The short answer
A VPN (virtual private network) creates an encrypted tunnel between your device and a server run by the VPN company. Everything you do online passes through that tunnel. This does two things:
- The network you are on cannot see what you are doing. Your internet provider, the café Wi-Fi or the hotel network sees only that you are connected to a VPN.
- Websites see the VPN server's location and IP address, not yours.
That is genuinely useful in some situations. But a VPN is not an all-purpose security tool, and much VPN advertising oversells it.
How a VPN works
Without a VPN, your device sends traffic to your router, then to your internet provider, then to the website. Your provider can see which sites you visit, even when the content itself is protected by HTTPS.
With a VPN:
- Your device encrypts the traffic and sends it to the VPN server.
- The VPN server decrypts it and sends it on to the website.
- The website replies to the VPN server, which sends it back to you through the tunnel.
So the trust shifts. Instead of your internet provider seeing your browsing, the VPN company can. Choosing a trustworthy one is the whole game.
When a VPN genuinely helps
- Public Wi-Fi in cafés, airports and hotels, especially networks with no password. A VPN stops others on the network, or a fake hotspot, from snooping. (Most sites already use HTTPS, so the risk is lower than it was, but a VPN adds a layer.)
- Hiding browsing from your internet provider, which in some countries can log and use that data.
- Travel, to reach your home banking or services that block foreign connections.
- Work, where employers use VPNs to give secure access to internal systems.
- Journalists, activists and people at risk, who may need stronger tools as well, such as Tor.
What a VPN does not do
| Claim | Reality |
|---|---|
| "Makes you anonymous" | Signing in to Google, Facebook or any account identifies you, VPN or not |
| "Protects you from hackers" | It does not stop phishing, malware, weak passwords or scams |
| "Blocks tracking" | Cookies and fingerprinting still work; some VPNs add an ad blocker, but that is a separate feature |
| "Military-grade encryption" | Marketing language for standard encryption that HTTPS also uses |
| "Required for safe banking" | Banking sites already encrypt your connection |
The threats most people actually face are scam texts and phishing emails, reused passwords and unpatched devices. A VPN helps with none of them. Two-factor authentication and a password manager do far more.
How to choose a VPN
- Avoid free VPN apps from unknown companies. Running servers costs money. Free services that are not backed by a known company often make money by collecting and selling data, showing intrusive ads, or worse. Some free VPN apps have been found to contain malware. The safer free options are limited free tiers from established paid providers.
- Look for an independently audited no-logs policy, ideally audited more than once by a recognised security firm. A no-logs claim without an audit is just a claim.
- Check the jurisdiction and ownership. Know who owns the company and where it is based.
- Use modern protocols such as WireGuard or OpenVPN, and a kill switch that blocks traffic if the VPN drops.
- Ignore "lifetime" deals and aggressive countdown discounts.
- Read independent reviews, not affiliate lists that rank whichever provider pays the most.
VPNs and the law
Using a VPN is legal in most countries. Some ban them entirely, restrict them to approved providers, or require businesses to register their VPNs, and the rules change. Before travelling, check the rules for your destination. Using a VPN does not make illegal activity legal, and using one to get around a streaming service's regional restrictions usually breaks its terms of service.
Setting one up
Most reputable VPNs work the same way:
- Install the official app from the provider's site or your device's app store.
- Sign in and choose auto-connect on untrusted Wi-Fi.
- Turn on the kill switch.
- Pick the nearest server for speed, unless you need a specific country.
For the broader set of privacy habits, see our guide to protecting your privacy online.
Key takeaways
- A VPN hides your traffic from the local network and your location from websites.
- It moves trust from your internet provider to the VPN company, so choose carefully.
- It is most useful on public Wi-Fi and while travelling.
- It does not stop scams, malware or tracking through accounts. Strong passwords and 2FA matter more.