What is a VPN?
A virtual private network creates a protected connection to a VPN endpoint. It can change the public IP used by routed traffic, but it does not make every activity anonymous.
By Andreas Lazarou · Content reviewed 7 September 2026
How a VPN works
A VPN client establishes a tunnel to a server or gateway. Traffic selected by your routing configuration travels through that tunnel. With a consumer VPN, the provider usually forwards it to the public internet; with a work VPN, the destination may be an organisation’s private network.
For traffic that exits through a consumer VPN, a destination website generally sees the exit server’s IP address. It can still receive account details, cookies, and information your browser sends. HTTPS continues to protect the browser-to-website connection through the VPN.
The protocol determines how the connection authenticates peers and protects packets. For example, WireGuard uses the Noise handshake framework and ChaCha20-Poly1305 authenticated encryption. Other protocols use different designs. A cipher name alone does not establish the quality of the app, device, or provider.
Read how VPN tunnels work for the connection stages, or compare VPN and proxy coverage.
What a VPN can help with
- Access to a work network: an approved remote-access service can connect you to private resources. Follow your organisation’s configuration and access rules.
- Visibility on your local connection: a correctly configured encrypted tunnel limits what the local network and ISP can read from the traffic inside it. They can still observe the VPN endpoint, timing, and traffic volume.
- A different public exit address: websites generally see the VPN exit IP for routed connections. Location databases can associate that address with another region.
- Some separation from other peers: peer-to-peer participants may see the VPN exit address instead of the usual public address for traffic routed through it. This does not establish anonymity.
Public Wi-Fi is not automatically a plaintext connection: HTTPS already protects supported website traffic. A VPN adds a separate tunnel layer. The FTC’s public Wi-Fi guidance explains why checking the connection and using good account security still matter.
What a VPN cannot protect
- Accounts and browser tracking: logging in identifies your account. Cookies, fingerprinting, and information you submit can still connect activity to you.
- Compromised devices or phishing: routing through a VPN does not remove malware or make a fraudulent login page trustworthy.
- Every app or network path: split tunneling, DNS choices, IPv4/IPv6 settings, and app exclusions can leave traffic outside the tunnel.
- All provider visibility: the VPN operator processes connections. Evaluate its policy, ownership, jurisdiction, and the date and scope of any audit.
- Guaranteed speed, savings, or streaming: congestion, distance, service rules, account history, and location checks still apply. A different IP does not guarantee a lower price or access to a catalogue.
- Legal permission: technical access does not make an activity lawful. Read our guide to official VPN-law sources.
How to choose a VPN service
Start with the device and task you need to support. Compare app availability, routing controls, protocol options, the privacy policy, and the total subscription cost. Check which features are included in the particular plan and operating system.
Free and paid services vary. A free plan may have data, server, speed, or feature limits, but price alone does not establish whether a provider sells data or has a sound privacy policy. A paid subscription is also not proof of independent auditing or good performance.
Read the renewal price, upfront total, cancellation process, and refund eligibility. An advertised monthly equivalent may require a long prepaid term. A money-back offer is different from a free trial. Use our VPN buying checklist and provider reviews to compare these details.
What connection checks can tell you
- Compare public addresses. Record your normal public IP, connect the VPN, and check again. A different address shows a different exit route for that request; it does not prove encryption or coverage of every app.
- Review DNS behavior. Compare observed resolvers with your intended configuration. A resolver name alone does not prove that your full browsing history is exposed.
- Check browser connection behavior. WebRTC may reveal additional addresses or masked local identifiers. IPv4/IPv6 differences and browser settings need interpretation.
- Check disconnect behavior. Where appropriate, test your app’s kill switch and routing on your own devices. Record the configuration and what you actually observed.
Our IP lookup and WebRTC check explains the limits of its results. No single website check certifies a VPN or device as secure.
Frequently asked questions
Can I be tracked while using a VPN?
Yes. Accounts, cookies, fingerprinting, payment records, compromised devices, and other signals can identify or link activity. A VPN does not guarantee anonymity.
Will a VPN stop ISP throttling?
Not necessarily. The ISP still carries the tunnel traffic and can limit the connection. Performance depends on routing, network conditions, the service, and your configuration.
Does a VPN hide my exact location?
It can change the public IP used by routed traffic. Browser location permissions, device location services, account information, and other data can still reveal location.
Should I keep a VPN on all the time?
That depends on your needs, battery use, routing, local-device access, and network compatibility. Choose a configuration you understand and check that important apps behave as expected.