VPN explained: what it protects and what it does not

Updated: Oct 28, 2026

A virtual private network is marketed as a switch that makes you anonymous, secure and invisible. It is none of those things. What a VPN actually does is precise and useful: it carries your internet traffic through an encrypted tunnel to a server elsewhere, so that the network you are on cannot see where the traffic goes and the sites you reach see the VPN server’s address instead of yours. Understanding exactly what moves and what does not is the difference between using a VPN well and paying for false comfort.

The encrypted tunnel and the VPN server

Normally your device sends packets to your router, which forwards them through your internet provider to the destination. Everyone on that path sees the destination address and, for unencrypted traffic, the content. With a VPN active, the device wraps every packet inside an encrypted packet addressed to the VPN server. The local network and provider see only a stream of encrypted data to one address. The VPN server unwraps the packets and sends them on to their real destinations, receiving the replies and tunnelling them back. From the destination’s point of view, the traffic came from the VPN server.

Protocols in common use are WireGuard (modern, fast, small code base), OpenVPN (older, flexible, widely supported) and IPsec/IKEv2 (built into most operating systems). All provide strong encryption when configured correctly; WireGuard is the default choice for new deployments.

What a VPN actually does

• Hides your traffic from the local network. The café, hotel, airport or employer running the Wi-Fi sees only the tunnel. This is the strongest real-world benefit, and it also blocks the fake captive-portal tricks used on public Wi-Fi.
• Hides destinations from your internet provider. Providers in many countries log or sell browsing metadata; a VPN moves that visibility to the VPN operator instead.
• Changes your apparent location. Websites see the server’s address and country, which affects region-locked content, pricing and some censorship filters.
• Connects you into a private network. The original use: reaching an office or home network’s internal services as if you were on site.

What a VPN does not do

• It does not make you anonymous. You are logged into Google, Facebook and your email; cookies and browser fingerprints identify you regardless of address. The VPN operator, meanwhile, sees everything your provider used to see.
• It does not encrypt traffic beyond the VPN server. From the server to the website, traffic is exactly as protected as it would have been without the VPN: HTTPS traffic stays encrypted, plain HTTP is plain.
• It does not stop malware, phishing or tracking. Those operate at the level of the site and the browser, above the tunnel.
• It does not hide you from the sites you log into. They know who you are because you told them.
• It does not guarantee legality or safety. A VPN operator with poor security or a logging policy is a single point where all your traffic can be observed.

Choosing a provider, or running your own

The VPN operator replaces your provider as the party that can see your traffic, so the choice is about trust. Look for: a clear no-logging policy that has been independently audited or tested in court; a jurisdiction you are comfortable with; WireGuard support; open-source clients; a kill switch that blocks traffic if the tunnel drops; and a business model you understand. Free VPNs are funded somehow, often by selling the very data you are trying to protect, or by injecting advertisements. Browser “VPN” extensions are usually proxies that cover only the browser.

For reaching your own home or office, a self-hosted WireGuard server on a router, a small home server or a cheap virtual machine gives you full control and is now straightforward to set up. It does not hide your location from websites, since traffic exits from your own address, but it protects you on untrusted networks and reaches your internal services without exposing them to the internet.

Choosing and using a VPN sensibly

• Use a VPN on any network you do not control: public Wi-Fi, hotels, conferences.
• Do not expect anonymity; for that, the tools are the Tor Browser and separate identities, and even they have limits.
• Enable the kill switch so a dropped tunnel does not silently expose traffic.
• Prefer WireGuard and audited, paid providers; avoid free services.
• Consider a self-hosted WireGuard server for accessing devices at home instead of forwarding ports.
• Keep using HTTPS, a password manager and two-factor authentication; the VPN does not replace any of them.

Frequently asked questions

Does a VPN slow the connection?

Some, because traffic takes a detour and is encrypted. With WireGuard and a nearby server the cost is usually small; a distant server adds latency noticeably.

Can websites tell I am using a VPN?

Often, yes. Address ranges of commercial VPN servers are known and some services block or challenge them.

Is a VPN the same as a proxy?

A proxy relays traffic for one application, often without encryption. A VPN captures all traffic from the device and encrypts it. Browser “VPN” features are typically proxies.

A VPN moves trust from the network you are on to the operator you chose; it does not remove the need for trust.

In short: A VPN tunnels all your traffic, encrypted, to a server that forwards it on, hiding destinations from the local network and provider and presenting a different address to websites. It does not provide anonymity, does not protect traffic past the server and does not stop malware or tracking. Use it on untrusted networks, choose the operator carefully or run your own, and keep the rest of your security habits intact.