Disclosure: This post contains affiliate links; we may earn a commission at no extra cost to you.
A VPN — virtual private network — is software that encrypts your internet traffic and routes it through a server run by the VPN company before it reaches its destination. To your internet provider, the websites you visit, and anyone monitoring the network you’re connected to, it looks like you’re only ever talking to that one VPN server; what you’re actually doing on the internet is hidden inside the encrypted tunnel. This is the whole mechanism — everything else (server locations, no-logs policies, kill switches) is built on top of that one basic function.
The mechanism, step by step
When you turn on a VPN app, it establishes an encrypted connection — called a tunnel — between your device and a server operated by the VPN provider, often in a city or country you pick from a list. Your device then routes all (or most) of its internet traffic through that tunnel. The VPN server decrypts your request, sends it out to the real destination (a website, an app’s backend, a streaming service) using its own IP address instead of yours, gets the response, encrypts it, and sends it back through the tunnel to you. Two things change as a result: your internet provider can see that you’re connected to a VPN server and how much data is passing through, but not what sites you’re actually visiting; and any website you visit sees the VPN server’s IP address and location instead of your own.
The protocols doing the actual encrypting
Most VPNs today default to WireGuard, a newer protocol that’s faster and uses less battery than older options because its codebase is smaller and simpler to audit. OpenVPN is the older, extremely well-tested alternative — slightly slower, but it’s been picked apart by security researchers for two decades with no major flaws found, which is why some privacy-focused users still prefer it. IKEv2 is common on mobile because it reconnects fast when you switch between WiFi and cellular, which matters for a phone but less for a desktop that rarely changes networks. Nearly every reputable VPN app today, including NordVPN and Proton VPN, defaults to WireGuard for most connections and lets you switch protocols manually in settings if you hit a specific compatibility issue.
What a VPN actually protects you from
On public WiFi (coffee shops, airports, hotels), a VPN prevents anyone else on that same network from snooping on your unencrypted traffic — a real risk on open networks with no password. It stops your internet provider from logging which sites you visit, which matters in places where ISPs sell browsing data or throttle specific types of traffic (streaming, torrenting) once they detect it. And it lets you connect through a server in another country, which is the mechanism behind unblocking region-locked content or accessing a site that’s blocked in your country entirely.
What a VPN does NOT do
This is the part most marketing pages skip. A VPN does not make you anonymous — if you log into Gmail, Facebook, or Amazon through a VPN, those services still know exactly who you are regardless of what IP address you’re connecting from. It doesn’t stop browser fingerprinting or cookie-based tracking, which identify you by device and behavior patterns rather than IP address — that requires separate tools like tracker-blocking browser extensions. It doesn’t protect you from malware, phishing links, or a compromised password (some VPNs bundle a separate threat-blocking feature for this, but the VPN tunnel itself doesn’t do it). And it doesn’t guarantee a service’s geo-restriction won’t detect and block VPN traffic — major streaming services actively maintain blocklists of known VPN server IPs, which is why some servers work for Netflix one month and stop working the next.
Do you actually need one?
A VPN is genuinely useful if you regularly use public WiFi, want your ISP out of your browsing data, travel to or live in a country with content restrictions, or occasionally need to access a service that’s geo-blocked in your region. It’s less necessary if you mostly browse at home on a trusted network and aren’t worried about ISP-level tracking — though even then, plenty of people run one as a low-effort default. It is not, on its own, a substitute for basic account security: use a password manager and two-factor authentication regardless of whether you run a VPN.
What to actually look for when picking one
Skip the marketing checklists (“military-grade encryption,” “blazing speeds”) and look at four things instead: a no-logs policy that’s been independently audited (not just self-declared), a kill switch that cuts your internet if the VPN drops so nothing leaks unencrypted, WireGuard support since it’s the fastest well-vetted protocol available, and enough simultaneous device connections to cover your household or personal device count without paying for a second subscription. A large server count matters mainly for streaming and finding an uncongested connection at peak hours — a provider with 500 well-maintained servers can outperform one with 5,000 poorly-distributed ones, so treat server count as a secondary signal, not the deciding factor.
FAQ
Does a VPN slow down my internet?
Yes, some — encrypting and rerouting traffic adds overhead. With a modern protocol like WireGuard on a nearby, uncongested server, the slowdown is often small enough not to notice on a normal broadband connection; it becomes more noticeable on already-slow connections or distant servers.
Is it legal to use a VPN?
In most countries, yes — VPNs are legal and widely used by businesses for remote access alone. A handful of countries (China, Russia, UAE, and a few others) restrict or ban VPN use for individuals, or only permit government-approved ones, so check local law if you’re traveling somewhere with tight internet controls.
Can my employer or school see what I do through a VPN?
If you’re on their network and using a personal VPN app, they can typically see that a VPN connection is active but not the encrypted contents inside it — though many workplace and school networks explicitly block VPN traffic outright.
Do free VPNs work the same way?
Mechanically, yes, but many free VPNs fund themselves by logging and selling usage data or injecting ads — the opposite of what most people want a VPN for. A handful of paid providers offer genuinely no-logs free tiers (Proton VPN is one), but a free VPN of unknown origin is a bigger privacy risk than no VPN at all.
