A VPN protects your internet connection by encrypting traffic between your device and a VPN server, hiding your real IP address from the websites you visit, and reducing what your internet service provider or local Wi-Fi operator can see.
Reviewed on ****. A VPN does not make you completely anonymous or protect you from every online threat. In a typical setup, the VPN protects 1 main link: the connection between your device and the VPN server.
VPN Protection at a Glance
| A VPN helps protect against | What it does |
|---|---|
| Public Wi-Fi snooping | Encrypts traffic between your device and the VPN server |
| ISP access to connection contents | Prevents your ISP from directly reading the contents of the VPN tunnel |
| Websites seeing your home IP address | Replaces your visible IP address with the VPN server's IP address |
| Some network-based tracking | Makes your connection appear to come from the VPN server |
| Remote-work interception | A business VPN can create a protected connection to an organisation's network |
A VPN does not replace HTTPS, antivirus software, strong passwords, multifactor authentication or safe browsing habits.
How Does a VPN Work?
A VPN client encrypts your traffic before it leaves your device. The VPN server then decrypts and forwards that traffic to its destination.
Without a VPN, the connection generally follows this path:
Your device → Wi-Fi router or ISP → Website
With a VPN, it looks like this:
Your device → Encrypted VPN tunnel → VPN server → Website
NIST describes VPNs as virtual networks that use encryption and tunnelling to create secure communications over public networks.
The VPN usually protects the connection between your device and the VPN server. It does not automatically encrypt every connection after the VPN server. HTTPS provides separate encryption between your browser or app and the website.
What Does a VPN Protect You From?
A VPN mainly protects against risks connected to the network carrying your traffic. It can also hide your normal IP address from the websites you visit.
1. People Snooping on Public Wi-Fi
A VPN can reduce the risk of someone on the same coffee-shop, hotel or airport Wi-Fi network intercepting your traffic. The person monitoring the local network sees an encrypted connection to the VPN server instead of the contents of the VPN tunnel.
Public Wi-Fi still requires care. The Federal Trade Commission recommends checking for HTTPS because website encryption protects the data sent between your device and that particular website.
A VPN is useful when you are:
- Using unfamiliar Wi-Fi
- Working remotely
- Travelling
- Accessing business systems outside the office
- Unsure whether to trust the network operator
2. Websites Seeing Your Real IP Address
Websites normally receive the IP address of the connection that reaches them. When you use a VPN, a website generally sees the VPN server's IP address instead of your home or mobile IP address.
This can hide your approximate network location and make your connection appear to come from the VPN server's location. An IP address is only one way to identify someone, though. A website can still recognise you through an account login, cookies, browser fingerprinting, payment details or information you provide yourself.
A VPN provides IP address privacy, not guaranteed anonymity.
3. Your ISP Seeing the Contents of Your Connection
When a full-device VPN is working correctly, your internet service provider can usually see that your device is connected to a VPN server. It may also see connection details such as timing and data volume.
The ISP should not be able to directly read the contents of the encrypted VPN tunnel or see the final websites as plainly as it could without a VPN.
The VPN provider becomes the network intermediary instead. You are shifting some trust from your ISP to the VPN company. Depending on the service and whether HTTPS is in use, the provider may be able to observe connection details or more of the traffic. Its privacy policy, technical design and logging practices matter.
What Can Different Parties See When You Use a VPN?
Different parties can see different parts of the connection:
| Party | What it may see |
|---|---|
| Local Wi-Fi operator | That your device is connected to a VPN, plus some connection metadata |
| Internet service provider | Your connection to the VPN, timing and data volume, but normally not the contents of the encrypted tunnel |
| VPN provider | Your connection source, VPN activity and potentially traffic metadata; logging depends on the provider |
| Website or online service | The VPN server's IP address, plus account, cookie, browser or device information it can collect |
A VPN changes who handles your connection. It does not make your online activity invisible.
What a VPN Does Not Protect You From
A VPN protects a network connection. It does not fix problems with your device, account or the website you choose to use.
Malware and Ransomware
A VPN does not stop malicious software from infecting your device. Malware can arrive through unsafe downloads, compromised websites, email attachments or phishing messages.
The FTC recommends keeping your operating system, browser and security software updated. It also advises avoiding unexpected links and attachments.
Phishing Websites and Scams
A VPN can encrypt your connection to a fraudulent website. It cannot make that website trustworthy.
If you enter a password or card details into a phishing site, the VPN may protect the connection while still sending your information to the scammer.
Tracking Through Accounts and Cookies
A VPN does not prevent a website from knowing who you are when you sign in. Google, Facebook, Amazon, banks and other services can connect activity to your account.
Cookies, advertising identifiers and browser fingerprinting can also recognise a device without relying on its IP address.
Unsafe Websites and Unencrypted HTTP
A VPN does not make an untrustworthy or poorly secured website safe. Check for HTTPS before entering passwords, financial details or other personal information.
HTTPS and VPN encryption protect different parts of the connection.
Activity Outside the VPN Tunnel
A full-device VPN can protect traffic from supported apps, but browser-only proxies and split-tunnelling settings may cover only selected traffic.
For example, Mozilla states that its Firefox proxy feature does not route traffic from other applications on the device.
Is a VPN Worth Using?
A VPN is worth using when your main concern is network privacy or connection security. Public Wi-Fi, remote work and travel are common use cases. A VPN can also keep websites from receiving your normal IP address.
A VPN is not the right tool if you expect it to:
- Make you completely anonymous
- Stop phishing attacks
- Remove malware
- Prevent all online tracking
- Protect an already compromised device
- Secure accounts with weak or reused passwords
For wider protection, combine a VPN with HTTPS, automatic software updates, reputable security software, unique passwords and multifactor authentication. The FTC identifies multifactor authentication as a useful defence because it can make account access harder even when a password is stolen.
Bottom Line
Use a VPN when the risk is the network carrying your traffic. Use other security measures when the risk is your account, device or the website itself.