A VPN service is a service that encrypts the connection between your device and a VPN provider's server, then routes your internet traffic through that server. Websites usually see the VPN server's IP address instead of your home or mobile IP address.
This guide was updated on ****. In the common consumer setup, a VPN connection works in five steps.
VPN Service at a Glance
| Question | Short answer |
|---|---|
| What does VPN stand for? | Virtual private network |
| What does a VPN do? | Encrypts traffic between your device and the VPN server |
| What IP address do websites see? | Usually the VPN server's IP address |
| Who commonly uses VPNs? | Individuals, remote workers, businesses and organizations |
| Does a VPN make you anonymous? | No. Websites can still identify you through logins, cookies and device fingerprinting |
| Does a VPN replace antivirus software? | No. A VPN does not stop malware, phishing or unsafe downloads |
| Is a VPN always necessary? | No. It is most useful for privacy, public Wi-Fi and secure remote access |
How Does a VPN Service Work?
A VPN service works by creating an encrypted tunnel between your device and a VPN server. The usual process is:
- You install a VPN app or configure VPN software on your device.
- The app authenticates you with the VPN provider.
- Your device establishes an encrypted tunnel to a VPN server.
- Your internet traffic travels through that server.
- Websites receive requests from the VPN server's IP address instead of your home or mobile IP address.
Your internet service provider can usually see that you are connected to a VPN. It cannot read the traffic passing through the encrypted connection in the same way it could without the VPN. The VPN provider becomes another important party in the connection because it operates the server carrying your traffic.
NIST defines a virtual private network as a virtual network built over existing networks that provides a secure communication mechanism for data and IP information. VPNs commonly use encryption, authentication and tunneling to protect communications across public networks such as the internet.
What Is a VPN Used For?
A VPN is used to add privacy to internet connections, protect traffic on shared networks and provide remote access to private business systems.
Protecting Connections on Public Wi-Fi
A VPN can add protection when you connect through Wi-Fi at an airport, hotel, café, library or another shared location. It makes it harder for someone monitoring the local network to inspect traffic that is not already encrypted.
Most major websites now use HTTPS, so public Wi-Fi is safer than it was in the past. A VPN can still add a privacy layer, especially for connection details that HTTPS does not hide from the local network or your internet provider.
Reducing Exposure to Your Internet Provider
Without a VPN, your internet service provider can observe information about your internet connections, including the domains you access. With a VPN, your provider sees a connection to the VPN service and encrypted traffic passing through it.
The activity has not disappeared. The VPN provider can become able to observe or handle information about the connection, so its privacy policy, technical controls and data-retention practices matter.
Hiding Your Public IP Address
A VPN replaces your visible public IP address with the IP address of the VPN server. This can make your approximate network location less obvious to websites and advertising systems.
A VPN does not remove every form of identification. Websites may still recognize you when you sign in, use cookies or rely on browser and device characteristics.
Connecting to a Business Network Remotely
Organizations use VPNs to give employees secure remote access to internal systems, applications and company resources. A business VPN can connect an individual device to a corporate network or connect separate office networks across the internet.
What Does a VPN Not Protect Against?
A VPN does not protect against every online threat. It is a security and privacy tool, not a complete cybersecurity system.
A VPN does not automatically:
- Make you anonymous online
- Stop malware, ransomware or phishing
- Prevent a website from identifying you after you log in
- Protect accounts with weak or reused passwords
- Secure a device that is already infected
- Guarantee access to every streaming service or website
- Prevent the VPN provider from collecting data
- Eliminate tracking based on cookies, accounts or device fingerprints
CISA warns that VPNs can contain vulnerabilities and that a VPN is only as secure as the devices connected to it. Businesses must patch VPN systems, configure them securely and restrict access appropriately.
What Are the Main Types of VPN Services?
VPN services generally fall into four categories:
| Type of VPN | Main purpose | Typical user |
|---|---|---|
| Consumer VPN | Protects a person's internet connection and routes traffic through provider-operated servers | Individual users |
| Remote-access VPN | Connects an authorized user to an organization's private network | Employees and contractors |
| Site-to-site VPN | Connects two or more private networks across the internet | Businesses with multiple offices |
| Browser VPN or proxy extension | Routes browser traffic through an intermediary server | Users who want browser-only routing |
A consumer VPN is usually sold as a monthly or annual subscription with an app for computers, smartphones and tablets. A business VPN is managed by an organization and tied to user accounts, network permissions and security policies.
Is a VPN Service Worth Using?
A VPN is worth considering if you regularly use public Wi-Fi, travel frequently, want to reduce your internet provider's visibility into your browsing destinations or need secure access to a workplace or school network.
You may not need a VPN if your only concern is protecting passwords and payment information on websites. HTTPS already encrypts traffic between your browser and HTTPS-enabled websites. A VPN can complement HTTPS, but it does not replace secure websites, strong passwords, multifactor authentication, software updates or antivirus protection.
How to Choose a VPN Service
Before subscribing, check the following:
- Privacy policy: Find out what connection data the provider collects, how long it keeps that data and whether it shares information with third parties.
- Independent security reviews: Look for credible audits or testing instead of relying only on claims such as "military-grade" encryption or "complete anonymity."
- Modern security protocols: Avoid services that depend on outdated or unsupported protocols.
- Device coverage: Check whether the service supports your operating systems and the number of devices you use.
- Performance: Server distance, network capacity and VPN configuration can affect speed.
- Transparency: Prefer providers that clearly identify their company, ownership, policies and technical practices.
- Free-service business model: A free VPN may earn revenue through advertising, data collection or restricted features. Read the privacy policy before using one.
Consumer Reports found that VPN services vary in their privacy practices, security controls and marketing claims. Using a VPN transfers some trust from your internet provider to the VPN company, so the provider's policies and technical practices deserve close attention.
VPN Service vs. Proxy Server
A VPN typically protects traffic from the device to the VPN server and can cover multiple applications on the device. A proxy usually routes traffic for a specific application, such as a web browser, and may not encrypt the connection.
The exact behavior depends on the product and its configuration. A VPN is usually the more complete option when the goal is device-wide connection privacy.
Bottom Line
Use a VPN when you need an added privacy layer on public Wi-Fi, want websites to see a VPN server's IP address or need secure remote access to a private network.
A VPN does not make you anonymous and does not stop every online threat. Choose a provider with clear data practices, credible security information and claims that match what the service can actually do.