How VPNs Work
VPN ads promise total privacy and security. The truth is narrower: a VPN moves who can see your traffic from one company to another. Learn what it really hides, when it's worth it, and how to avoid the risky ones. Flip the switches to see who can see what.
What a VPN actually does
Normally your phone or computer sends traffic through the Wi-Fi network you're on, then your internet provider (ISP), then out to the website. If you're new to how that works, see How the Internet Works.
A VPN (virtual private network) app creates an encrypted tunnel from your device to a server run by the VPN company. All your traffic goes through the tunnel first, then out to the internet from the VPN's server.
Two things change:
- The local network and your ISP can't see which sites you visit, only that you're connected to a VPN.
- Websites see the VPN server's IP address instead of yours, so they can't tell your rough location from it.
The catch: the VPN company can now see what your ISP used to see. You're not removing the middleman, you're choosing a different one. So the VPN you pick matters a lot.
HTTPS already protects a lot
Most websites now use HTTPS (the padlock in the address bar). HTTPS encrypts everything between your browser and the site: the pages you read, what you type, your passwords and card numbers. The FTC notes that because encryption is now so widespread, using public Wi-Fi is usually safe.
What HTTPS doesn't hide is which site you're connecting to (like example.com) and your IP address. That's the gap a VPN fills. Flip the switches below to see the difference.
A little more nuance: some browsers and devices can encrypt the website lookups (DNS) too, which hides a bit more from the Wi-Fi owner and ISP even without a VPN. And the website always sees what you do on it, with or without a VPN.
When a VPN is useful
- Public or untrusted Wi-Fi: at a coffee shop, airport or hotel, a VPN keeps the network owner (or anyone running a fake hotspot with a similar name) from seeing which sites you visit. The FTC has long pointed to VPN apps as a way to shield information sent over public, open Wi-Fi.
- Travel: hotel and foreign networks are run by people you don't know. A VPN adds a layer of privacy. Some services, like your bank, may flag logins from unusual locations, so pick a server in your home country.
- Privacy from your ISP: your internet provider can see which sites you connect to. A VPN hides that from them (and shows it to the VPN instead).
- Work: employers use VPNs so staff can reach private company systems from home. That's a different job from a consumer privacy VPN, and you should only use it the way your employer allows.
- Changing your apparent location: people use VPNs to see content for another region. Many streaming services' terms forbid this and they often block VPN addresses.
VPN laws vary. VPNs are legal in the US, but some countries restrict or ban them. Check before you travel, and never use a VPN to do something that's illegal without one.
What a VPN can't do
| Myth | Reality |
|---|---|
| “A VPN makes me anonymous.” | The VPN knows who you are (it has your payment and your real IP). If you sign in to a site, the site knows it's you. |
| “A VPN stops tracking.” | Cookies, ad trackers, your browser's fingerprint and logged-in accounts still track you. Use your browser's privacy settings for that. |
| “A VPN protects me from hackers.” | It doesn't stop phishing, scam sites, malware you download, or weak and reused passwords. |
| “A VPN keeps my data from the website.” | The website gets everything you type into it, as always. |
| “Any VPN is better than none.” | A shady VPN can see your traffic and may log or sell it. That can be worse than no VPN at all. |
CISA, the US cybersecurity agency, makes the same point in its mobile security guidance for people at high risk of being targeted: it advises against personal VPNs, because they shift risk from your ISP to the VPN provider, and many providers have questionable security and privacy policies.
Things that protect you more than a VPN for everyday safety: keeping devices updated, strong, unique passwords, two-factor authentication, and spotting scams.
Choosing a VPN, and why free ones are risky
The FTC's checklist before you install
- Research the app and company before downloading. Look for independent reviews and who actually runs it.
- Check the permissions it asks for. A VPN doesn't need your contacts or photos.
- Make sure it actually encrypts your traffic. Some apps marketed as VPNs don't.
- Find out whether it shares your data with third parties, like advertisers. Read the privacy policy.
What else to look for
- A no-logs policy that's been independently audited, not just promised.
- Modern protocols such as WireGuard, OpenVPN or IKEv2.
- A kill switch that blocks internet if the VPN drops, so traffic doesn't leak outside the tunnel.
- A clear business model. If you're not paying, ask how the company makes money.
Free VPN risks: running servers costs money. Free VPNs may pay for it by showing ads, tracking what you do, selling data, or limiting speed and data. Some fake “VPN” apps contain malware. If you need a VPN, a reputable paid one, or one included with a security product or service you already trust, is usually safer.
Set it up and test it
- Download the app from the official app store or the company's own website.
- Sign in, turn on the kill switch, and set it to connect automatically on untrusted Wi-Fi if it offers that.
- Connect, then search “what is my IP” in your browser. The location shown should be the VPN server's, not yours.
- Remember to keep checking for the padlock. The VPN doesn't replace HTTPS.
FAQCommon questions
Do I need a VPN at home?
For security, usually not, as long as your home Wi-Fi has a strong password and you use HTTPS sites. A VPN at home mainly hides which sites you visit from your ISP, and shows them to the VPN company instead.
Is public Wi-Fi safe without a VPN?
The FTC says it's usually safe today because most sites use encryption. Stick to HTTPS sites, don't ignore browser security warnings, and use a VPN or your phone's cellular data if you want the network owner to see less.
Does a VPN slow down my internet?
A little, because traffic takes a detour through the VPN server. Picking a server close to you usually keeps the slowdown small.
Can my employer or school see my browsing if I use a VPN?
On their network, they'd see that you're using a VPN, not the sites. But if it's their device, they may have monitoring software on it that sees everything regardless. And their rules may forbid VPNs.
Is a VPN the same as private or incognito browsing?
No. Incognito mode only stops your own browser from saving history and cookies after you close it. It doesn't hide anything from the network, your ISP or websites.
Can the police or a court get my VPN data?
A VPN company has to follow the laws where it operates. If it keeps logs, they can be requested. That's why an independently audited no-logs policy matters.