VPNs Explained: What a VPN Does, What It Does Not, and When You Need One
A VPN routes your traffic through an encrypted tunnel to someone else’s server. That changes who can watch it — your ISP, or the VPN provider — and nothing more magical than that.
A VPN does one job well: it moves where your internet traffic appears to come from, and who can watch it on the way. It does not make you invisible, and it does not turn a risky click into a safe one. The Electronic Frontier Foundation puts it plainly: when you connect to a VPN, the data you send appears to originate from the VPN itself, rather than from your internet service provider, which masks your IP address. A VPN is also no substitute for unique passwords, covered in our guide to password managers. Mullvad, a commercial provider, describes the same mechanism from the other side: with a VPN, your traffic is encrypted and sent to a VPN server before it travels on to the site you want to visit, so your ISP cannot see which sites you visit. Everything useful — and everything disappointing — about a VPN follows from those two sentences.
Highlights
- A VPN creates an encrypted tunnel to a server run by the provider; sites then see that server’s IP address, not yours.
- Trust does not disappear — it moves from your ISP and the local network to the VPN provider, which sits in the position they occupied.
- A VPN is not an anonymity tool: cookies, fingerprinting, accounts you sign into and information you type in can still identify you.
- “No-logs” is a policy claim you cannot verify from outside. Audits and transparency can support it, but they are not a guarantee of future behaviour.
- Most websites now use HTTPS, so a VPN is less essential on public Wi-Fi than older advice suggested — it still hides metadata and destinations from the local network and your ISP.
What a VPN actually does
VPN stands for Virtual Private Network. In the consumer version sold to individuals, you install an app, sign in, and connect. From that moment, your device’s traffic is packaged into an encrypted tunnel between your device and a server operated by the VPN provider. The traffic leaves that server and continues to its real destination. Three things change as a result.
First, the website or service at the other end sees the VPN server’s IP address instead of the address assigned to your home or mobile connection. Second, your internet service provider can see that you are connected to a VPN, but not the destinations beyond it. Third, anyone watching the local network sees encrypted traffic to one destination, the VPN server, rather than a readable list of the sites you visit.
Trust moves. It does not disappear
Here is the part the advertisements leave out. The traffic has to be decrypted at the VPN’s end before it travels onward, which means the provider can potentially see what your ISP could have seen: which services you connect to and when. The US Federal Trade Commission makes the same point about VPN apps: using one just shifts trust from those networks to the VPN app provider. You have not removed a watcher. You have chosen a different one.
That choice can still be a good trade. The EFF notes that, according to a 2021 FTC report it cites, ISPs in the United States share more of your browsing data with third parties than you might expect. If you would rather place that trust in a provider you selected, whose privacy policy you have read and whose business is selling the tunnel itself, a VPN gives you that option.
What a VPN does not do
It does not make you anonymous. The FTC states that a VPN app generally is not going to make you entirely anonymous, and the EFF lists why: companies can still track you through GPS, web cookies, tracking pixels and browser fingerprinting, none of which a tunnel touches.
It does not add end-to-end encryption where HTTPS already provides it. The EFF explains that HTTPS protects the content of your communications — the pages you view on a site, your login name and your messages — while observers along the path can usually still see the domain names you visit and when. A VPN hides that metadata from your ISP and the local network, but the provider sees it instead.
It does not protect you from malware, phishing or scams. A tunnel delivers traffic; it does not judge it. The FTC’s public Wi-Fi guidance warns that scammers create fake websites and encrypt them too: if you visit a scammer’s website, your data may be encrypted on its way to the site, but it will not be safe from the scammers operating it. The EFF is equally direct that a VPN is not a security multi-tool, and lists more impactful steps first — strong passwords, two-factor authentication, software updates, device encryption and tracker blocking among them.
The “no-logs” claim problem
Almost every provider promises not to log your activity. Treat that sentence correctly: it is a claim in a policy document, not a fact you can test. The EFF warns readers that a claim is not a guarantee, advises digging into the privacy policy to see how data is handled and monetised, and suggests treating impossible marketing claims as a warning sign about the provider generally.
There are stronger and weaker forms of evidence, and it helps to rank them honestly. A clear, specific policy that rules out collecting connection data is better than a slogan. Some providers also commission independent audits of their apps or infrastructure; Mullvad, for example, states that it requests independent audits of its app and infrastructure to provide transparency and improve security. The EFF notes that public audit results can reveal vulnerabilities and signal that a provider takes security seriously — while also warning that there is no certainty practices will not change after an audit, especially under government pressure. An audit is a dated inspection, not a permanent certificate.
When a VPN genuinely helps
There are real cases. On a public network you do not trust — where you do not know who runs the Wi-Fi or who its ISP is — the EFF says a VPN you trust may be useful, because it protects metadata and any unencrypted traffic from local observers.
A VPN also helps if your concern is your ISP itself: it prevents the provider of your connection from seeing the destinations you visit, subject to the trade described above — the VPN provider now occupies that position. For travel, connecting to a server in your home country can make services treat you as if you were at home, and the EFF notes VPNs can bypass some geographic restrictions or bans by making it appear you are connecting from a different location. Finally, the EFF identifies circumventing internet censorship on a network that blocks certain sites or services as one of the two circumstances where VPNs are most useful — while noting that whether it works depends on the censorship you face and on local law, which you should check before relying on it.
When a VPN is pointless — or makes things worse
If your goal is to stop advertisers following you around the web, a VPN alone will disappoint you, because cookies, accounts and fingerprinting survive the tunnel. If your goal is protection from phishing or malicious downloads, a VPN is simply the wrong tool. And if the provider is worse than the network you were avoiding, you have traded down. That risk is highest with free apps from companies you cannot identify. The FTC found that many VPN apps are free because they sell advertising within the app, or because they share your information with, or redirect your traffic through, third parties — and it cites researchers who studied almost 300 VPN apps and found some that did not use encryption at all, some that asked for sensitive and possibly unexpected permissions, and some that shared data with third parties. Giving such an app permission to intercept all of your traffic is the opposite of the protection the icon on your home screen suggests.
Protocols, in one paragraph
Underneath the app, a protocol does the encrypting. The EFF advises checking that a provider uses OpenVPN or WireGuard, which have become common, and warns against the older PPTP protocol, whose broken encryption can be decrypted and viewed. The WireGuard project describes its own design as simple, fast and modern, built with a minimal attack surface so the code is easier to audit.
Related Guides
- How to Use a VPN: A Step-by-Step Guide for Every Device
- Free VPN vs Paid VPN: What You Actually Give Up
- 7 VPN Myths That Could Leave You Exposed
- How to Choose a VPN: A Practical Checklist That Cuts Through the Marketing
- VPN Protocols Explained: WireGuard, OpenVPN and IKEv2 in Plain English
What this means
For a US reader, the practical meaning of all this is that a VPN is a trust decision, not a safety switch. Your home ISP is not a neutral pipe: the EFF, citing the FTC’s 2021 report, notes that US ISPs share more browsing data with third parties than most subscribers expect. A reputable VPN can take your ISP out of the audience for your destinations — but it seats the VPN provider in the same chair. So the comparison that matters is not “VPN versus no VPN.” It is “this provider, with this policy, this business model and this record, versus my ISP and the networks I actually use.”
It also means recalibrating what you expect day to day. A VPN will not stop the tracking that follows you through accounts, cookies and fingerprints, will not rescue you from a convincing phishing page, and will not make a scam site safe because the connection to it was encrypted. Where a VPN earns its place is narrower and specific: networks you do not control and do not trust, an ISP whose data practices you object to, travel where you need to appear at home or reach services blocked on a local network, and censorship you are lawfully trying to work around. If none of those describes your week, you may not need one at all, and the honest answer to “should I buy a VPN?” is sometimes no.
Finally, it means reading “no-logs” and “anonymous” on a sales page the way you would read any other unverifiable promise: as the start of a check, not the end of one. Look for a specific policy, a named company, a comprehensible way of making money and, where it exists, an audit you can actually read about — then hold the claim at the strength the evidence supports. A VPN used with that understanding is a legitimate, useful tool. A VPN used as a talisman is worse than useless, because it encourages you to take risks on the strength of protection you do not have.
Bottom line
A VPN moves trust; it does not delete it. Choose one when you would rather trust a reputable, audited provider than your ISP and the networks you pass through — and expect it to do that one job well, not ten jobs badly.
Read Next
Sources
- Electronic Frontier Foundation, Surveillance Self-Defense, “Choosing the VPN That’s Right for You” — https://ssd.eff.org/ps/module/vpn (accessed 7 November 2026)
- Mullvad VPN, “What is a VPN?” / Mullvad VPN product page — https://mullvad.net/en/vpn (accessed 7 November 2026)
- Federal Trade Commission, “In the market for a VPN app?” — https://www.ftc.gov/business-guidance/blog/2018/02/market-vpn-app (accessed 7 November 2026)
- Federal Trade Commission, Consumer Advice, “Are Public Wi-Fi Networks Safe? What You Need To Know” — https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know (accessed 7 November 2026)
