What is a VPN and how does it work? A plain-English guide

A VPN (virtual private network) is a service that sends your internet traffic through an encrypted tunnel to a server run by the VPN company, which then passes it on to the website or app you’re using. Your internet provider and the Wi-Fi network you’re on see only that you’re connected to that server, and the websites see the server’s IP address instead of yours.

That is genuinely useful, but much less than the adverts suggest. A VPN doesn’t make you anonymous, doesn’t stop most tracking and doesn’t protect you from scams. It moves the job of seeing your traffic from one company (your internet provider) to another (the VPN provider). This guide explains how it works, what it hides from whom, the features that matter, what it can’t do, and how to choose one if you decide you want it.

How does a VPN work?

Your device encrypts everything it sends and wraps it in packets addressed to the VPN server. The server unwraps and decrypts them, sends your requests on to the internet under its own IP address, and encrypts the replies on the way back to you.

The EFF’s Surveillance Self-Defense guide puts it simply: with a VPN, “all data that you send (such as the requests to servers when browsing the web) appears to originate from the VPN itself”, according to its module on choosing a VPN¹. Step by step:

1. You connect. The VPN app on your phone or computer and the VPN server prove who they are to each other and agree on fresh encryption keys. The rules for this are the VPN protocol, such as WireGuard or OpenVPN (see WireGuard vs OpenVPN).
2. Your traffic goes into the tunnel. The app routes your device’s internet traffic into a virtual network interface. Each packet is encrypted and wrapped inside a new packet addressed to the VPN server. Anyone in between sees scrambled data going to one address.
3. The server sends it on. At the VPN server your traffic is decrypted and forwarded to its real destination. The website sees a request from the VPN server’s IP address.
4. Replies come back the same way. The website answers the VPN server, which encrypts the reply and sends it down the tunnel to you.

The “virtual private network” name comes from the corporate world, where the same technology lets employees reach their company’s internal systems from home as if they were in the office. Consumer VPNs reuse the idea, but instead of connecting you to an office network they connect you to the open internet through someone else’s server.

What does a VPN hide, and from whom?

It hides the sites you visit from the local network and your internet provider, and hides your real IP address from the sites you visit. It hides nothing from the VPN company itself, and little from sites you log in to.

The last row is the one that matters most. In the EFF’s words, “while a VPN hides your browsing data from the ISP, it’s all visible to the VPN provider.” That is why the most important thing about any VPN is who runs it, where, and what evidence there is that it doesn’t keep logs. It’s also why this site compares providers on audits and track records rather than on features: see the comparison table and our guide to checking a no-logs claim.

HTTPS, the padlock in your browser’s address bar, already encrypts the contents of most web pages between you and the site, whether or not you use a VPN. The FTC’s consumer guidance says that “most websites do use encryption to protect your information” and that “because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe”, according to its advice on public Wi-Fi². What HTTPS doesn’t hide from the network is which sites you connect to. A VPN does.

How does VPN encryption work?

Modern VPN protocols use the same kind of well-studied public cryptography as secure websites and messaging apps: a key exchange to agree on secret keys, then fast symmetric encryption for the traffic itself, with a check on every packet to catch tampering.

WireGuard, the protocol most providers now use by default, fixes its choices rather than negotiating them: its whitepaper⁴ describes Curve25519 for key exchange and ChaCha20Poly1305 for encrypting and authenticating packets, carried over UDP. OpenVPN uses TLS, the same protocol family that secures HTTPS. Either is strong enough that nobody sensible attacks the encryption; the realistic weak points are the software around it, the server, and the company running it.

You don’t need to understand the maths. What you should check is that the provider uses a mainstream protocol (WireGuard, OpenVPN, IKEv2, or its own protocol that has been published and independently audited) and not something secret. The US National Security Agency and CISA, in 2021 guidance on selecting and hardening VPNs³ for organisations, steered buyers toward standards-based products rather than proprietary ones.

What are IP addresses and DNS, and why do they matter?

Your IP address is the number the internet uses to send data back to you, and it reveals your internet provider and roughly where you are. DNS is the lookup that turns a name like example.com into an IP address. A VPN should handle both, or it leaks.

When a website sees the VPN server’s IP address, it can’t tell which household or phone the request came from, and its guess at your location becomes the server’s location. That is how a VPN lets you appear to be in another city or country.

DNS is the quieter problem. Every time you open a site, your device first asks a DNS server where to find it. If those lookups go to your internet provider instead of through the tunnel (a “DNS leak”), your provider still gets a list of the sites you visit. Reputable VPN apps send DNS through the tunnel to the provider’s own resolvers. If you set a VPN up manually, for example on a router, it’s worth checking.

What are a kill switch and split tunneling?

A kill switch blocks your internet connection if the VPN drops, so nothing slips out unprotected. Split tunneling does the opposite job: it lets you choose apps or sites that skip the VPN.

• Kill switch. VPN connections drop for ordinary reasons: a phone switching from Wi-Fi to mobile data, a laptop waking from sleep, a server restarting. Without a kill switch your device quietly carries on over your normal connection. With one, traffic stops until the tunnel is back. If you use a VPN for privacy rather than convenience, turn it on.
• Split tunneling. Some things work badly through a VPN: banking apps that flag foreign IP addresses, printers and smart-home devices on your own network, video calls where every millisecond counts. Split tunneling sends those directly while everything else goes through the tunnel. It’s convenient, and it also means those apps aren’t protected.
• Multi-hop. Some providers can route you through two servers, often in different countries, so no single server sees both your real IP address and your destination. It’s slower and mostly useful if you’re worried about a specific server being watched.
• Obfuscation. Networks in some workplaces, schools and countries block VPNs. Obfuscation modes disguise VPN traffic as ordinary web traffic. Each provider has its own name for this.

What can’t a VPN do?

A VPN doesn’t make you anonymous, doesn’t stop tracking by cookies, logins or fingerprinting, and doesn’t protect you from phishing, scams or malware. It changes who can see your connections, not what you give away.

• It isn’t anonymity. The EFF is blunt: “A VPN is not a tool for anonymity.” The provider knows your real IP address and usually your payment details. If you want stronger anonymity, the EFF says “Tor is a better solution than a VPN.”
• It doesn’t stop most tracking. The same EFF guide¹ notes “there are many other ways companies may track you, including GPS, web cookies, tracking pixels, or fingerprinting.” If you’re logged in to Google, Facebook or Amazon, they know it’s you whatever IP address you use. A tracker-blocking browser or extension does more for this than a VPN.
• It doesn’t stop scams. The FTC warns that scammers “create fake websites and encrypt them to make you think they’re safe when they’re not.” A phishing page works just as well over a VPN.
• It doesn’t replace basic security. Software updates, a password manager, unique passwords and two-factor authentication protect you from far more of the attacks ordinary people actually face.
• It doesn’t put you beyond the law. The EFF notes that “depending on jurisdiction, a government can demand that data or issue a subpoena for it,” and that providers “may also be subject to pressure from governments or law enforcement to turn over information.”

What’s the difference between a work VPN and a consumer VPN?

A work VPN connects you into your employer’s private network so you can use internal systems; a consumer VPN connects you out to the public internet through the provider’s servers. They use similar technology for opposite purposes.

CISA says remote-access VPN servers “allow off-site users to tunnel into protected networks”, in its alert on the NSA and CISA guidance³. When your employer’s VPN is on, your employer’s network can typically see your traffic in the same way your internet provider normally would, so don’t treat it as private. A consumer VPN like Proton VPN, Mullvad or NordVPN is a separate product you pay for (or use on a free plan) to keep your browsing from your own network and provider.

Are VPNs legal?

In most countries, including the US, using a VPN is legal. Some governments restrict or ban them, and anything illegal without a VPN is still illegal with one. Nothing here is legal advice.

The EFF advises keeping up with “specific countries’ policies on VPNs (like VPN bans)” if you travel or live somewhere with internet censorship. Separately, many streaming services forbid using a VPN to reach another country’s catalogue in their terms of service and actively block VPN servers; that’s a contract question rather than a criminal one, but it can get an account suspended. Our guide to VPNs for streaming covers what that means in practice, and VPNs for torrenting covers why a VPN doesn’t change copyright law.

Do I need a VPN?

Many people don’t. It’s worth having if you regularly use networks you don’t trust, don’t want your internet provider to see which sites you visit, or want sites to see a different location. It isn’t a general “stay safe online” tool.

Our full answer, with the situations where it helps and where it doesn’t, is in Do I need a VPN?. If cost is the question, read free vs paid VPNs and our list of free VPNs worth using.

How do I choose a VPN?

Choose the company before the features. Look for a named, independent no-logs audit you can read, a clear owner and jurisdiction, a track record you can check, a mainstream protocol, and refund terms you understand.

• Ask how it makes money. The EFF suggests asking: “If the VPN doesn’t sell its service, how is it keeping its business afloat?” Free VPNs with no visible business are the riskiest kind.
• Read the privacy policy. The EFF warns that “a VPN company might log your data if it doesn’t specifically rule it out in its privacy policy.”
• Look for evidence, not slogans. Audits by named firms, police raids or court cases that found nothing, and honest handling of breaches. Our no-logs roundup ranks providers on exactly that.
• Check the real price. Headline prices usually need a one- or two-year plan paid up front and renew higher. See the cheapest trustworthy VPNs.

If you’re choosing between the big names, our head-to-heads go provider by provider: NordVPN vs ExpressVPN, NordVPN vs Surfshark, Proton VPN vs NordVPN and Mullvad vs Proton VPN.