The basic idea
Normally your device connects to the internet through whatever network you are on: your home router, an office, a hotel. Your traffic passes through that network on its way to the websites and services you use. A virtual private network, or VPN, adds a step. Your device first builds an encrypted connection, often called a tunnel, to a VPN server. Your traffic then travels through that tunnel and comes out onto the wider internet from the server.
Two things follow from that setup.
- The local network can no longer read the contents of your traffic, because it only sees scrambled data going to the VPN server.
- The websites you visit see the VPN server’s address instead of your own network’s address.
That is the whole mechanism. Everything a VPN does or fails to do comes from those two facts.
Two common kinds of VPN
Company VPNs. Many organizations run a VPN so employees working remotely can reach internal systems as though they were in the office. Here the VPN is mostly about access: some internal resources are only reachable through it. It also lets the company apply its own rules to the traffic.
Consumer VPN services. These are subscription services you install yourself. They are usually marketed for privacy, for safer use on open networks and for appearing to connect from another country.
The two share the technology but differ in who runs the server and who you are trusting.
What a VPN can help with
- Untrusted local networks. On a shared network such as a cafe, the VPN hides your traffic from other people on that network and from the network operator. This is one of the better reasons to use one, though much web traffic is already protected separately by everyday encryption.
- Reaching work resources. A company VPN can be required to open internal tools.
- Hiding your address from sites. Websites see the server’s address instead of your own, which makes casual tracking by network address harder.
- Avoiding some local restrictions. Some people use a VPN to get around network blocks. Be aware that workplaces, schools and services may have rules against this, so check before you rely on it.
What a VPN does not do
This is where marketing and reality often part ways.
- It does not make you anonymous. The VPN provider can see where your traffic goes unless it is otherwise encrypted. You have moved trust from your network to the provider. Sites can still recognize you if you are logged in, and they can use cookies and device characteristics.
- It does not stop phishing. A deceptive message works the same whether or not you use a VPN.
- It does not fix weak accounts. A reused password is just as weak behind a tunnel. Strong, unique logins and a second step matter far more.
- It does not protect a compromised device. Malware on your computer sees your data before it is ever encrypted.
- It does not guarantee safety from every kind of tracking. Accounts you sign in to still know who you are.
- It is not required for ordinary encrypted sites. Most of the web uses encrypted connections already, so a VPN is an added layer rather than the only protection.
A VPN can also slow your connection a little, since traffic takes a longer path, and some services block known VPN addresses.
The trust question
Because a VPN routes your traffic through a server run by someone else, choosing one is largely a question of trust. For a consumer service, the points worth weighing are:
- How the company describes what it logs and for how long. Claims like “no logs” are statements by the company; they are not something you can easily verify yourself, so treat them cautiously.
- Whether it has been independently reviewed, and whether it publishes information about that.
- Who owns it and where it is based.
- Whether the price and business model make sense. If a service is free, think about how it earns money.
- Whether it works on all the devices you use.
Free VPNs deserve particular care for that last reason. A good rule is to be skeptical of any provider that promises complete safety.
When it makes sense
A sensible way to decide is to ask what problem you are solving.
- Your employer requires it: use the company VPN as instructed.
- You regularly work from networks you do not control and want an extra layer: a reputable VPN can help, alongside the precautions in our notes on public Wi-Fi.
- You want a private browsing experience from advertisers or a local network: a VPN helps with part of that, but browser settings and account choices matter too.
- You are worried about someone stealing your accounts: put effort into passwords, two-factor authentication and phishing awareness first.
A VPN is one tool among several. Used for the right reasons, it narrows who can watch your traffic. Used as a cure-all, it gives a false sense of safety.