NordVPN is a VPN app. Once you connect, it encrypts everything your device sends and routes it through a NordVPN server, which fetches the page or file you asked for and sends the reply back through the same encrypted tunnel. Your internet provider and anyone on the same Wi-Fi can see that you are connected to NordVPN, but they cannot read what passes through. Websites see the server's IP address and location instead of yours. The details below come from NordVPN's help center, checked on November 4, 2026.
What happens when you press connect
You open the app and press the quick connect button, which picks a server for you, or choose a country from the location list. The app and the server then agree on encryption keys and open a tunnel between them, using the protocol set in your settings. In most NordVPN apps that protocol is NordLynx unless you change it.
From that point on, your device encrypts each packet before it leaves. The NordVPN server decrypts it, sends the request to the website on your behalf and encrypts the reply on the way back. The site never talks to your device directly, so the address it records is the server's.
NordLynx, NordWhisper and OpenVPN
A protocol is the set of rules the app and the server follow to build and run the tunnel. NordVPN has four.
NordLynx is NordVPN's own technology built on WireGuard, the open-source protocol. NordVPN recommends it for most people, uses it by default in most of its apps and says it is much faster than OpenVPN. It is the one to keep for gaming, video calls and anything else that suffers from lag.
NordWhisper is NordVPN's own protocol for restrictive networks, such as filtered office and campus Wi-Fi or the public Wi-Fi in airports, cafes and hotels. If NordLynx will not connect somewhere, try NordWhisper next. It is available on Windows, macOS, Linux, iOS and Android, and it does not work with a dedicated IP, Meshnet or Onion Over VPN servers.
OpenVPN is the long-standing open-source protocol, and NordVPN runs it over UDP or TCP. NordVPN says it encrypts OpenVPN traffic with AES-256-GCM and a 4096-bit Diffie-Hellman key. TCP is slower but gets through more networks. IKEv2/IPsec is the fourth option, listed mainly for manual setups.
Post-quantum encryption
NordVPN has a post-quantum option meant to protect today's traffic against future quantum computers that could break current key exchange methods. It works only with NordLynx, on Windows, macOS, Linux, Android, iOS, tvOS and Android TV, and each app's setup guide shows you how to switch it on. It turns off when you use a dedicated IP, another protocol, obfuscated servers or Meshnet. NordVPN's help article does not name the algorithm it uses.
How NordVPN changes your IP address and location
Your internet provider gives your connection an IP address that points back to your home or phone network. With NordVPN on, sites see the address of the server you picked instead. Connect to a server in Canada and you appear to be in Canada. NordVPN's help center puts its network at more than 8,400 servers in more than 167 countries, and the United States alone has servers in 20 cities.
Most servers share each address among many customers, which makes it harder to tell people apart. The trade-off is that some banks and shops send shared VPN addresses through extra checks. A dedicated IP, which NordVPN sells as an extra, gives you an address that only you use and that does not change.
Specialty servers
Besides standard servers, the app has a "Specialty servers" list:
- Double VPN sends your traffic through two VPN servers, so it is encrypted twice. Expect slower speeds.
- Onion Over VPN combines the VPN tunnel with the Tor network, for people in countries with heavy surveillance.
- Obfuscated servers disguise your VPN traffic for networks and countries that block VPN traffic.
- Dedicated IP servers carry the personal address described above, if you have bought one.
The kill switch and split tunneling
If the tunnel drops for a second, your device would normally carry on over your normal connection and expose your real address. NordVPN's kill switch stops that, and it works a little differently on each system:
- Windows has two. The Internet Kill Switch cuts your connection when you lose the VPN, and the App Kill Switch, off by default, closes the programs you choose, such as a torrent client.
- On Android 8.0 and later the kill switch blocks all internet access system-wide when there is no VPN connection. It is not available on the Amazon Fire TV Stick.
- On iPhone, iPad and the App Store Mac app, NordVPN uses VPN bypass prevention, which forces all covered traffic through the tunnel and holds through restarts and sleep.
- On Linux you switch it on with
nordvpn set killswitch on, and it blocks traffic even when you disconnect on purpose.
Split tunneling does the opposite job. It lets you choose apps that skip the VPN, such as a banking app that rejects VPN addresses, on Windows, Android and Android TV. Linux uses an Allowlist of ports and subnets instead. Excluded apps still use NordVPN's DNS servers, which can confuse a streaming app about where you are. When the kill switch and split tunneling are both on, the kill switch wins: if the VPN drops, it blocks everything, including the excluded apps.
What NordVPN says it keeps
NordVPN says it does not log your online activity and does not link your account to anything you do while connected. It keeps your email address, an encrypted login, a username for VPN connections and the order ID from your payment so it can process refunds. It says that, because of this policy, it would have nothing useful to hand over under a valid court order.
NordVPN operates under the jurisdiction of Panama, which its help center says has no mandatory data retention law. Its parent company, Nord Security, is based in the Netherlands. The help center pages we read did not name an independent no-logs audit.
Protection beyond the tunnel
The NordVPN app now does more than encrypt traffic. On Windows and macOS, the malicious website blocker stops known malware and phishing sites, warns you about fraudulent ones and keeps running when the VPN is off. It needs one of NordVPN's higher plans, not the VPN-only plan. Other parts of the same Real-time protection settings check downloaded files for malware, and on Android a Call Protection feature warns you about likely scam calls.
What a VPN does not do
The tunnel moves trust from your internet provider to NordVPN, because NordVPN's servers now carry your traffic. Sites you sign in to still know who you are, and cookies can still follow you around the web. A VPN will not stop you from typing a password into a phishing page, although the website blocker catches some of those.
Streaming services and some governments also block VPN addresses they spot, so a server that works this week may not work next week. Some countries restrict VPN use by law, so check the rules before you travel.
Devices, apps and refunds
One NordVPN account covers up to 10 devices at the same time. If two of your devices connect to the same server, each needs a different protocol, so pick a second server if you hit that limit. A router running NordVPN uses one of the 10 slots and protects everything connected to it. NordVPN has apps for Windows, macOS, Linux (with both a graphical app and a command-line version), iOS, Android, Android TV, Fire TV and Apple TV.
New customers in the US and 14 other countries get a 7-day free trial on 1-year and 2-year plans if they pay by credit card or PayPal; cancel before the week ends or the plan starts at the price you were shown. First-time customers can also ask for a refund within 30 days of buying. That guarantee covers the first purchase only, not renewals, and Apple handles refunds for App Store purchases.
Is NordVPN the right VPN for you
NordVPN suits people who want a fast default protocol, a fallback for networks that block VPNs and a Linux app that matches the others. If you need to cover more than 10 devices, Surfshark sets no device limit. You can see plans and details on our NordVPN listing, or compare it with ExpressVPN and CyberGhost.
