A VPN (virtual private network) is an app that sends all your device's internet traffic through an encrypted connection to a server run by the VPN company. That server makes your requests for you and passes the answers back. Your internet provider, and anyone sharing the same Wi-Fi, can see that you're connected to a VPN server but can't read what you send or see which sites you visit. The sites themselves see the server's IP address and location instead of yours.
What happens when you press connect
- The app contacts a VPN server and the two prove who they are to each other.
- They agree on encryption keys for this session, in a way that someone watching the network can't reproduce.
- From then on, your device encrypts every packet before it leaves and wraps it inside another packet addressed to the VPN server. This wrapping is what people mean by a "tunnel".
- The server unwraps and decrypts each packet, then sends it on to the website or app with the server's own IP address as the return address.
- Replies come back to the server, which encrypts them and sends them down the tunnel to you, where your device decrypts them.
All of this happens below your browser and apps, so they work as normal. A good VPN app also sends your DNS lookups (the step that turns a name like example.com into an address) through the tunnel, so your provider can't see the names of the sites you look up either.
What a VPN hides, and from whom
Your internet provider, your employer's or school's network, and the owner of a café or hotel Wi-Fi lose sight of your traffic. They see encrypted data going to one VPN server.
Websites and apps lose your real IP address, which is the main way they tell roughly where you are. Pick a server in Japan and a site sees a visitor in Japan.
The VPN company gains what your internet provider lost: it could, in principle, see where your traffic goes. That makes the company's own practices the thing to check. Look for a no-logs policy that an outside firm has audited, and for where the company is based. ExpressVPN, for example, says its servers run from RAM and are wiped on every restart, and it names PwC, Cure53 and KPMG among the firms that have audited it.
What a VPN doesn't hide
A VPN changes your network address. It does nothing about the accounts you sign in to. If you're logged in to Google, Facebook or Amazon, they still record what you do on their services, and cookies and browser fingerprinting still let ad networks recognize your browser. A VPN also won't stop malware you download yourself or a phishing page you type a password into. Some VPNs add ad, tracker and malicious-site blocking, but that's a separate filter bolted onto the tunnel.
VPN protocols, in plain terms
A protocol is the set of rules the app and server use to build the tunnel and encrypt the traffic. Most VPN apps pick one for you, and you can usually change it in settings.
- WireGuard is the newest widely used protocol. Its developers say it is written in very few lines of code so that one person can review all of it, and it uses modern encryption such as ChaCha20, Poly1305 and Curve25519. It can also roam: if your phone moves from Wi-Fi to mobile data, the connection carries on from the new address.
- OpenVPN has been the default for many VPNs for years. It's open source and widely audited, and it can run over UDP, which is usually faster, or TCP, which gets through more restrictive networks.
- IKEv2/IPsec is common on phones. An extension called MOBIKE lets the connection survive a change of address, such as walking out of Wi-Fi range.
- L2TP/IPsec is older. L2TP builds the tunnel and has no encryption of its own, so it relies on IPsec for that.
- PPTP is the oldest and shouldn't be used. ExpressVPN says its authentication methods have been cracked repeatedly, and none of ExpressVPN's apps support it.
Several companies also run their own protocols. ExpressVPN has Lightway, and Proton VPN has Stealth, which Proton says bypasses internet blocks by hiding the VPN connection.
Three safety features worth switching on
A kill switch blocks all internet traffic if the VPN connection drops, so nothing slips out over your normal connection while the app reconnects. ExpressVPN calls it the Internet Kill Switch.
Leak protection makes sure your DNS lookups and your real IP address don't escape outside the tunnel. ExpressVPN says it guards against IP, DNS and WebRTC leaks.
Obfuscation disguises VPN traffic as ordinary web traffic, which helps on hotel, school and office networks that block VPNs. ExpressVPN applies it automatically on supported platforms, and Proton's Stealth protocol does the same job.
What people use a VPN for
Public Wi-Fi is the plainest case: on a network run by someone you don't know, a VPN keeps your traffic away from them. Travelers use one to reach their home banking and services from abroad, though some banks block VPN addresses and you may need to switch servers or turn the VPN off to sign in.
Streaming is the most advertised use, and the services push back. Prime Video's terms say you may not use any technology or technique to disguise your location, and Netflix says VPNs aren't supported on its ad-supported plan or for live events.
For torrenting, a VPN hides your IP address from other people in the swarm. It doesn't make downloading copyrighted files legal.
In countries that censor the internet, a VPN can reach blocked sites, but the legal risk is real. China, for example, has banned unlicensed VPNs since 2017, according to Freedom House. Our guide to the best VPN for China covers that in more detail.
Free VPNs versus paid ones
Running servers costs money, so a free VPN either limits what you get to sell you an upgrade or earns money some other way. Read the privacy policy before you install one. The limited kind can be fine. Proton VPN's free plan, for instance, covers one device with no data cap, but it connects you to servers in 10 countries chosen at random. Paid plans add more countries and devices: Proton's VPN Plus covers 10 devices in more than 140 countries.
Why some things break with a VPN on
Printers, smart speakers and other devices on your home network can stop responding, because your traffic now looks like it comes from a server far away. Most apps have a setting to allow local network access, or you can use split tunneling to keep some apps off the VPN. Some sites also show more captchas or block shared VPN addresses outright, and switching to another server usually fixes it.
To compare specific services, see our best VPN software guide. If you're weighing a VPN against other tools, we also compare a VPN with a proxy and a VPN with Tor.
