What is a VPN? What it hides and what it doesn't

A VPN, or virtual private network, is an encrypted connection from your device to a server run by someone else, which then passes your traffic on to the internet as if it came from there. It hides what you do online from the local network and your internet provider, and hides your real address from the sites you visit. It doesn't make you anonymous, and the VPN company can see everything the others can't.

In short

• A VPN wraps all your traffic in encryption as far as its own server, then sends it out from that server's address.
• It moves trust rather than removing it: your internet provider stops seeing your traffic, and the VPN provider starts.
• It doesn't stop tracking by logins, cookies or browser fingerprinting, and it doesn't protect against malware or phishing.

How does a VPN work?

Normally, your device sends data to the internet through whatever network it's on: a café's Wi-Fi, then the café's internet provider, then onward to the site. Each of those can see where the data is going, and each website sees your IP address, which reveals your provider and rough location.

With a VPN switched on, your device first sets up a secure session with the VPN server, agreeing on encryption keys. From then on, every packet your device sends is encrypted and wrapped inside another packet addressed to the VPN server. That wrapping is the "tunnel". The café and the provider see only a stream of scrambled data going to one address. The VPN server unwraps each packet, sends it to its real destination from the server's own IP address, and passes the reply back down the tunnel.

The tunnel is built with a protocol, a set of rules for the handshake and the encryption. The main ones today are IPsec, an internet standard defined in RFC 4301 and long used by companies; OpenVPN; and WireGuard, a newer and much smaller design described in its 2017 paper by Jason Donenfeld. Older protocols such as PPTP are no longer considered safe.

Who sees what, with and without a VPN?

A VPN doesn't make your traffic invisible: it changes who can see it. Take one ordinary visit to a news site from café Wi-Fi. Most sites already use HTTPS, which encrypts the content of a page between your browser and the site, so even without a VPN no one along the way can read the article you open or the password you type. What they can see is where you're going.

Who	Without a VPN	With a VPN
The Wi-Fi owner and people on the same network	Which sites you visit and when (not their content, on HTTPS)	Only that you're connected to a VPN server, and how much data flows
Your internet provider	Which sites you visit and when	Only that you're connected to a VPN server
The VPN provider	Nothing	Which sites you visit and when, and anything not protected by HTTPS
The website	Your real IP address, so your provider and rough location	The VPN server's IP address
The website, if you're logged in or tracked by cookies	Who you are	Still who you are

The last row is the one people forget. If you log in to an account, the site knows it's you, VPN or not. Advertising networks recognize you through cookies and browser fingerprints, which are built from your device's settings and don't depend on your IP address at all. The Electronic Frontier Foundation's guide to choosing a VPN puts it bluntly: "A VPN is not a tool for anonymity."

What are VPNs actually good for?

VPNs were first built for companies. A corporate VPN lets an employee at home reach the office network, its file servers and internal tools, as if they were at their desk. The U.S. National Institute of Standards and Technology's guide to IPsec VPNs is written for exactly that use. Here the tunnel's job is to let the right people in, not to hide anyone.

Consumer VPNs, sold to individuals, are used for different reasons:

• Untrusted networks. On public Wi-Fi in a hotel or airport, a VPN keeps the network owner and anyone snooping on it from seeing which sites you use, and protects the few apps and pages that still don't encrypt their traffic.
• Hiding activity from an internet provider. In countries where providers may record or sell browsing data, a VPN hands that view to the VPN company instead.
• Appearing to be somewhere else. Because sites see the server's address, a VPN can make you appear to be in another country. People use this to reach services that are blocked where they are, or to watch catalogs licensed for other regions, which often breaks a streaming service's terms.
• Getting around censorship. In countries that block news sites or social networks, VPNs are a common way through, though some governments block or restrict VPNs themselves. The law differs widely from country to country.

What doesn't a VPN protect you from?

A VPN doesn't stop malware you download, or a fake login page you type your password into: phishing works just as well through a tunnel. It doesn't hide what you do from the accounts you're signed in to. It doesn't stop websites tracking you across visits. And as EFF notes, for many people it isn't the most important security step: strong passwords, two-factor sign-in and software updates do more.

It can also leak. If the tunnel drops for a moment, a device may fall back to sending traffic in the open, which is why many apps offer a "kill switch" that blocks the connection until the tunnel returns. Some set-ups still send DNS lookups, the step that turns a site's name into its address, outside the tunnel, revealing every site visited. Encryption and the detour through a distant server also cost some speed.

Can you trust a VPN company?

Everything a VPN hides from your provider, it shows to itself. So the useful question isn't whether a VPN is secure but whether its operator is honest and competent. In February 2018 the U.S. Federal Trade Commission published tips for choosing a VPN app that come down to the same question: research the app before installing it, check which permissions it asks for, and find out whether it really encrypts your traffic and whether it shares your data with third parties.

Still argued

"No-logs" promises are hard to check from outside. Some providers commission independent audits of their systems, and a few have had their claims tested when authorities demanded records they turned out not to hold. Critics reply, as EFF's guide does, that an audit checks one moment, and that a provider can change its practices afterwards, especially if a government compels it, or change its owner or its jurisdiction. What the evidence supports is narrower than the marketing: a VPN is as private as the company running it, and free VPNs have to pay for their servers somehow.

A VPN is also different from the dark web's Tor network, which sends traffic through three volunteer-run relays so that no single one knows both who you are and where you're going. A VPN is one hop, run by one company that knows both.

Check yourself

• On café Wi-Fi with HTTPS but no VPN, what can the Wi-Fi owner see, and what can't they?
• Why does logging in to an account undo the privacy a VPN gives against that site?
• What do you have to trust about a VPN company, and why can't the VPN itself guarantee it?

Sources

• Choosing the VPN that's right for you — Electronic Frontier Foundation, Surveillance Self-Defense
• FTC provides tips for using VPN apps — U.S. Federal Trade Commission, 2018
• Guide to IPsec VPNs, SP 800-77 Rev. 1 — National Institute of Standards and Technology, 2020
• WireGuard: Next Generation Kernel Network Tunnel — Jason A. Donenfeld, 2017
• RFC 4301: Security Architecture for the Internet Protocol — Internet Engineering Task Force, 2005