What is a VPN?

The short answer

A VPN (virtual private network) is software that wraps your internet traffic in encryption and sends it to a server run by the VPN provider. From there, your traffic goes out to the open internet. Websites see the server's IP address instead of yours. Your Wi-Fi network and your internet service provider (ISP) see that you are connected to a VPN, but not which sites you visit or what you send.

That is the whole trick. A VPN doesn't make you anonymous, doesn't stop malware, and doesn't hide you from the sites you log in to. It changes who can see your traffic. Before, your ISP and anyone on your local network could watch where you went. After, the VPN company can. Picking a VPN is mostly about picking a company you trust with that view.

How a VPN works, step by step

Without a VPN, your device sends requests to your router, then to your ISP, then across the internet to the site you want. Each step can see the destination of the request. Each step could log it.

1. Your device opens a tunnel The VPN app connects to a server you choose, or one it picks for you. The two sides agree on encryption keys using a VPN protocol such as WireGuard, OpenVPN or IKEv2.
2. Your traffic is encrypted Everything your device sends is encrypted before it leaves. To your router and ISP it looks like a single stream of scrambled data going to one server.
3. The server forwards your traffic The VPN server decrypts the traffic and sends it on to the website or app, using the server's own IP address.
4. Replies come back the same way The site replies to the VPN server, which encrypts the reply and sends it back down the tunnel to you.

The "tunnel" is a metaphor. Nothing is physically separate. Your data still crosses the same cables and Wi-Fi as before. It is just encrypted on the stretch between your device and the VPN server, and it exits the internet from a different place.

The encryption itself uses well-studied building blocks. WireGuard, for example, uses ChaCha20-Poly1305 for encryption and Curve25519 for key exchange, according to its design paper. OpenVPN and IPsec typically use AES. Our VPN protocols guide compares them.

What a VPN hides, and from whom

The middle row is the one people forget. A VPN provider sits in the same spot your ISP used to. If it keeps logs, it can link your real IP to the sites you visited. That is why no-logs claims, and independent checks of them, matter so much. See what a no-logs policy actually means and our list of VPN audits.

Do you still need a VPN now that most sites use HTTPS?

Less than you used to. HTTPS encrypts the content of your connection to a website, so a café's Wi-Fi operator can't read your passwords or messages on sites that use it. Google's Transparency Report shows that the large majority of pages loaded in Chrome now use HTTPS.

HTTPS still leaves some things visible. Your network and ISP can usually see which domain names you connect to, through DNS lookups and the server name your browser sends when it opens a secure connection. A VPN hides those from the local network and the ISP. Whether that is worth paying for depends on how much you trust those parties. On a hotel or airport network you don't control, many people decide it is. Our public Wi-Fi safety guide covers this.

What a VPN can't do

• Make you anonymous. If you log in to Google, Facebook or your bank, they know it is you, VPN or not.
• Stop tracking by cookies and fingerprinting. Ad networks recognize your browser by many signals beyond your IP. A private browser and tracker blocking do more here. See private browsers.
• Protect you from phishing or malware. A fake login page works just as well through a VPN. Some VPN apps bundle blockers for known bad domains, but that is a separate feature.
• Make illegal activity legal. A VPN hides your traffic from your ISP. It does not make copyright infringement legal, and it doesn't change the law where you are.
• Guarantee access to streaming catalogs. Watching another country's catalog usually breaks the streaming service's terms of use, and services actively block VPN IP addresses. Results change. See why streaming services block VPNs.
• Keep your data from the VPN company. Only its policies, its technical design and outside audits limit what it can see and keep.

Types of VPN

The word "VPN" covers three different things.

• Remote-access VPNs let an employee reach a company network from home. This is the original use. NIST's guide to IPsec VPNs (SP 800-77) is written mainly for this kind.
• Site-to-site VPNs join two office networks over the internet so they act like one.
• Consumer VPN services such as NordVPN, Proton VPN or Mullvad sell access to a network of servers so individuals can route their own traffic through them. Most of this site is about this kind.

The US National Security Agency and CISA published joint advice in 2021 on choosing and hardening remote-access VPNs for organizations. It recommends standards-based VPNs from vendors with a record of fixing security flaws quickly, because VPN gateways are a frequent target for attackers.

Why people use VPNs

• Untrusted networks. Hotels, airports, cafés and conference Wi-Fi are run by people you don't know.
• Hiding browsing from an ISP. In the US, ISPs can use and share browsing data in ways that worry privacy groups. A VPN moves that data to the VPN provider instead.
• Censorship. In countries that block news sites or social networks, people use VPNs and tools like Tor to reach them. Some governments restrict or block VPNs in turn. Freedom House's annual Freedom on the Net report tracks where. Our guide to VPN legality covers the rules.
• Travel. People abroad use VPNs to reach home banking or work services that block foreign IPs. See VPNs for travel.
• Keeping their IP address from sites and peers. On peer-to-peer networks, everyone in a swarm can see each other's IP addresses. A VPN shows the server's IP instead. That is a privacy measure only.

How to judge a VPN provider

Because the provider sees what your ISP used to see, you are mostly judging a company. These are the questions that matter, roughly in order.

• Who owns it? Several well-known brands belong to a handful of parent companies. Our VPN ownership page traces them.
• Has anyone checked its no-logs claim? An audit by an outside firm, published with its scope, is stronger than a promise. A court case or server seizure in which the company had nothing to hand over is stronger still. See VPN audits.
• What happened when things went wrong? Every large provider has had incidents. How fast it disclosed them and what it changed tells you more than its marketing.
• Where is it based? The legal entity's country decides which courts can order it to act. Jurisdiction is one factor among several, and it is often overstated.
• Are the apps open source? Published code lets outside researchers look for flaws. Mullvad and Proton VPN publish their app code.
• Does it have a kill switch and leak protection? A kill switch blocks traffic if the tunnel drops. You can check for leaks yourself with our leak test guide and WebRTC leak test.
• Which protocols does it offer? Modern options are WireGuard (or a provider's version of it), OpenVPN and IKEv2. Avoid PPTP. See WireGuard vs OpenVPN.

What about free VPNs?

Running servers costs money, so a free VPN has to pay for itself somehow. Some free tiers are funded by paid plans from the same company, with limits on speed, data or locations. Others are funded by advertising or data collection.

A 2016 academic study of 283 Android apps that use the system VPN permission, by researchers at CSIRO's Data61 and partner universities, reported that 18% used tunneling protocols without encryption, about 84% did not send IPv6 traffic through the tunnel, and over 38% showed some form of malware presence according to VirusTotal. That study is old and the app market has changed, but the lesson holds: check who runs a free VPN before you route everything through it. See are free VPNs safe? and free vs paid VPNs.

Where VPNs came from

VPNs began as business tools. Microsoft and other vendors developed PPTP in the 1990s so staff could reach office networks from outside, and it was published as an informational standard (RFC 2637) in 1999. The IETF's IPsec standards gave networks a stronger, vendor-neutral way to build tunnels; IKEv2, the current key-exchange protocol for IPsec, is defined in RFC 7296. OpenVPN followed as an open-source alternative built on TLS. WireGuard arrived in the late 2010s with a much smaller codebase and was merged into the Linux kernel in version 5.6 in 2020.

Consumer VPN services grew out of that technology. They reuse the same protocols but point them at the provider's servers instead of an office network. That is why the security advice for both is similar: use a modern protocol, keep apps updated, and know who runs the other end.

VPN vs proxy vs Tor

A proxy forwards traffic for one app, often without encryption. A VPN usually covers the whole device and encrypts the link to the server. Tor sends traffic through three volunteer relays so that no single relay knows both who you are and where you are going. Tor is slower but is designed so that you don't have to trust one company. Our VPN vs proxy vs Tor guide compares them.

Setting one up

For most people, setup means installing the provider's app, signing in, and pressing connect. You can also run a VPN on a home router so every device is covered, including ones that can't run apps. See VPN on a router and VPN on a smart TV. If you only want some apps to use the tunnel, look for split tunneling.