What a VPN actually does, and what it doesn't

In brief

A VPN, or virtual private network, creates an encrypted tunnel between your device and a server run by the VPN provider. Everything you send goes through that tunnel first, and then out to the internet from the provider's server. Two things change as a result: the network you are on cannot see where you are going, and the websites you visit see the VPN server's location instead of yours.

That is the entire product. Most of the claims made about VPNs are either a consequence of those two changes or an exaggeration of them.

What it genuinely helps with

Untrusted networks. On hotel, café or airport Wi-Fi, the network operator, or anyone who has tampered with it, can see which sites you connect to. A VPN hides that. This matters less than it did, because almost all websites now use HTTPS, which already encrypts the content of what you send, but the VPN still hides the list of destinations.

Location. Because websites see the VPN server's location, a VPN can make you appear to be in another country. That is why people use them for travel or for services that vary by region.

Your internet provider's view. At home, your provider can see the sites you visit. A VPN moves that visibility to the VPN company instead.

What it does not do

It does not make you anonymous. The websites you log in to still know who you are, your browser still carries cookies and identifiers, and the VPN provider itself can see your traffic. You have not removed a watcher; you have chosen a different one.

It does not stop malware, phishing or scams. A malicious link is just as dangerous through a tunnel.

It does not protect your accounts. Passwords, two-step sign-in and software updates do that, and no VPN replaces them.

It does not necessarily make anything faster. Traffic takes a longer route, so it is usually slightly slower.

Choosing one, if you need one

Because the provider can see everything, the choice is really about trust. Prefer a company with a published privacy policy, an independent audit of its "no logs" claims, a clear business model that is not selling your data, and a jurisdiction you are comfortable with. Be cautious of free services; running servers costs money, and the product may be you.

Some phones and browsers include a built-in private relay or VPN from the platform vendor, which is a reasonable default for people who mainly want protection on public Wi-Fi.

The short version

Use a VPN on networks you do not trust and when you need to appear elsewhere. For everything else, a modern browser, HTTPS and good account hygiene are doing more of the work than any VPN can.

Sources and scope

This piece is ByteNib editorial analysis written for general readers. It draws on public guidance on VPN use from consumer-protection and cybersecurity agencies, including the UK's National Cyber Security Centre, and on the published documentation of major VPN and browser vendors. It does not recommend a specific product.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.