What a VPN actually does
A VPN, or virtual private network, creates an encrypted tunnel between your device and a server operated by the VPN provider. All your internet traffic passes through that tunnel before reaching its destination. Two things happen as a result: the data is scrambled so that anyone who intercepts it between your device and the VPN server cannot read it, and the IP address that websites see belongs to the VPN server, not to you.
Your internet service provider (ISP) normally has a clear view of every site you visit. With a VPN active, the ISP can see that you are connected to a VPN server, but not which sites you access through it. That is a meaningful privacy gain if you prefer your ISP not to log or sell your browsing history.
For context on what encryption in transit means more broadly, see what the padlock in your browser actually means.
Encrypts traffic between your device and VPN server
Anyone intercepting data on the same network, such as a public Wi-Fi operator, cannot read the contents of your connection while the VPN is active.
Hides your IP address from websites you visit
Sites see the VPN server's IP address rather than yours, which limits one method websites use to identify and locate users.
Prevents your ISP from seeing browsing activity
Your internet provider can observe that you are using a VPN but cannot read which sites you visit or what data you send through the tunnel.
Reduces exposure on public and shared networks
On hotel, airport, or cafe Wi-Fi, a VPN prevents the network operator from monitoring your traffic, adding a useful layer for people who travel frequently.
What a VPN does not protect you from
A VPN stops at the VPN server. Once your traffic leaves that server heading toward a website, it travels the normal internet path, and the VPN has no role in what happens there.
If you log into a social media account, that platform knows who you are regardless of which IP address you arrived from. Behavioral tracking through cookies and browser fingerprinting persists through a VPN connection. Advertisers that track you across sites rely on these methods, not on your IP address, so masking the IP does not stop them.
Malware already on your device operates independently of your VPN. Phishing sites can still deceive you, because a VPN does not evaluate the content of the pages you load. It moves data without inspecting it.
The VPN provider itself can see all your unencrypted traffic. If a provider keeps logs or has weak security practices, your data is exposed at that point instead of at your ISP. Choosing a provider with a clear, independently audited no-logs policy matters precisely because of this.
Does not protect you from malware or phishing
A VPN passes traffic without inspecting it, so malicious sites and downloads are as dangerous through a VPN as without one.
Cannot hide identity from sites where you are logged in
Once you sign into an account, the platform identifies you directly. Your IP address becomes irrelevant to that identification.
The VPN provider can see your traffic
Trust shifts from your ISP to the VPN provider. A provider with poor data practices or logging policies creates the same exposure you were trying to avoid.
Does not stop cookie or fingerprint-based tracking
Most cross-site advertising tracking uses cookies and browser fingerprinting, neither of which a VPN affects.
Can slow connection speeds
Routing traffic through an additional server and encrypting it adds latency. The impact varies by provider, server location, and your base internet speed.
VPNs and public Wi-Fi: a more honest picture
VPN marketing has long pointed to public Wi-Fi as the primary reason to subscribe. The threat is real but narrower than often presented. A decade ago, intercepting unencrypted traffic on a coffee shop network was straightforward. Today, the vast majority of websites use HTTPS, which encrypts data between your browser and the server regardless of whether you have a VPN.
That said, a VPN still adds protection on public networks. It prevents the network operator from seeing which sites you visit, and it guards against the minority of connections that still travel unencrypted. For anyone who regularly works on hotel, airport, or cafe networks, using a VPN is a reasonable precaution.
For a detailed breakdown of which public Wi-Fi risks are genuine concerns today, see separating real risks from overstated fears on public Wi-Fi.
Your VPN provider is not neutral
When you use a VPN, you are moving trust from your ISP to the VPN company. That company can log your activity, comply with government data requests, or experience security breaches. Look for providers that publish independently audited no-logs policies and are transparent about their jurisdiction. A VPN is only as private as the company running it.
Comparing VPNs to other privacy tools
A VPN and incognito mode are often confused for doing the same job. Incognito mode prevents your browser from saving your browsing history locally and clears cookies at the end of the session. It does nothing to hide your IP address or encrypt your traffic from your ISP. A VPN does the opposite: it changes what outside parties see but has no effect on what your browser stores locally.
Used together, they address different problems. Neither replaces the other. For a full breakdown of what private browsing does and does not hide, see what incognito mode actually hides.
95%+
Top websites now using HTTPS
According to Google's Transparency Report, the large majority of page loads in Chrome use HTTPS, meaning encryption in transit is often already present without a VPN.
1 in 3
American adults reported using a VPN
A Pew Research Center survey found roughly one-third of U.S. adults have used a VPN, though many overestimate the scope of protection it provides.
