Step 1 of 8 ยท Privacy basics
What a VPN does, and what it does not
A VPN moves where your traffic appears to come from and who can see it in transit. It does not make you anonymous, and it does not make anything legal that was not.
How it works, in four steps
Your device encrypts the traffic
The VPN app or built-in client wraps your traffic in encryption before it leaves the device.
The traffic travels through a tunnel
The Wi-Fi network and your internet provider carry the encrypted tunnel, but cannot read what is inside it.
The VPN server unwraps it
At the other end, the VPN server decrypts the traffic and sends it on to the website or service you asked for.
Sites see the server, not you
The website sees the VPN server's IP address rather than yours. Replies come back along the same route.
Most websites already use HTTPS, which encrypts the content of your traffic with that site. A VPN adds a second layer that also hides which sites you connect to from the networks in between.
Who can see what
| Party | Without a VPN | With a VPN |
|---|---|---|
| Wi-Fi or local network operator | Which servers you connect to, and the content of any unencrypted traffic | That you are connected to a VPN server, and how much data you send |
| Your internet provider | Which servers you connect to, and usually your DNS lookups | That you are connected to a VPN server |
| The VPN provider | Nothing | Which servers you connect to, and the content of any unencrypted traffic |
| Websites you visit | Your IP address and anything you tell them by signing in | The VPN server's address and anything you tell them by signing in |
| Your employer or school, on their device | Whatever their management software is set to record | Usually the same: a VPN does not remove software installed on the device |
What it changes and what it does not
A VPN can help with
- Keeping traffic private on a public Wi-Fi network you do not control.
- Reducing what your internet provider can see about the sites you use.
- Reaching your organisation's internal systems, when it provides the VPN for that purpose.
- Not showing your home IP address to every site you visit.
A VPN does not
- Make you anonymous. Accounts, cookies and browser fingerprints still identify you.
- Protect you from phishing, malware or weak passwords.
- Remove monitoring software from a work or school device.
- Change what is lawful where you are, or the terms of the services you use.
Common misunderstandings
- "With a VPN nobody can see what I do."
- The VPN provider can, and so can every site you sign in to. Your device and browser can still be tracked.
- "A VPN makes public Wi-Fi completely safe."
- It protects traffic in transit. It does not stop a fake sign-in page or a malicious download.
- "Paying more means more privacy."
- Price says little about logging, ownership or security practice. Evidence does; see the provider checklist.
Terms used here
- VPN (virtual private network)
- A service or setup that carries your traffic through an encrypted tunnel to a server, which then connects to the internet on your behalf.
- Tunnel
- The encrypted connection between your device and the VPN server. Traffic inside it cannot be read by the networks it passes through.
- Encryption
- Scrambling data so that only someone with the right key can read it. A VPN encrypts traffic between your device and the VPN server.
- IP address
- The numeric address that identifies a connection on the internet. With a VPN on, websites see the VPN server's address instead of yours.
- Internet provider (ISP)
- The company that connects your home or phone to the internet. Without a VPN it can see which servers you connect to; with one, it sees that you are connected to a VPN.
- HTTPS
- The encrypted version of the web protocol, shown by a padlock in most browsers. It protects the content of your traffic with a website whether or not you use a VPN.
- Public Wi-Fi
- A shared network in a cafe, hotel, station or similar place. Its operator, and sometimes other users, may be able to observe unencrypted traffic.