What a VPN does
A virtual private network, or VPN, creates an encrypted connection, often called a tunnel, between your device and a VPN server. Your internet traffic travels through that tunnel before it reaches the wider internet. To a local network or internet provider, the traffic appears as an encrypted stream going to the VPN server instead of a series of separate connections to individual websites. To the websites you visit, your connection generally appears to come from the VPN server’s address, not your own.
Two broad types are common. A business VPN connects employees to their organization’s internal network from outside the office. A consumer VPN service routes an individual’s traffic through a provider’s servers. They share technology but serve different purposes.
This article is general information, not security or legal advice. Products and their claims vary, and this text does not recommend or assess any provider.
What a VPN encrypts, and what it does not
This is the most misunderstood point.
What a VPN typically protects:
- Traffic between your device and the VPN server, which is hidden from people on the same local network, such as other users of a cafe’s Wi-Fi.
- The visibility of which sites you visit from your internet provider or local network operator, although the VPN provider itself can see more.
- Your apparent network address, which is replaced by the VPN server’s address in the eyes of the sites you visit.
What a VPN does not do:
- It does not make you anonymous. The VPN provider can generally see your traffic’s destinations, and sites can still recognize you through logins, cookies and other forms of online tracking.
- It does not protect against phishing, malware or fraudulent sites. A scam page is just as dangerous through a tunnel.
- It does not protect data after it leaves the VPN server. If a site uses plain unencrypted connections, the stretch between the VPN server and that site is not protected by the VPN, though most sites now use encryption of their own.
- It does not secure a compromised device or account.
- It does not make you legally immune. Illegal activity remains illegal.
Common reasons people use one
Public Wi-Fi. On shared networks, a VPN can add a layer against snooping by other users or a poorly managed network. The need has lessened as most websites now encrypt connections by default, but a VPN can still help with the visibility of what you do on the network.
Remote access for work. Organizations often require a VPN so staff can reach internal systems. This lets the company keep those systems off the open internet and apply access rules. It is a staple of remote work technology, though many companies are moving toward approaches in the style of zero trust, where each request is verified instead of trusting anyone inside a tunnel.
Linking sites. A business with multiple offices can connect them over the internet using VPNs, as an alternative to leased lines.
Reducing local exposure while traveling. Some travelers use VPNs to keep their traffic from being easily observed by hotel or airport networks.
Changing apparent location. People sometimes use VPNs to appear in a different region, for example to reach services from abroad. Terms of service for some services forbid this, and rules differ by country, so users should check what applies to them.
Weighing the benefits and costs
Potential benefits: protection on untrusted networks, a way to reach internal business resources, and some reduction in what local network operators can see.
Costs and risks:
- Trust moves, it does not vanish. You shift trust from your internet provider to the VPN provider. A provider that logs or misuses data, or is poorly secured, can undercut the whole purpose. Privacy claims such as “no logs” are statements by the provider that can be hard for users to verify.
- Speed. Routing through a server can slow connections, depending on distance and load.
- Cost. Reputable services typically charge subscriptions. Free services often have to earn money in other ways, which may include advertising or data collection, so their business model deserves scrutiny.
- Misconfiguration. If a VPN connection drops and the device keeps sending traffic normally, protection may silently lapse unless a safeguard such as a kill switch is available and enabled.
- Blocking and friction. Some websites and services restrict traffic from VPN addresses.
- False confidence. Believing a VPN solves everything may lead people to ignore basics such as multi-factor authentication or updates.
- Business risk. A VPN that gives broad access to an internal network can be an attractive target. If an attacker steals credentials, the tunnel may let them in. Limiting access with least privilege and monitoring VPN use are common precautions.
Choosing sensibly
For individuals, questions worth asking include: What problem am I trying to solve? Do I trust this provider, and how is it funded? What does it say it logs? Is the software kept up to date? Does it offer protection if the connection drops? Has it been independently reviewed? Be cautious of exaggerated marketing claims about total privacy or unbreakable security.
For organizations, VPN decisions are part of wider planning for remote access, alongside identity and access management, device management, logging and patching of the VPN gateway itself, which has been a common target when left unpatched.
Other measures that matter
A VPN is one tool among many. Using sites that encrypt connections, keeping software updated, enabling multi-factor authentication, using a password manager and being skeptical of unexpected messages often do more for everyday security than a VPN does. Where privacy from trackers is the goal, browser settings and account controls also play a role. In short, a VPN can be useful in specific situations, but it is neither a cure-all nor necessary for every user.