What a VPN does, and what it doesn't

A VPN (virtual private network) encrypts the internet traffic between your device and a server run by the VPN provider, then sends it on to the wider internet from there. That hides the content of your traffic from the local network and from your internet provider, and it means websites see the VPN server's IP address instead of yours. It does not make you anonymous, it does not stop you falling for a scam, and it does not replace software updates or antivirus software. It is one useful layer of protection, not a complete security plan.

How a VPN works

When you switch a VPN on, the app on your device creates an encrypted connection, often called a tunnel, to a VPN server. Everything your device sends travels through that tunnel. The server decrypts it and passes it on to the website or service you asked for. Replies come back the same way.

The practical effect is that two parties lose sight of what you are doing: whoever runs the network you are connected to, and your internet service provider. A third party gains that view: the VPN provider. That is why a provider's logging policy, and whether it has been independently audited, matters so much.

What a VPN does well

• It encrypts traffic between your device and the VPN server, so other people on the same Wi-Fi network cannot read or alter it.
• It hides your real IP address from the websites and apps you connect to, which see the server's address instead.
• It stops your internet provider from seeing which sites you visit. The provider can still see that you are connected to a VPN and roughly how much data you use.
• It sends your DNS lookups, the step where your device turns a site name into an address, through the tunnel, as long as the app handles DNS properly.
• When you travel, it encrypts your connection on unfamiliar networks, and connecting through a server in your home country lets services you already use, such as online banking, see a familiar location.

Public Wi-Fi is where these benefits are most obvious. In a cafe, hotel or airport you do not know who runs the network or who else is on it. A VPN means that what leaves your device is encrypted before it touches that network.

What a VPN does not do

It does not make you anonymous. If you sign in to an account, the service knows it is you, whatever IP address you appear to come from. Websites can also recognise returning visitors through cookies and browser fingerprinting, which looks at details such as your screen size, fonts and browser version.

It does not stop tracking through accounts and cookies. Advertising networks and platforms you are logged in to can still connect your activity across sites. Clearing cookies, using private browsing windows and reviewing the privacy settings on your accounts deal with this better than a VPN alone.

It does not stop phishing by itself. A fake login page is just as convincing over a VPN. Some VPN apps include threat protection features that block known malicious sites, which helps, but the main defence is still checking where a link really goes before you type a password.

It does not replace antivirus software or updates. A VPN protects data while it travels. It does not remove malware already on your device, and it does not patch the security holes that operating system and app updates fix.

It does not protect your data once it reaches a website. If a service you use suffers a data breach, the VPN cannot help, because your data was delivered to that service as intended.

The trade-offs to know about

A VPN adds an extra stop on the way to every site, so your connection may be a little slower, especially if you choose a server far away. Modern protocols such as WireGuard are designed to keep this overhead low, and choosing a nearby server usually keeps the difference small.

Some sites treat VPN traffic with extra caution and may ask you to complete an additional check or sign in again. Banks sometimes flag a login from an unfamiliar location. This is normal and is not a sign that anything is wrong.

You are also moving trust from your internet provider to your VPN provider. Choose one with a clear no-logs policy that has been checked by an independent auditor, and read what its privacy policy says it collects.

When a VPN is worth turning on

• On any public or shared Wi-Fi network: cafes, hotels, airports, libraries and co-working spaces.
• When travelling, so your connection to the services you use at home is encrypted on networks you do not know.
• At home, if you would rather your internet provider did not see which sites you visit.
• When working remotely on a network you do not control.

The short version

A VPN is good at one job: protecting your traffic on its way between your device and the internet, and keeping your IP address from the sites you visit. Pair it with the basics it does not cover. Keep your devices updated, use a password manager and two-factor authentication, think before you click, and run reputable security software. Together, those habits do far more than any single tool.