What Is a VPN? A Beginner's Guide
Last updated: September 2026
A VPN (virtual private network) is software that creates an encrypted tunnel between your device and a server run by the VPN company. Everything you do online travels through that tunnel, and emerges onto the internet from the VPN's server instead of from your own connection.
That one change does two things:
- It hides your traffic from your local network and your ISP. Your internet provider, the coffee-shop Wi-Fi owner, or anyone snooping on your local connection sees only encrypted data going to the VPN server — not which sites you visit or what you do on them.
- It hides your real IP address from the sites you visit. Websites see the VPN server's IP and location instead of yours, which is why a VPN can make you appear to be in another city or country.
What a VPN does not do
This is the part VPN marketing usually skips. A VPN is a transport privacy tool — it protects data in transit. It does not protect you from most of the things that actually harm people online:
- Malware. A VPN transports data securely, but it doesn't judge whether that data is malicious. Download an infected attachment or install a bad app and a VPN won't stop the infection — that's what antivirus is for (Norton).
- Phishing. Scam emails and fake login pages target you, not your connection. A VPN can't stop you from typing your password into a convincing fake PayPal page (Norton, TechRadar).
- Cookies and fingerprinting. Logging into Facebook or Google tells them exactly who you are, VPN or not. Browser fingerprinting can identify your device without any IP address at all (EFF).
- Malicious or hacked websites. If the site you're visiting is compromised, encrypting the connection to it changes nothing (EFF).
- Legal requests. VPN servers exist in real countries and their logs can be subject to law-enforcement requests. A VPN cannot fully anonymize you or guarantee no logs exist — "no logs" is a promise you take on trust (EFF).
Worth knowing: the EFF points out that most web traffic is now encrypted with HTTPS anyway, which already protects the
content of what you do online. A VPN's real added value is hiding the
metadata — which domains you visit and when — from your ISP and local network. If that metadata doesn't worry you, you may not need a VPN at all. See our
honest "do I need a VPN?" guide.
VPN protocols, briefly
The "protocol" is the technical method the VPN app uses to build the tunnel. You'll see three names everywhere:
- WireGuard — the modern default. Tiny codebase (around 4,000 lines vs. OpenVPN's 100,000+), consistently the fastest in benchmarks, and easy on battery. The default choice for most people in 2026 (TechRadar, Surfshark).
- OpenVPN — the battle-tested veteran, around for two decades, open-source and heavily audited. Slower than WireGuard, but excellent at slipping past restrictive firewalls because it can run over TCP port 443 and look like ordinary HTTPS traffic (Ivacy, PIA).
- IKEv2/IPsec — best on mobile. Reconnects in under two seconds when you hop between Wi-Fi and cellular, which is its standout trick (TechRadar, ExpressVPN).
Avoid PPTP — it has known vulnerabilities and no modern VPN app should be offering it as anything but a legacy fallback (TechAdvisor).
The trust tradeoff nobody mentions
A VPN doesn't eliminate the question of who sees your traffic — it moves it. Without a VPN, your ISP sees your browsing metadata. With one, the VPN provider sees it instead. That's a reasonable trade if you trust the provider more than your ISP, but it's still trust: as the EFF puts it, subscribing to a VPN means taking it on faith that "no logs" claims are true. Independent audits help, but they verify a moment in time, not a permanent guarantee.
Verify yours actually works
A VPN that leaks is worse than no VPN — it gives you confidence you haven't earned. Run this two-minute check:
- Connect your VPN, then check what IP address sites see — the location should match your VPN server, not your home.
- Run our free VPN leak test to check for WebRTC and IP leaks in your browser.
- Read the full step-by-step checklist.
FAQ
Is using a VPN legal?
In most countries, yes. Some countries restrict or ban VPN use, and using one to bypass a streaming service's geo-blocks can violate that service's terms of service. This is not legal advice — check your local laws.
Will a VPN make me anonymous online?
No. It hides your IP and encrypts your traffic, but logins, cookies, fingerprinting, and the VPN provider's own records all still exist. "Anonymous" is marketing; "harder to observe" is the honest claim.
Do I still need HTTPS if I have a VPN?
Yes — they protect different things. The VPN hides your traffic from your ISP; HTTPS protects it from everyone between the VPN server and the website, and verifies the site is who it claims to be.
Are free VPNs safe?
Running a VPN network costs real money, so free VPNs pay for it somehow — data caps, slower speeds, ads, or in the worst cases, logging and selling your activity. Reputable providers with limited free tiers (like Proton VPN's free plan) exist, but treat any free VPN's privacy claims with extra skepticism.
Sources