What Is a VPN? How It Works and What It Actually Hides

A VPN encrypts traffic to a VPN server and changes the public IP websites see. Learn what it hides, what it cannot protect, and how to test it.

By Tudor Uzun

Founder and Senior Software Engineer, IP Trackers

Published August 1, 2026Updated August 20, 2026Editorial standards

A VPN, or Virtual Private Network, creates an encrypted connection from your device to a VPN server. Websites see the server's public IP instead of your home IP, while your ISP or public Wi-Fi operator sees the tunnel rather than each destination inside it. A VPN improves privacy at the network layer, but it does not hide your accounts, cookies, GPS, fingerprint, or unsafe behavior.

What is a VPN?

VPN stands for Virtual Private Network. It is a network service that creates a protected path between a VPN client on your device and a remote VPN server operated by a provider, employer, or by you. Your normal internet connection still carries the packets, but the local network sees an encrypted tunnel to that server instead of a separate readable connection to every destination.

The VPN server becomes the public exit point. It forwards requests to websites and returns their responses through the tunnel. Those sites normally see the server's IP and approximate location, not the public IP assigned to your router or phone by your ISP.

How does a VPN work?

1. You launch the VPN app and authenticate to the provider.
2. The client negotiates an encrypted tunnel to a selected VPN server.
3. Your device routes traffic through that tunnel instead of directly to the internet.
4. The VPN server removes the outer VPN-tunnel encryption and forwards the request. HTTPS content remains encrypted until the destination.
5. The destination website sees the VPN server IP as the source.

That is the core reason VPNs are useful: they change the visible exit IP and protect traffic on the local path. They do not erase everything else about your identity or browser behavior.

What changes when the VPN connects?

What is a VPN server, provider, client, and tunnel?

A VPN feels simple when you press the connect button, but several pieces have to cooperate for the connection to work correctly. The VPN app is the client. It authenticates your account, chooses a server, sets up a virtual network adapter, negotiates keys, and changes routing rules on your device. The VPN server is the exit point. It receives encrypted packets from you, decrypts them, forwards them to the destination, and sends replies back through the tunnel.

The virtual adapter is important because it lets the operating system treat the VPN as a network path. When the VPN is connected, the OS can route traffic into that adapter instead of sending it directly through Wi-Fi, Ethernet, or mobile data. If routing rules are wrong, the app may say connected while some traffic still uses the normal interface. That is why a real test checks IP, DNS, WebRTC, IPv6, and ASN behavior rather than trusting the status light.

DNS is another piece of the connection. When you visit a domain, your device has to ask a resolver for the IP address first. A good VPN setup sends those DNS queries through the VPN or to a resolver controlled by the provider. A weak setup changes the visible IP while DNS queries still go to your ISP or browser-level resolver. That is a classic DNS leak, and it is one reason our DNS leak test sits next to VPN verification.

What is VPN passthrough?

VPN passthrough is a router setting, not a VPN. It lets older protocols - PPTP, L2TP, and IPsec - cross the router's NAT so a device behind it can reach a VPN server somewhere else. Those protocols predate NAT and break without help, which is why the toggle exists at all.

Two things follow. Turning passthrough on does not encrypt anything or route your traffic anywhere: the VPN still runs on the device, and passthrough only stops the router interfering. And if you use WireGuard or OpenVPN, you almost certainly do not need it, because both run over ordinary UDP that NAT already handles. Finding the setting disabled is rarely the reason a modern VPN will not connect.

What is a VPN concentrator?

A VPN concentrator is enterprise equipment that terminates many tunnels at once, so hundreds or thousands of remote employees can reach an internal company network through a single managed endpoint. It handles authentication, key exchange, and routing for all of them centrally.

It is worth knowing the term mainly so you can recognise that it does not apply to you. Nothing about a consumer VPN subscription involves a concentrator - your provider operates its own server fleet, and you are a client connecting to it. The word turns up in networking coursework and job descriptions far more often than in anything a home user buys.

What is a VPN router?

A VPN router runs the VPN client itself, so every device on the network is tunnelled without installing an app on each one. That is the way to cover a smart TV, a games console, or anything else that cannot run VPN software. The trade-off is speed: the router's CPU has to encrypt every packet, and consumer hardware is much weaker at that than a phone or laptop, so throughput usually drops noticeably.

Consumer VPNs, business VPNs, and self-hosted VPNs

The word VPN is used for several related products. A consumer VPN is what most people mean today: a privacy or location-shifting service with apps for phones, laptops, browsers, and sometimes routers. The goal is usually to change the public IP, protect traffic on untrusted networks, reduce direct exposure to websites, or route through another region.

A business VPN has a different purpose. It connects employees to a private company network so they can reach internal applications, databases, admin panels, and file systems. In that model, the VPN is often less about hiding from public websites and more about controlled access. The company cares about authentication, device posture, monitoring, and limiting which internal resources a user can reach.

A self-hosted VPN is a server you run yourself, often with WireGuard or OpenVPN on a VPS or home server. It can be excellent for secure remote access to your own network, but it is not the same as a large consumer privacy VPN. If you host it on one VPS, websites see that VPS provider every time. You gain control and simplicity, but you do not get a large shared exit network or frequent location switching.

VPNs and HTTPS are not the same thing

Modern websites usually use HTTPS, which encrypts traffic between your browser and the website. A VPN encrypts traffic between your device and the VPN server. Those protections overlap in casual conversation, but they solve different problems. HTTPS protects the content of the connection to a specific site. A VPN protects the local path and changes the network address that the site sees.

On a normal HTTPS website without a VPN, your ISP can usually see that you connected to a destination domain or IP, but not the private content of the page. On the same HTTPS website with a VPN, your ISP sees an encrypted tunnel to the VPN provider, while the destination website sees the VPN server IP. The VPN provider, however, can see that your account or tunnel reached certain destinations unless the provider designs the service to minimize that visibility.

This is why a VPN is not a replacement for HTTPS. You still want HTTPS for passwords, payment forms, account sessions, and private content. The VPN changes the network path; HTTPS protects the application session. The strongest everyday setup uses both.

VPN protocols and why they matter

VPNs use different protocols to establish secure tunnels. Common examples include:

• OpenVPN: mature, flexible, and widely supported
• WireGuard: modern, fast, and efficient
• IKEv2/IPsec: useful on mobile devices that switch networks often
• L2TP/IPsec: older and less preferred in modern setups
• PPTP: outdated and insecure, generally not recommended

The best protocol depends on your device, network conditions, and provider implementation. In practice, users often care most about the speed, stability, and leak behavior that result from those protocol choices.

Important VPN features explained plainly

Kill switch

A kill switch blocks traffic if the VPN tunnel drops. Without one, a brief reconnect can expose your normal public IP before the VPN comes back. A good kill switch should protect the whole device, not only the VPN app interface. You can test it by watching your public IP before, during, and after forced reconnects.

Split tunneling

Split tunneling lets some apps use the VPN while other apps use the normal connection. It is useful when a banking app, printer, game, or work tool breaks over the VPN. It is also a common leak source. If your browser is excluded from the tunnel, the VPN app can say connected while websites still see your home IP.

Dedicated IP

A dedicated IP is a VPN exit address assigned only to you or your account. It can reduce login challenges and blocklist issues because the IP is not shared by thousands of users. The tradeoff is privacy: shared exits blend many users together, while a dedicated IP is easier to associate with one customer over time.

Multi-hop

Multi-hop routes traffic through more than one VPN server before it reaches the destination. It can reduce the amount of context available to any single server in the chain, but it often costs speed and latency. It is most useful when your threat model values separation more than raw performance.

Obfuscation

Obfuscation makes VPN traffic look less like ordinary VPN traffic. It can help on networks that block VPN protocols or apply heavy filtering. It is not magic. A network operator may still detect patterns, endpoints, or known VPN infrastructure, but obfuscation can make simple protocol blocking less reliable.

What a VPN hides from different observers

A useful way to understand VPN value is to ask "hidden from whom?" The answer changes depending on the observer. A coffee-shop Wi-Fi operator sees that you are connected to a VPN server, but not the individual sites inside the tunnel. Your ISP sees the VPN endpoint and timing, but not the final browsing destinations in the same simple way it would without the VPN. The websites you visit see the VPN exit IP rather than your home IP.

The VPN provider is different. Because your traffic exits through its infrastructure, the provider becomes an important trust point. Strong providers try to reduce retained logs, publish audits, run RAM-only servers, separate account systems from traffic systems, and explain what happens when they receive legal requests. Weak providers give vague promises without evidence.

Websites can still identify you through account sessions, cookies, browser fingerprinting, payment details, device identifiers, and the things you type or upload. A VPN changes the network layer. It does not reset every identifier above that layer. If you log into the same account from your normal IP and VPN IP, the service can link both sessions to the same user.

Can someone tell I am using a VPN?

In most cases, yes. VPN detection is a routine part of modern web operations, and the signals are not subtle. The visible exit IP usually belongs to a known data-center ASN rather than a residential or mobile ISP. Public threat feeds, anti-fraud databases, and commercial proxy-detection services maintain lists of VPN endpoints that are updated over time. A website can compare the source IP with those datasets and treat it as likely VPN or hosting traffic.

That detection rarely tells the site exactly which VPN you use, but it does tell them you are on one. Streaming services, banks, large marketplaces, and many SaaS platforms use this information to apply extra friction: a second login challenge, a captcha, a temporary block, or stricter fraud scoring. None of that means the VPN is broken. It means the operator chose to react to VPN traffic. A clean login flow without challenges is not proof the site cannot tell - it just chose to let you through.

Your ISP can also tell you are using a VPN, though usually in a coarser way. The ISP sees an encrypted tunnel from your home to a single endpoint with predictable patterns (steady connections to one IP, large flow volumes, periodic handshakes). It cannot read the contents, but the fact that you are tunneling somewhere is plain. In countries that restrict VPN use, this is the layer that gets inspected first, which is why obfuscation protocols exist - they try to make the tunnel look less like an obvious VPN.

Browser-level detection is a separate path. A site can run JavaScript that compares your stated location to time zones, language settings, WebRTC-exposed addresses, and browser fingerprint patterns. If your IP says Toronto but your browser reports a European time zone and a non-English locale, the inconsistency is detectable. A VPN that only changes the IP without aligning the rest of the browser environment will look anomalous to anti-fraud systems even when network-level detection is clean.

Can you trust a VPN provider and its no-logs claim?

A VPN changes who sits in the middle of your connection. Your ISP sees less destination detail, but the VPN provider operates the exit path. That makes provider trust a design requirement, not a marketing detail. The phrase "no logs" is useful only when the company explains exactly which traffic, connection, account, diagnostic, and payment data it collects, why it needs each category, and how long it keeps it. A provider can avoid logging browsing history and still retain account email, payment records, crash and diagnostic reports, bandwidth totals, device identifiers, or connection timestamps for abuse prevention. Some of that is reasonable to keep; all of it should be disclosed plainly.

Look for evidence that can be checked: recent independent audits with a defined scope, transparent ownership, clear incident handling, open-source clients with reproducible builds where practical, and policies that distinguish traffic logs from aggregate operational metrics. RAM-only servers can reduce what survives a reboot, but they do not prove that no data is exported or stored elsewhere.

The warning signs run the other way. A cheap or free service with unclear ownership, aggressive advertising, bundled browser extensions, no published audit, and no real technical documentation deserves scepticism no matter how strong the privacy language on its homepage is. None of these signals is proof on its own, but together they describe a provider that has chosen not to make itself checkable.

Jurisdiction can affect which legal requests a company must answer, but an "Eyes alliance" label is not a complete trust test. Where the company is incorporated, where its servers operate, what it records, and how its systems are separated all matter. Treat jurisdiction as one factor alongside architecture, incentives, transparency, and track record. For legal-use questions, see our guide to VPN laws and restrictions.

VPN jurisdictions and the eyes alliances explained

Jurisdiction comes up constantly in VPN reviews, usually framed as "avoid 5 Eyes / 9 Eyes / 14 Eyes countries." The shorthand is useful but often oversimplified. The Five Eyes (US, UK, Canada, Australia, New Zealand) is an intelligence-sharing arrangement, not a unified surveillance court. The Nine Eyes adds Denmark, France, Netherlands, and Norway; Fourteen Eyes adds Germany, Belgium, Italy, Sweden, and Spain. The shared agreement is about intelligence cooperation between signals agencies - it does not directly create new legal powers for commercial subpoenas or law enforcement requests.

What actually matters operationally is whether a country's laws require VPN providers to log user activity or respond to local data requests. Switzerland (Proton VPN's base) and Panama (NordVPN) are often cited as privacy-friendly because their domestic surveillance laws do not mandate broad data retention by communication providers. Sweden (Mullvad) is technically inside the 14 Eyes umbrella but has explicit case law supporting Mullvad's refusal to retain user data, which is why the 2023 raid produced nothing. Romania and Bulgaria (where several smaller providers operate) have rejected EU data retention directives. The legal environment is more granular than the eyes alliance maps suggest.

Beyond the headquarters country, you also need to consider where servers physically sit and where the provider's legal entity owns infrastructure. A Swiss-headquartered VPN with a server farm in Frankfurt is still subject to German law for actions taken on those servers. Most large providers respond to this by running rented infrastructure they can disconnect quickly and by using RAM-only nodes that do not persist data across reboots. The practical effect is that a server seized in a friendly jurisdiction produces nothing useful, regardless of the legal regime around it.

For most everyday users, the jurisdiction debate matters less than the audit history and architecture choices. A provider with a strong technical track record in a 14 Eyes country is often more trustworthy than an unknown provider in a privacy-friendly jurisdiction with no published audits. Use jurisdiction as a tiebreaker, not the primary criterion.

VPN speed, latency, and reliability

A VPN adds work. Traffic is encrypted, sent to a VPN server, forwarded to the destination, and returned through the same tunnel. That can reduce throughput and increase latency. The size of the penalty depends on your baseline connection, the protocol, server distance, server load, peering quality, device CPU, and whether the VPN provider has enough capacity in the region you picked.

Speed tests can be misleading because they measure one moment on one route. A VPN may be fast to a nearby test server and slow to a game server, video service, or work application. For real evaluation, test the things you actually use: video startup, download stability, upload behavior, video calls, game latency, and whether sites keep challenging your logins.

Reliability matters as much as peak speed. A VPN that is usually fast but drops during calls or exposes traffic during reconnects may be worse than a slightly slower provider with stable routes and a strict kill switch. If the goal is privacy, consistency beats the best screenshot from a speed test.

When is a VPN useful?

A VPN is a strong fit when the problem is the network path or exposure of your public IP. The table below separates those jobs from problems that need a different control.

This framing keeps expectations realistic. A VPN is excellent when the problem is network path exposure or public IP exposure, and limited when the problem lives at the account, browser, device, or human layer. The better you define the problem, the easier it is to choose between a VPN, a proxy, Tor, browser hardening, DNS changes, or simply changing an app permission.

Limitations of VPNs

Not complete anonymity

A VPN improves privacy, but it does not make you anonymous. Websites can still identify you through account logins, cookies, browser fingerprints, device identifiers, or behavior patterns.

Provider trust still matters

When you use a VPN, you shift part of your trust from the local network and ISP to the VPN provider. That is why the provider's logging policy, jurisdiction, technical reputation, and audit history matter.

Speed and compatibility tradeoffs

A VPN often reduces speed at least somewhat because traffic is encrypted and routed through another server. Some sites also challenge or block VPN exits, especially when those exits are tied to abuse or heavy shared usage.

Legal and policy limits

A VPN does not make unlawful activity lawful, and it does not override the terms of every service you use. Some platforms restrict VPN traffic for fraud control, licensing, account security, or abuse prevention. Some countries regulate or restrict VPN use. If your use case is sensitive, check the rules that apply to your location and the service you are accessing.

Location signals outside the VPN

Apps and websites may receive location from GPS, Wi-Fi positioning, Bluetooth beacons, account billing country, SIM country, shipping addresses, browser permissions, or the content you upload. A VPN changes your IP location, not every location source on the device. If an app has precise location permission, the VPN cannot hide that signal.

Free VPNs vs paid VPNs

A free VPN is not automatically unsafe, and a paid VPN is not automatically trustworthy. The useful comparison is the business model and the evidence behind it. A reputable free tier may be funded by paid subscribers and clearly limit data, locations, devices, or speed. A risky service may hide who operates it, request excessive permissions, inject advertising, or give no clear explanation of data collection.

• Check who owns and operates the service.
• Read the data and logging policy, not only the home-page promise.
• Compare limits on data, speed, locations, and devices.
• Look for current audits, maintained apps, and security history.
• Test IP, DNS, WebRTC, and IPv6 behavior after installation.

Paid plans commonly remove usage limits and add more locations or support, but payment alone proves nothing about privacy. Compare the tradeoffs in our free VPN directory before choosing based on price alone.

How to choose a VPN without getting lost in marketing

Start with the job you need the VPN to do. If you mainly use public Wi-Fi, prioritize stable apps, automatic connect rules, kill switch behavior, and DNS leak protection. If you care about privacy research, prioritize audits, open-source apps, minimal account data, anonymous payment options, and transparency reports. If you care about streaming or travel, prioritize server reliability in the regions you actually need and expect results to change over time.

Then test instead of assuming. Connect to a server, check the public IP, run a DNS leak test, run a WebRTC leak test, compare ASN ownership, and repeat after switching networks. Keep notes about failures. A provider that works once during setup but fails after sleep, Wi-Fi changes, or mobile handoff is not reliable enough for privacy-sensitive use.

Be skeptical of extremes. "Military grade encryption" is usually a vague phrase. Huge server-count claims do not prove good routing. Lifetime deals can create bad incentives. Free unlimited VPNs need some monetization model, and that model may be the product. Good providers explain tradeoffs instead of pretending every use case is perfect.

We apply those same checks in our current VPN comparison, including the evidence and limitations behind each recommendation.

How do you set up and test a VPN?

1. Install the official app from the provider or device app store.
2. Record your public IP, ISP, ASN, and DNS resolver before connecting.
3. Choose a nearby server first, then enable the kill switch.
4. Leave split tunneling off until you know which apps need exclusion.
5. Connect and confirm that the visible IP and home ISP have changed.
6. Check DNS, WebRTC, and IPv6 for paths outside the tunnel.
7. Repeat after sleep, reconnecting, or switching Wi-Fi and mobile data.

A changed IP is necessary, but it is not the entire test. If the IP changes while DNS still points to the ISP, resolver traffic may be outside the tunnel. If WebRTC exposes the original public address, the browser needs attention. If IPv4 changes but IPv6 does not, the provider or device is not protecting both network stacks.

A practical rule is to test the exact thing you care about. If you care about hiding your home IP, compare the visible IP and ASN. If you care about DNS privacy, run the DNS leak test. If you care about browser exposure, run the WebRTC test. If you care about IPv6, test IPv6 directly. VPN confidence should come from observable behavior, not from the connect button.

Keep that test record after setup. A short note with the server region, protocol, visible IP, ASN, DNS resolver, and leak-test result makes future troubleshooting much faster when an app update or network change breaks something. Repeat the same notes on every device you depend on.

Run the complete before-and-after workflow with Is My VPN Working?. If the app says connected but the IP stays the same, use our VPN troubleshooting guide.

VPNs on phones, laptops, browsers, and routers

Phone VPN apps

Phone VPN apps are convenient because they protect traffic on mobile data, public Wi-Fi, hotel Wi-Fi, and tethered networks with one switch. They also have a special challenge: phones move between networks often. A good mobile VPN should reconnect cleanly when you move from Wi-Fi to cellular, when the screen sleeps, and when the phone changes towers. If the tunnel drops silently during those transitions, your visible IP may switch back to the carrier without you noticing.

Mobile apps can also collect location through GPS or operating-system permissions. A VPN does not block that. If a weather app, map app, ride service, or social app has location permission, it can still receive device location even while the IP points somewhere else. For mobile privacy, pair the VPN with careful location permissions and background app review.

Laptop and desktop VPN apps

Laptop VPNs usually give more control: protocol selection, kill switch, split tunneling, custom DNS, LAN access, auto-connect rules, and startup behavior. Those options are useful, but they also create more ways to misconfigure the tunnel. A browser excluded through split tunneling, a custom DNS resolver left in the operating system, or a virtual machine using bridged networking can all produce surprising results.

On desktops, re-test after browser updates, VPN updates, and operating system network changes. The setup that passed last month can fail after a new browser DNS-over-HTTPS default, a VPN app reset, or a changed firewall rule.

Browser VPN extensions

Browser VPN extensions are often proxies rather than full-device VPNs. They may route only browser traffic and leave other apps untouched. That can be fine for a narrow use case, but users often overestimate the protection. A browser extension will not automatically protect a game client, torrent app, system updater, email client, or another browser. Check the provider documentation carefully before treating an extension as a full VPN.

Router VPNs

A router VPN sends traffic from many devices through the VPN without installing an app on each device. That can help with smart TVs, consoles, and devices that do not support VPN apps. The tradeoff is complexity. Router CPUs can be slow at encryption, server switching is less convenient, and one bad router rule can affect every device in the house.

Router VPNs also make troubleshooting harder because the device may not know it is behind a VPN. If a laptop has its own VPN app running inside a router-level VPN, you may be double tunneling without meaning to. If a streaming device fails, the issue may be the router server, DNS setting, or the service blocking that exit IP. Test router setups with the same IP, DNS, WebRTC, and IPv6 checks, but do it from several devices.

Common VPN symptoms and what they usually mean

• VPN says connected, but IP is unchanged. The browser or device is not using the tunnel. Check split tunneling, reconnect, change server, and read VPN connected but IP not changing.
• IP changed, but DNS still shows the ISP. The VPN is not controlling resolver traffic. Enable DNS leak protection and review browser secure-DNS settings.
• Some sites work and others block you. The VPN exit may be on a denylist, overloaded, or classified as hosting/proxy infrastructure. Try another server and compare the ASN.
• Speed collapses on one server. Server load, distance, peering, or protocol choice may be the cause. Try nearby servers and compare WireGuard/OpenVPN/IKEv2 if available.
• Local printers or smart devices stop working. The VPN may block local LAN access. Look for a "local network access" or "allow LAN" setting if you need it.

Building a realistic VPN threat model

A threat model is just a plain answer to "what am I trying to protect, and from whom?" A traveler on hotel Wi-Fi may care about local network interception. A gamer may care about not exposing a home IP to strangers in a voice server. A journalist or activist may care about much stronger adversaries and should not rely on a consumer VPN alone. A remote worker may care about secure access to company systems rather than hiding from websites.

Once the threat model is clear, VPN choices get easier. If the problem is local Wi-Fi risk, auto-connect and kill switch behavior matter. If the problem is IP exposure to websites, exit locations and shared IP reputation matter. If the problem is censorship or network blocking, obfuscation and protocol flexibility matter. If the problem is account tracking by the service you log into, a VPN alone is not the main fix.

When not to use a VPN

There are times when turning the VPN off temporarily is reasonable. Some banking, government, healthcare, school, and workplace systems treat VPN exits as riskier logins and may lock accounts or require extra verification. Some low-latency gaming sessions work better without the extra hop. Some local network tasks, like printing or casting, can fail if the VPN blocks LAN discovery.

The point is not that VPNs are bad. The point is that they are tools. Use them where they solve the problem, and understand the tradeoff when they do not. If you turn a VPN off for compatibility, remember to turn it back on before returning to the browsing or network scenario where you wanted protection.

What a VPN is not

Much of the confusion around VPNs comes from treating them as a general-purpose security product. They are a network-layer tool with a specific job, and these are the categories they are regularly mistaken for.

• Not a firewall: it changes the path and encrypts traffic, but it is not the same as host or network filtering
• Not anti-malware: it does not stop malicious files by itself
• Not Tor: VPNs are a different trust and routing model from Tor relays, where no single operator sees both ends of the connection
• Not a cure for tracking: many identifiers still work above the network layer, including cookies, logins, and browser fingerprints
• Not an anonymity guarantee: it changes what the network sees, not who you are to services you sign in to

Common mistakes and edge cases

• Choosing only on marketing. The real quality test is routing stability, leaks, and trust, not slogans.
• Ignoring DNS and WebRTC leaks. A changed IP alone is not the whole story.
• Assuming every blocked site will work through a VPN. Some services actively detect and reject shared exits.
• Expecting no speed impact. Another encrypted hop usually changes latency and throughput at least somewhat.
• Using a VPN while staying logged into everything. That limits the privacy gain.

Useful IP Trackers tools and guides around VPNs

• IP Address Lookup for basic before-and-after public IP checks
• DNS Leak Test for resolver leakage checks
• WebRTC Leak Test for browser-side exposure checks
• Is My VPN Working? for a focused testing workflow
• How to hide my IP for the broader decision tree around VPNs, Tor, and proxies

Frequently asked questions

What does VPN stand for? VPN stands for Virtual Private Network. It describes a protected network connection between your device and a remote VPN server.

What does a VPN actually do? It encrypts the network path from your device to a VPN server, then sends traffic to the internet from that server. This changes the public IP seen by websites and reduces what the local network can inspect directly.

How does a VPN work? A client app negotiates an encrypted tunnel, routes selected traffic into it, and sends the packets to a VPN server. The server removes the outer tunnel layer and forwards the request; HTTPS remains encrypted to the destination.

What is a VPN server? It is the remote endpoint that accepts the encrypted tunnel and acts as your public internet exit. A commercial provider usually operates many servers in different regions.

Does a VPN hide your IP address? Usually yes from the websites and services you reach through the tunnel. They see the VPN server's exit IP instead of the public IP assigned by your ISP.

Does a VPN make you anonymous? No. Accounts, cookies, browser fingerprints, payments, GPS, and your own activity can still identify you. A VPN changes important network signals, not every identity signal.

Do you need a VPN at home? Not everyone does. It is useful when you want to hide your home IP from remote services, reduce ISP visibility into destinations, or keep one protected workflow across home and public networks. HTTPS and good account security still matter. If you decide you want one, see our current VPN comparison for the picks and the limitations behind each.

Next: how to hide your IP, proxy vs VPN, and what Tor is.