A VPN, or virtual private network, is a service that creates an encrypted tunnel between your device and a remote server, so your internet traffic travels through that server instead of going directly to its destination. The effect is twofold: websites see the address of the VPN server rather than your own, and anyone watching your local network, such as others on a public Wi-Fi hotspot, sees only scrambled data. The Electronic Frontier Foundation (EFF) describes a VPN as a way of connecting your computer securely to another network across the internet.
What is a VPN in plain terms?
Normally, when you visit a website, your request travels from your device to your internet service provider (ISP) and then out to the site, which can see the address you are connecting from. A VPN inserts an extra step. Your device first makes an encrypted connection to a VPN server. All of your traffic is packaged, encrypted and relayed to that server, where it is decrypted and passed on to its destination. Responses return the same way. To the wider internet, the request appears to come from the VPN server, not from you.
How does a VPN work?
The core mechanism is the encrypted tunnel. Encryption scrambles data so that only the intended parties can read it. When a VPN is active, the data leaving your device is encrypted before it reaches your local network or ISP, which means those parties can no longer read the contents or easily tell which sites you are visiting. The VPN server acts as the exit point to the internet, substituting its own IP address for yours.
Behind the scenes, VPNs rely on protocols, which are agreed methods for setting up the tunnel and handling encryption. Common examples include OpenVPN, IPsec and the newer WireGuard. These handle authentication, so each side confirms who it is talking to, and encryption, so the data in transit stays private.
What was a VPN originally for?
VPNs were not created for consumer privacy. They were built so that organisations could give staff secure access to internal systems from outside the office. As the EFF explains, when a remote worker connects through a corporate VPN, their traffic is encrypted and relayed to the organisation, and to that network it looks as though the request is coming from inside the building rather than from a distant location. This lets employees reach internal file servers, printers and applications safely over the public internet. That business use remains widespread today.
What can and cannot a VPN protect?
It helps to be precise about what changes when you use a VPN. The table below summarises common expectations.
| Goal | Does a VPN help? | Notes |
|---|---|---|
| Hide your IP from websites | Yes | Sites see the VPN server’s address instead. |
| Shield traffic on public Wi-Fi | Yes | Local observers see only encrypted data. |
| Hide activity from your ISP | Yes, mostly | Trust moves to the VPN operator instead. |
| Full anonymity online | No | Logins, cookies and fingerprinting still identify you. |
| Protection from malware | No | A VPN is not antivirus or a firewall. |
Does a VPN make me anonymous?
No. This is the most important limitation to understand. A VPN hides your IP address from the sites you visit and from your local network, but it does not erase your identity. You can still be tracked through accounts you log into, through cookies stored in your browser, and through browser fingerprinting techniques. Crucially, a VPN moves trust rather than removing it. Your ISP can no longer see your traffic, but the VPN operator now can, because your data passes through its servers. The EFF has cautioned that VPNs are not a magic privacy solution and that their protection depends on the trustworthiness of the provider.
How do I judge whether a VPN is trustworthy?
Because a VPN can see the traffic you route through it, the operator’s practices matter a great deal. Points often raised by privacy experts include how the provider handles logs of user activity, where it is based and under what laws it operates, how transparent it is about ownership and security, and whether it has undergone independent audits. A free or poorly run VPN may fund itself by collecting and selling data, which can undermine the very privacy a user sought. In short, using a VPN means deciding to trust the operator instead of, or in addition to, your ISP.
What are the main types of VPN?
Not all VPNs serve the same purpose, and it helps to distinguish two broad categories. A remote-access VPN connects an individual device to a private network, which is the model behind both corporate remote work and most consumer VPN apps. A site-to-site VPN, by contrast, links whole networks together, for example connecting two office locations of the same organisation over the internet as if they were on one network. Consumer VPN services are almost always remote-access VPNs, marketed for privacy on personal devices, whereas businesses use both types depending on whether they are connecting people or places.
Does a VPN slow down my connection?
It can. Because traffic is encrypted and routed through an additional server, a VPN often adds some overhead, which may reduce speed or increase delay. The size of that effect depends on factors such as the distance to the VPN server, how busy that server is, and the protocol in use. Newer, lightweight protocols like WireGuard are designed partly to reduce this cost. For everyday browsing the impact is frequently modest, but for latency-sensitive uses it can be noticeable. This trade-off between protection and performance is a normal part of how VPNs work, and it is worth weighing against the privacy benefits when choosing whether and when to keep a VPN switched on.
Is using a VPN legal?
In most countries VPN use is legal and routine, particularly for remote work and general privacy. Some jurisdictions restrict, regulate or discourage them, so laws vary by location. Using a VPN does not, by itself, make otherwise unlawful activity legal, and it does not exempt a user from the rules of the services they access.
The bottom line
A VPN is a practical tool for encrypting your connection, hiding your IP address and protecting traffic on untrusted networks, and it remains essential for secure remote access to organisational systems. It is not, however, a shortcut to anonymity or a substitute for other protections such as strong passwords, software updates and careful browsing. Used with realistic expectations, and with a provider you have reason to trust, a VPN is a useful layer in a broader approach to online privacy and security.
Frequently Asked Questions
What does a VPN actually do?
A VPN encrypts the connection between your device and a server it operates, then forwards your traffic to the wider internet from that server. Websites see the VPN server's address rather than yours, and anyone watching your local network sees only scrambled data. It changes who can see your traffic, not whether you are online.
Does a VPN make me anonymous?
No. A VPN hides your IP address from the sites you visit and from local observers, but the VPN operator can potentially see your traffic, and you can still be identified through logins, cookies and browser fingerprinting. The EFF has stressed that a VPN shifts trust rather than removing it, and does not deliver full anonymity.
Why do companies use VPNs?
VPNs were originally designed so employees could securely reach internal company resources, such as file servers and applications, from outside the office. The encrypted tunnel makes a remote device behave as if it were connected inside the organisation's network. This remains a core business use today.
Is a VPN legal and safe to use?
In most countries using a VPN is legal, though some jurisdictions restrict or regulate them. Safety depends heavily on the provider, because your traffic passes through its servers. Choosing a reputable operator with clear privacy practices matters, since a poorly run or malicious VPN could see the very data you hoped to protect.
Does a VPN protect me on public Wi-Fi?
It helps. On shared networks such as cafes or airports, a VPN encrypts your traffic so others on the same network cannot easily read it. Modern websites already use HTTPS encryption for much traffic, but a VPN adds a further layer and hides which sites you connect to from the local network.
