What Does a VPN Do? What It Changes and What It Does Not

A VPN encrypts the traffic between your device and the VPN server. Websites see the server’s IP address instead of yours, so you appear to be in the server’s country. Your internet provider and the local Wi-Fi can no longer see which sites you visit, but the VPN provider can. A VPN does not make you anonymous.

A VPN is a service you use through an app. Encryption scrambles data so that only someone with the right key can read it. An IP address is the number that identifies your internet connection. Our page on what a VPN is explains the term, and how a VPN works explains the technology. This page covers the results: what changes when you connect, and what stays the same.

What a VPN does

A VPN changes four things while it is connected. Each one has a limit, and the sections below explain both.

It encrypts your traffic as far as the VPN server

The Electronic Frontier Foundation (EFF) is a digital rights group. Its Surveillance Self-Defense guide says a VPN routes all your web traffic through an “encrypted tunnel” between your devices and the VPN server. The guide names WireGuard as one of two common VPN protocols. A protocol is the set of rules that the app and the server follow. WireGuard’s documentation shows the core step. The app encrypts each packet, a small piece of your data, and sends it across the internet to the server. The server then decrypts it.

The US National Institute of Standards and Technology (NIST) publishes a guide to VPNs. It lists the protections a VPN can provide, and two of them are confidentiality and integrity. Confidentiality means outsiders cannot read your data. Integrity means any change to the data on the way is detected.

That protection covers one stretch of the journey. NIST calls this setup remote access: one device connects to a VPN server, which NIST calls a gateway. Its guide says this setup “does not provide full protection for data throughout transit”. The part between the VPN server and the website is not protected by the VPN. HTTPS protects that part when the site uses it, as we explain below.

It hides your IP address from the sites you visit

Every site you visit sees the IP address your traffic comes from. The EFF notes that your IP address gives an indication of your general location and can be used to identify you. With a VPN, your traffic leaves from the VPN server. Sites see the server’s address instead of yours. Our what is my IP tool shows the address that sites see right now.

Your real address does not disappear. The VPN provider still sees it, because your device connects to its server. The EFF warns that the provider may collect it even if you pay in a way that does not reveal who you are.

It changes the country you appear to be in

Sites use your IP address to guess where you are. The EFF puts it this way: “From a website’s point of view, it appears your location is wherever the VPN server is.” Connect to a server in another country, and sites treat you as a visitor from there.

This can help with some blocks. The EFF gives the example of a school network or a place that blocks content. There, a VPN can get around some restrictions by making it look as if you connect from somewhere else. Some countries restrict VPNs, so check our VPN laws tracker first.

Streaming is less certain. The EFF notes that video platforms increasingly block devices that appear to use a VPN. It says VPNs are “not a guaranteed means to get around geographic restrictions”. We have not yet tested streaming in our lab. Our guide on how to change your Netflix region covers the steps and Netflix’s rules. If Netflix shows a proxy error, our Netflix troubleshooting guide lists the fixes.

It protects your browsing on Wi-Fi you do not trust

On public Wi-Fi, people within range of the network could choose to listen in, the EFF says. HTTPS is the encryption behind the lock icon in your browser. Most web traffic now uses it, so the content of most pages is already protected. But HTTPS leaves the metadata visible. Metadata is information about your traffic rather than its content. It includes the domain names you visit, when you visit them and how much data you load.

A VPN can hide that metadata from people on the local network. A properly set up VPN also protects any traffic that is not encrypted at all. Even so, the EFF says a VPN on public Wi-Fi is not as necessary as it used to be, because most traffic now uses HTTPS. But if you must use a network you do not trust, and you have a VPN you trust, the EFF says a VPN may be useful.

Who can see your browsing with a VPN on

With a VPN on, three parties see different things:

• Your internet provider and the Wi-Fi operator see encrypted traffic going to one VPN server. They cannot see which sites it is for. Your internet service provider is often shortened to ISP.
• The VPN provider sees what your ISP used to see. The EFF says that while a VPN hides your browsing data from the ISP, “it’s all visible to the VPN provider”.
• The sites you visit see the VPN server’s address. They still see everything you do on the site itself, including your account if you log in.

So the provider becomes the company you have to trust. The EFF warns that a disreputable VPN service might collect personal information on purpose. VPN providers also get requests from police and governments. Many keep as much information as ISPs do, according to the EFF. Our page on what “no logs” means shows how to judge a provider’s promise.

What a VPN does not do

The EFF warns that VPN adverts often overpromise. It says ads that present a VPN as the only tool you need against cyber criminals, malware and online tracking “vastly oversell the benefits of VPNs”. In its view, a VPN is best suited for one thing: “routing your network connection through a different network”.

It does not make you anonymous

The EFF says it plainly: “A VPN is not a tool for anonymity”. Your provider knows your real IP address and sees where your traffic goes. Police and governments can ask the provider for what it holds. For anonymity, the EFF points to Tor instead. Tor passes your traffic through several Tor servers. The EFF explains that, because of how Tor is designed, no single Tor server can see your browsing data. Our VPN vs Tor page compares the two.

It does not stop cookies, fingerprinting or logged-in tracking

Your IP address is only one way to recognize you. The EFF lists others that a VPN does not touch, including GPS, web cookies, tracking pixels and fingerprinting.

• Cookies are small pieces of data a site stores in your browser. The cookie standard, RFC 6265, warns that third parties such as advertising networks can use cookies to track you between sites. A VPN changes your address, not your cookies.
• Fingerprinting recognizes your device from its settings and other details it reveals. The W3C is the body that develops web standards. It defines fingerprinting as the ability of a site to identify or re-identify a visitor “via configuration settings or other observable characteristics”. Its guidance warns that “clearing cookies or using a VPN do not prevent further correlation.”
• Logging in tells a site who you are, whatever your address. The EFF adds that a VPN does nothing to stop police from getting the history saved in your browser, or in an account you are logged into.

It does not block malware or phishing

Malware is software built to harm your device. Phishing uses fake messages or sites to trick you into giving away details such as passwords. A VPN carries your traffic. It does not check whether that traffic is safe.

NIST’s guide shows the same split in a company network. There, a firewall or proxy server behind the VPN can filter malicious traffic. The VPN itself does not. NIST also notes that a compromised device is a problem even with a VPN. An attacker on that device could install tools that capture data and passwords.

Some VPN apps add a blocker for ads and trackers. The EFF calls these extra features. It notes that they work at the DNS level, which is less precise than a blocker in your browser. DNS is the system that turns site names into addresses. Treat such a blocker as a bonus, not as antivirus.

It does not replace HTTPS

HTTPS and a VPN protect different stretches of the path. The HTTP standard, RFC 9110, defines an HTTPS connection as one where all communication with the website’s server has confidentiality and integrity protection. That protection runs all the way to the site. A VPN’s protection ends at the VPN server, as NIST’s guide shows. On a site without HTTPS, the VPN server and every network after it can read what you send. So keep your browser’s HTTPS-only mode on. The EFF lists it among the steps that matter more than a VPN.

When a VPN is worth it

A VPN is worth paying for when at least one of these applies to you:

• You often use networks you do not trust, such as hotel, airport or café Wi-Fi.
• You do not want your ISP to see which sites you visit. The EFF cites a 2021 report in which the US Federal Trade Commission found that ISPs share more browsing data with third parties than you might expect.
• You need to reach your office network while you travel. This is one of two situations where the EFF says VPNs are useful in practice.
• A network blocks sites you need, and using a VPN is legal where you are. Getting around censorship is the EFF’s other situation.
• You want to appear to be in another country, and you accept that some services will block you.

A VPN is a poor buy if you want protection from malware or scams, or if you want to be anonymous. The EFF says that in many cases a VPN “isn’t the most important security step to take”. The steps it suggests instead include:

• strong passwords and two-factor authentication, which asks for a second proof such as a code when you log in
• HTTPS-only mode in your browser
• device encryption and regular software updates
• chat apps with end-to-end encryption
• encrypted DNS and tracker blocking

A VPN also sends your traffic on a detour through its server. We have not yet tested speed in our lab. So we make no claims about how much any VPN slows a connection. Our page is a VPN worth it compares prices and use cases in more detail. To try one before you pay, see our list of VPN free trials and free plans.

How to check that your VPN is working

A VPN does these jobs only while the connection holds. Connect, then open our VPN check. The address and country should match the server you picked, not your home. The same page runs two leak tests that look for your real address escaping the VPN.

If the connection drops, the app’s kill switch decides what happens next. Our page on the VPN kill switch explains how it works. If you only want a new address for a while, our guide on how to change your IP address compares a VPN with the other options.

Related

• What is a VPN?
• How does a VPN work?
• Is a VPN worth it?
• VPN vs Tor
• VPN vs proxy
• What “no logs” really means
• How to change your IP address
• Is my VPN working? Leak check