VPNs explained: what they protect, and what they don’t

VPNs are often marketed as all-round privacy and security tools. They are useful in specific situations, and it pays to know which ones.

By Robert MartinPublished 5 October 2026Last reviewed 5 October 2026How we write

Diagram: your device connects through an encrypted tunnel to a VPN server, which forwards traffic to the website. The Wi-Fi owner or internet provider sees only encrypted data going to a VPN server; the website sees the VPN server's IP address. — A VPN moves the point where your traffic enters the open internet from your local network to the VPN provider’s server. *Original illustration by vardenis.online.*

How a VPN works

A VPN app on your device sets up an encrypted connection (a “tunnel”) to a server run by the VPN provider. All your internet traffic travels through that tunnel. The server then forwards it to its destination, so websites see the server’s IP address rather than your own.

Where a VPN genuinely helps

Untrusted networks: on public Wi-Fi in cafés, hotels or airports, a VPN stops other users and the network operator from seeing your traffic.
Hiding browsing from your internet provider: your provider sees that you use a VPN, but not which sites you visit.
Masking your IP address from the websites you visit.

What a VPN does not do

It does not detect or remove malware, and it doesn’t stop you entering your password on a phishing site.
It does not make you anonymous. Accounts you log in to, and other tracking techniques, can still identify you.
It does not remove risk: it moves it. The VPN provider can technically see your connection metadata, so you have to trust it.
Most websites already use HTTPS, which encrypts the content of your connection to them even without a VPN.

How to evaluate a VPN provider

Logging policy: read exactly what is and isn’t logged. Has the policy been checked by a named, independent auditor, and is the report published?
Jurisdiction and ownership: who owns the company, and under which country’s law does it operate?
Protocols: modern, well-reviewed protocols such as WireGuard or OpenVPN are preferable.
Kill switch and leak protection: check that traffic stops if the VPN drops, and that DNS requests also go through the tunnel.
Terms and renewal: as with other subscriptions, note the renewal price and cancellation process.

Legal note

Using a VPN is legal in EU countries. Using one to get around streaming services’ regional restrictions may breach those services’ terms of use, and anything illegal without a VPN is still illegal with one.

This guide contains no partner links. It reflects general good practice as of 5 October 2026. For product-specific details, the vendor’s own documentation prevails. Illustrations are original works by vardenis.online. Corrections: info@vardenis.online.

Sources

ENISA, cyber hygiene. enisa.europa.eu
UK National Cyber Security Centre, “Virtual Private Networks (VPNs)” guidance. ncsc.gov.uk
US Federal Trade Commission, “Using a VPN to protect your online privacy”. consumer.ftc.gov
WireGuard project. wireguard.com