A VPN (virtual private network) is a service that encrypts your internet traffic and routes it through a server run by the VPN provider, hiding your browsing from your local network and your internet provider – but it does not make you anonymous. Understanding that last part is the key to using a VPN wisely, because the advertising around VPNs often promises far more than the technology delivers.

How a VPN actually works

Normally your device talks directly to websites through your internet service provider (ISP). A VPN inserts an encrypted tunnel: your traffic goes first to the VPN’s server, and from there out to the wider internet. Two things follow. Your ISP and anyone on your local network see only encrypted data heading to the VPN, not the sites you visit. And the websites you reach see the VPN server’s IP address rather than yours. That is the whole core mechanism – it reroutes and encrypts your connection.

What a VPN does hide

  • Your browsing from your local network and ISP. On shared or public Wi-Fi, others on the network cannot see which sites you visit.
  • Your real IP address. Websites see the VPN’s location instead, which is why VPNs can bypass region blocks or local censorship.
  • Which services you use, from the network operator. Useful on networks that block or monitor specific sites.

What a VPN does NOT hide

This is where expectations need a reality check. As the EFF explains, VPN ads vastly oversell the benefits. A VPN does not:

  • Make you anonymous. When you log in to an account, that service knows it is you. Cookies, trackers and browser fingerprinting can still follow you around the web.
  • Hide your activity from the VPN itself. Your traffic is decrypted at the VPN’s end, so the provider – and the country it operates in – could in principle see it. You are moving trust from your ISP to the VPN company.
  • Protect you from malware, phishing or scams. A VPN is not antivirus. Dangerous downloads and fake login pages are just as dangerous with it on.
  • Encrypt everything by magic. HTTPS already protects the content of most site traffic; a VPN mainly adds who-can-see-the-destination privacy, not new content protection for already-encrypted sites.

Where the trust actually goes. This is the point most VPN ads skip. Without a VPN, your ISP can see the sites you connect to. With a VPN, your ISP is blinded – but the VPN provider now sits in exactly that position, because your traffic is decrypted at their end before heading out to the wider internet. You have not removed the need to trust someone; you have moved it from your ISP to the VPN company and the country it operates under. That is fine if the provider is trustworthy and has no reason to log you, and a problem if it is not. It is the single most important thing to understand before you rely on one.

When a VPN is genuinely useful

Despite the caveats, VPNs solve real problems. They are worth using to add a layer of privacy on untrusted public Wi-Fi, to reach content or services blocked on a particular network, to get around local censorship, and to connect securely to a workplace network remotely. Journalists, travelers and remote workers use them for exactly these reasons. The trick is matching the tool to the job rather than treating it as a cure-all. If your goal is strong anonymity – not just privacy from your ISP – a VPN alone is the wrong tool, and something like the Tor Browser is designed for that job instead.

How to choose one

Because you are trusting the provider with your traffic, choose carefully:

  1. Reputation and transparency. Favor providers with a clear privacy policy and independent audits.
  2. Logging policy and jurisdiction. Understand what they record and which country’s laws apply.
  3. Business model. Be wary of free VPNs – if you are not paying, your data may be the product.
  4. Your actual need. The EFF’s “Choosing the VPN That’s Right for You” guide walks through matching a service to your threat model.

It also helps to think about what problem you are actually solving. If you just want privacy from others on a coffee-shop network, most reputable paid VPNs will do. If you are trying to evade a government or protect sources, the stakes – and the scrutiny you should apply to a provider’s location, laws and logging – are far higher. Matching the tool to the real risk beats picking whichever service has the loudest ads.

The bottom line

A VPN is a useful, specific privacy tool: it encrypts your connection and hides your browsing from your network and ISP. It is not an invisibility cloak and not a security suite. Pair it with strong account protection – see our explainers on two-factor authentication and passkeys – for a far stronger everyday setup than any single tool alone.