What is a VPN, and what it does not do

A VPN (virtual private network) is an app or service that sends your internet traffic through an encrypted connection, called a tunnel, to a server run by the VPN company. Websites then see the server’s address instead of yours. The Electronic Frontier Foundation (EFF) is a nonprofit that works on digital rights. It says a VPN also hides your outgoing traffic from your internet service provider (ISP) and from the owner of a local Wi-Fi network. A VPN does not make you anonymous, and it does not stop phishing or malware. It also moves your trust: the VPN company can see what your ISP used to see.

How a VPN works, in four steps

Encryption scrambles data so that only the right device can read it. Here is the process, based on the EFF’s description:

1. You turn on the VPN app. It builds an encrypted tunnel between your device and the VPN company’s server.
2. Your traffic goes through the tunnel. The ISP is the company that sells you internet. The EFF says the VPN hides your outgoing traffic from your ISP, and from the owner of a local network such as a coffee shop or hotel.
3. The server passes your request to the website. The site sees the server’s IP address. An IP address is a number that identifies your connection. The EFF says it gives a rough idea of where you are, and it can be used to identify you. With a VPN, your location appears to be wherever the server is.
4. The reply comes back the same way.

What a VPN is good for

The EFF says VPNs are best suited to one thing: routing your network connection through a different network. It names two practical uses:

• Getting around blocks on a network. A VPN can sometimes get around censorship or blocks that depend on where you are. The EFF warns that video services increasingly block devices that seem to use a VPN, so a VPN is not a guaranteed way around location limits.
• Reaching a private network from far away. A company can run a VPN so that staff can reach the office network from home or while traveling. The EFF adds that a personal VPN you run yourself can connect you to your home network.

What a VPN does not do

• It does not make you anonymous. The FTC said in 2018 that a VPN app generally is not going to make you entirely anonymous. The EFF explains why. Companies can still track you with cookies, tracking pixels or fingerprinting, which is a way of recognizing your device from its settings. When you sign in to an account, the site knows who you are.
• It does not stop phishing or malware. Phishing is a trick that gets you to type a password into a fake site. The EFF says VPN ads “vastly oversell” what a VPN can do against cybercriminals, malware and tracking. The FTC makes a related point about encryption on public Wi-Fi: it does not protect you from a scammer’s fake website, even if that site is encrypted. See AI scams and Do you need antivirus?.
• It does not hide your traffic from the VPN company. The EFF says that a VPN hides your browsing from the ISP, but the VPN provider can see it all. A provider that wanted to could sell that information. The FTC put it the same way in 2018: a VPN “just shifts trust” from those networks to the VPN app’s provider.
• It is not required on public Wi-Fi, but it can help. The FTC says (page dated February 2023) that connecting through a public Wi-Fi network is usually safe, because most websites now use encryption. Look for a lock symbol or “https” in the address bar. HTTPS is the encrypted way a browser talks to a website. The EFF agrees that a VPN is less necessary than it used to be. It adds that HTTPS protects the content of your visits, not the metadata. Metadata is information about your activity. People on the same network can still see which sites you visit and when. A VPN could hide that, the EFF says, and it may be useful on a network you do not trust.
• It does not make every VPN app safe. The FTC cited a study of nearly 300 VPN apps in 2018. Some did not encrypt data, some asked for unexpected permissions, and some shared data with third parties. The EFF adds that an app’s presence in an official app store does not prove it is safe.

VPN, proxy or Tor?

	VPN	Proxy	Tor
What it is	A service that sends your traffic through an encrypted tunnel to its server	A server that relays your traffic	A network of relays run by volunteers, which pass your traffic along
Who can see your traffic	The VPN company	The proxy company	No single relay sees both who you are and what you do, the Tor Project says
What it suits	Hiding browsing from your ISP or a local network; reaching a work network	Simple relaying, if you want no privacy protection and trust the provider, the Tor Project says	Stronger anonymity, the EFF says

A proxy is a server that relays your traffic. The Tor Project says that in the simplest setup you just point your browser at it. It also says a simple proxy provider knows who you are and what you browse, and in some cases can see inside your encrypted traffic. Tor sends your traffic through at least three servers, with a separate layer of encryption for each. The Tor Project says that a bad first server sees only that your address is using Tor, and a bad third server cannot tell who sent the traffic. The EFF says that if you want more anonymity, Tor is a better solution than a VPN.

How to decide if you need one

1. Name the problem. “I want to hide my browsing from my ISP,” “I am on a network I do not trust,” or “I need my work network” are real reasons. “I want to be safe online” is too broad for a VPN to solve.
2. Do the basics first. The EFF lists steps with more impact than a VPN: strong passwords, two-factor authentication, HTTPS-only mode, encrypted devices, software updates, and end-to-end encrypted chat apps. Our password generator and Passkeys vs passwords cover the first two.
3. If a VPN still fits, question its claims. The EFF says a claim is not a guarantee. It tells you to read the privacy policy, see whether the provider has independent audits, and ask how it earns money. A VPN can be free and still sell your data. A “no logs” promise is not proof either. The EFF also says to avoid broken encryption such as PPTP.
4. Check the app before you install it. The FTC advises you to research the app, review the permissions it asks for, confirm that it encrypts your traffic, and read the privacy policy to see whether it shares your data. This page does not recommend a provider.
5. Keep your other protections on. A VPN adds one layer. It does not replace the others.

What can go wrong

• Choosing by ad. On a provider’s marketing pages, the EFF says to watch for hyperbolic claims about privacy or security. A VPN that makes impossible claims may not be trustworthy in other areas.
• A free VPN paid for by your data. The FTC said in 2018 that free apps may earn money from ads or by sharing user data.
• A work VPN. On a company VPN, whoever runs the network sees your traffic, the EFF says. Keep personal browsing off it.
• Not everyone should use a personal VPN. CISA advises highly targeted people, such as senior officials, not to use one. It says personal VPNs shift risk from the ISP to the VPN provider, and that many free and paid providers have questionable security and privacy policies. That advice is for a narrow group, and CISA notes that a VPN required by an employer is a different case.

What to do now

1. Turn on two-factor authentication or a passkey for your email account first.
2. On public Wi-Fi, check for the lock symbol or “https,” and keep your phone and apps updated.
3. If you want a VPN, write down the reason, then read the provider’s privacy policy for what it logs and how it earns money.
4. Do not count on a VPN to stop scams. Do not click links in unexpected messages, even when a VPN is on.
5. If your employer gives you a VPN, use it for work and assume your employer can see that traffic.