A VPN creates an encrypted connection between your device and a VPN server. It can hide your destination traffic from the local network and change the IP address websites see. It does not make you anonymous or protect you from every online threat.
Start with the journey your data takes
When you open a website, your device sends traffic through a Wi-Fi router or mobile network, your internet provider, and other networks to the destination. A VPN app adds a tunnel over part of that journey: from your device to a server operated by the VPN company. The server forwards your traffic onward.
This matters because different parties see different parts of the connection. The local network can usually see that you are communicating with a VPN server, but not the destinations carried inside a correctly configured tunnel. A website usually sees the VPN server’s public IP address instead of your home connection’s address. Your VPN provider becomes a party you need to trust.
A VPN and HTTPS do different jobs
HTTPS encrypts the connection between an app or browser and the website it talks to. A VPN can carry that already encrypted connection inside another encrypted tunnel. You should keep using HTTPS even when the VPN is on. An encrypted tunnel to a VPN server does not magically add website-level encryption to a plain HTTP page.
Consider checking your bank account on hotel Wi-Fi. HTTPS protects the content exchanged with the bank. A VPN can reduce how much the hotel network learns about your destinations. Neither protects you if you enter your password into a convincing fake banking site. The domain name, account security, and device still matter.
What each party can still learn
| Party | With a correctly configured VPN | What does not disappear |
|---|---|---|
| Local network or ISP | Usually sees the VPN connection rather than each tunneled destination | Timing, volume, and the fact that a VPN is in use |
| VPN operator | Handles the connection between your device and the wider internet | Potential network metadata; its logging policy and implementation matter |
| Website | Normally sees the VPN exit IP address | Your login, cookies, browser fingerprint, and information you submit |
| Device administrator | Depends on device controls and monitoring | A VPN does not undo management software or local activity records |
Choose a VPN for a specific reason
Start with the problem, then select a service. For a laptop that regularly joins shared networks, reliable automatic connection and clear disconnect behaviour may matter more than a huge country list. For a household, device support and the total renewal price may matter more than a headline introductory rate.
If your goal is to avoid advertising profiles, also review cookies, browser settings, and the accounts you sign in to. If your goal is safer downloads, use a maintained operating system and suitable malware protection. Paying for a VPN while leaving your main email account without strong authentication is an uneven security trade.
Read our VPN shortlist for a framework that compares use cases rather than treating one product as a universal winner.
The settings worth checking
- Install the app from the provider’s official site or a verified app-store listing. Confirm the publisher before signing in.
- Choose a nearby server first. Extra distance can add latency; the geographically closest server is not always the least congested.
- Look for a kill switch or an operating-system option that blocks traffic if the VPN disconnects. Read what happens during startup, sleep, and network changes.
- Check split tunneling. An excluded browser or app may use your normal connection even while the VPN reports that it is connected.
- Verify the public IP address changes, then check for unexpected DNS exposure using a reputable test. A successful check is a useful snapshot, not proof against every leak.
- Save your purchase and renewal details. Deleting an app is usually different from cancelling its subscription.
A practical before-and-after check
On a connection you control, note your public IP address without the VPN, connect, and check again. Then open your usual email, video call, and banking services. If something breaks, change one setting at a time and record what changed. Do not permanently disable security controls just to make a speed test look better.
Try a Wi-Fi-to-mobile transition on your phone and a sleep-and-wake cycle on your laptop. A service that behaves predictably during those ordinary moments is more useful than an impressive result in a single speed screenshot. Do not perform experiments on a work device without your organisation’s approval.
Watch: three layers of protection
Read the video transcript
A VPN adds an encrypted tunnel between your device and a VPN server. It does not make every website trustworthy. Antivirus helps detect malicious software on supported devices. It cannot replace updates and backups. An ad blocker filters matching browser requests. It cannot stop every ad or protect every app. Use the right layer for the risk, keep software updated, and protect your accounts.
Original WebDefenseLab animation · 32 seconds · silent, with English captions.
Questions, answered
Can a VPN stop malware?
The tunnel itself does not scan your device. Some subscriptions include separate filtering or security tools, but their coverage and operating-system support must be checked individually.
Does a VPN hide me from a website I am logged into?
No. Your account identifies you to that service. Changing an IP address does not erase account activity or existing cookies.
Should the VPN be on all the time?
That depends on your goal and device. Automatic protection on shared networks may be useful, but some local services and managed networks need a different configuration. Test your actual workflow.
Sources & further reading
Source review: September 25, 2026. Product features and subscriptions can change; confirm the exact plan before purchase.
About the author
Clara WeissVPNs, passwords & digital privacyClara’s coverage focuses on VPN privacy, transparent product documentation, password-manager recovery, and the practical limits of encrypted connections. Start with the VPN explainers for help turning a feature list into a useful decision.
View profile and articles
