VPN Basics

A virtual private network (VPN) creates an encrypted tunnel between your device and a VPN server. It can protect your traffic on public Wi-Fi and hide your location from the sites you visit. But a VPN is not a magic shield. It doesn’t stop malware, phishing or tracking by the sites you log in to, and a bad VPN can be worse than none.

• Everyone
• Remote Workers
• Travelers

What a VPN does

• Encrypts your traffic between your device and the VPN server, so someone on the same Wi-Fi network, such as at a cafe or hotel, can’t read what you send. See Public Wi-Fi.
• Hides your IP address from the websites you visit, which shows the VPN server’s address instead of yours. This hides your approximate location from sites.
• Hides your browsing from your internet provider (they see you connect to a VPN, but not which sites you visit). But the VPN company can see it instead.
• Connects you to a work network securely. Many employers use a VPN so staff can reach company systems from home.

What a VPN does not do

• It doesn’t make you anonymous. If you log in to an account, the site knows who you are. Cookies, browser fingerprinting and ads still track you. See Online Privacy.
• It doesn’t stop malware or phishing. A VPN won’t protect you from a bad download or a fake login page. See Malware & Antivirus and Phishing.
• It doesn’t secure a weak account. You still need strong passwords and two-factor authentication. See Passwords.
• It doesn’t make illegal activity legal.
• It moves trust to the VPN company. The provider can see your traffic metadata (and unencrypted traffic). Choose carefully.
• Most websites now use HTTPS, which already encrypts your connection to the site. A VPN adds a layer, but HTTPS is the main protection on public Wi-Fi.

Work VPNs and personal VPNs

• Work VPN: provided by your employer to reach company systems. Use it as instructed, and don’t share your login or turn it off to bypass controls. The employer may monitor traffic. Don’t use a work VPN for personal browsing if policy forbids it. See Remote Work Security.
• Personal (consumer) VPN: a paid service you install for your own privacy on public networks, or to protect traffic from your internet provider. It isn’t a substitute for the company VPN, and don’t run two VPNs at once unless IT says so.
• Router or home VPN: some people set up a VPN on their router or a home server to reach their home network while away. It needs careful setup and updates.

Risks of bad VPNs

• Free VPN apps are risky. If you aren’t paying, you may be the product. Some free VPNs log and sell your browsing data, inject ads, weaken your security or contain malware. Some have been found to leak data.
• Unknown providers may keep logs, sell your data or hand it over. A fake VPN app can steal your passwords.
• Browser extensions and look-alike apps in app stores can be malicious. Check the publisher, reviews and permissions. See App Permissions and Browser Extensions.
• VPN leaks: a poor VPN can leak your real IP address or DNS requests, or disconnect without warning and expose your traffic.
• Slow speeds and blocked services: many streaming and banking sites block VPN addresses.

Choosing a VPN

• Pick a reputable, paid provider with a long track record, clear ownership and a transparent business model.
• Read the privacy policy. Look for a clear no-logs policy, and an independent audit that confirms it. Beware of vague claims.
• Look for modern protocols and strong encryption (such as WireGuard or OpenVPN), a kill switch that blocks traffic if the VPN drops, and DNS leak protection.
• Check the jurisdiction and where the company is based, since laws on data retention differ.
• Download only from the official site or app store, and keep the app updated.
• Compare prices and refund policy, and ignore “lifetime” deals from unknown sellers.
• Be skeptical of reviews and rankings that are paid affiliate marketing.

Using a VPN safely

• Turn it on before you use public Wi-Fi, and use auto-connect on untrusted networks if the app has it.
• Use the kill switch and check your IP address occasionally to see that it works.
• Keep your device and apps updated, and use antivirus where appropriate.
• Stay careful with logins and links. A VPN doesn’t make a fake site safe.
• When possible, use mobile data instead of public Wi-Fi for sensitive things, such as banking.
• Protect the VPN account with a strong password and two-factor authentication.
• Follow your employer’s rules, and local laws, when traveling. Some countries restrict or ban VPNs.

VPN checklist

• I understand a VPN encrypts traffic and hides my IP, but doesn’t stop malware or phishing
• I use the company VPN only as my employer directs
• I avoid free or unknown VPN apps and downloaded from the official source
• My VPN has a clear audited no-logs policy and a kill switch
• I turn it on before joining public Wi-Fi and still use strong passwords and 2FA

Last updated: October 4, 2026