A VPN does exactly two things: it encrypts the traffic between your device and the VPN provider's server, and it swaps your visible IP address for the server's. That protects you from anyone watching the network path in between — the coffee-shop Wi-Fi operator, your ISP, a workplace network — and it hides your real IP from the sites you visit.
That's the whole product. A VPN does not stop malware, block phishing, secure your accounts, delete tracking cookies, or make you anonymous. If those are the threats you actually worry about — and for most people they should be — a VPN is the wrong tool, and ads promising "total protection" are selling a category error.
Key takeaways
- A VPN encrypts traffic between you and the VPN server and masks your IP address. Nothing more.
- It genuinely helps on networks you don't control and against ISP-level logging of your browsing metadata.
- It does nothing against malware, phishing, weak passwords, cookies, or browser fingerprinting.
- Services you log into still know exactly who you are, VPN or not.
- A VPN shifts trust from your ISP to the VPN provider — so the provider's policies matter more than its feature list.
What a VPN actually does
When you connect, your device builds an encrypted tunnel to a server run by the VPN provider. Everything you send travels through that tunnel first, then exits to the open internet from the provider's server.
Two consequences follow. First, anyone sitting between your device and that server — the Wi-Fi network, your ISP, whoever runs the router — sees only encrypted traffic headed to a single destination. Second, websites see the VPN server's IP address instead of yours, which hides your approximate location and your home network's identity.
Note the boundary: the tunnel ends at the VPN server. From there, your traffic continues to its destination the same way it always would. The VPN moved your exposure. It didn't remove it.
What a VPN genuinely protects
Untrusted networks. On hotel, airport, or café Wi-Fi, a VPN stops the network operator — or anyone else on it — from seeing which sites you visit. Worth knowing: HTTPS already encrypts the content of nearly all modern web traffic. What the VPN adds is hiding the metadata — the domains you connect to and your DNS lookups.
ISP visibility. Without a VPN, your ISP can log which domains you visit, when, and how often. Depending on where you live, that data may be retained or shared. A VPN reduces the ISP's view to "encrypted traffic to one server."
IP-based identification. Your IP address reveals your rough location and links your activity across sites at the network level. Masking it removes one persistent identifier — a real but modest privacy gain.
Network-level blocking. If a network or region blocks certain sites at the connection level, tunneling to an outside server can route around the block. Whether doing so is permitted depends on local law and the network's own rules — that's a judgment call only you can make.
What a VPN will never protect
Malware and ransomware. A VPN encrypts traffic in transit. A malicious file you download arrives through the tunnel perfectly encrypted — and exactly as malicious. Stopping it takes careful download habits, OS-level protections, and installer checks like the ones in our review methodology.
Phishing. A fake login page loads over a VPN just like any other page. What actually blunts phishing is a healthy dose of skepticism plus a password manager, because a good password manager only offers your credentials on the exact domain they belong to — a fake domain gets nothing.
Account security. Reused passwords and missing two-factor authentication are how most accounts fall. A VPN has no opinion on either. Unique passwords in a manager like Bitwarden plus 2FA close this gap; a VPN cannot.
Cookies and browser fingerprinting. Sites and ad networks track you through cookies and through your browser's fingerprint — neither of which involves your IP address. Switch servers all day; the tracking follows your browser, not your connection. A hardened private browser does far more here than any VPN.
Anything you log into. Sign in to your email or social accounts and those services know precisely who you are, whatever your IP says. A VPN hides your address, not your identity.
The scorecard
| Threat | Does a VPN help? | What actually helps |
|---|---|---|
| Snooping on public Wi-Fi | Yes | VPN, on top of HTTPS |
| ISP logging your browsing | Yes | VPN |
| Hiding your IP and rough location | Yes | VPN |
| Malware and ransomware | No | Careful downloads, OS protections |
| Phishing | No | Domain-matching password manager, skepticism |
| Hacked accounts | No | Unique passwords + two-factor authentication |
| Cookie and fingerprint tracking | No | Privacy-focused browser and settings |
| Full anonymity | No | No single tool provides it |
The trust shift nobody advertises
A VPN doesn't eliminate the party that can observe your traffic metadata — it replaces your ISP with the VPN provider. Everything your ISP could see, the provider now can. That makes choosing a provider the entire game: jurisdiction, logging policy, whether those policies have been independently audited, and how the business earns its money.
The pricing model is a useful signal. Reputable providers charge a subscription, and a few offer a limited free tier as an on-ramp. If a VPN is entirely free with no paid product behind it, ask yourself what funds the servers. Check the official site for current pricing and policy details before committing.
Two providers we've verified approach the same problem differently — see our breakdown of Mullvad vs Proton VPN. Mullvad is built around collecting as little account information as possible, while Proton VPN pairs its VPN with a wider privacy ecosystem and offers a free tier.
So do you actually need one?
Get a VPN if you regularly work on networks you don't control, you don't want your ISP building a browsing profile, or you need your traffic to exit from a different location.
Deprioritize it if your real worries are hacked accounts, viruses, or ad tracking. Your money and attention go further with a password manager, two-factor authentication, and a hardened browser — our privacy essentials list puts those foundations ahead of any VPN for a reason.
A VPN is a good, narrow tool: it protects the path between you and the internet, and nothing above that layer. Buy it for what it does, not for what the ads imply. Features and pricing change — always check the official site before deciding.
Frequently asked questions
Does a VPN make me anonymous online?
No — a VPN hides your IP address from websites and your browsing metadata from your network, which is one identifier among many rather than a cloak. Cookies, browser fingerprinting, and any account you log into identify you regardless of which server you connect through. Treat a VPN as a privacy improvement, not invisibility.
Do I still need a VPN if websites already use HTTPS?
Only for a narrower reason than the ads suggest: HTTPS already encrypts the content of your traffic, so passwords and messages are protected even on public Wi-Fi. What HTTPS does not hide is which sites you connect to, along with your DNS lookups. A VPN covers that metadata layer — genuinely useful on networks you don't control, but a smaller upgrade than the marketing implies.
Are free VPNs safe to use?
Be cautious with any VPN that is entirely free and has no paid product behind it, because running servers costs real money and that cost gets funded somehow — sometimes in ways that work against the privacy you were seeking. A limited free tier offered by a reputable subscription provider is a different and safer arrangement than a mystery app that charges nothing at all. The provider's jurisdiction, logging policy and independent audits matter more than its feature list.
Does a VPN protect me from viruses and phishing?
No. A VPN encrypts traffic in transit, so a malicious download or a fake login page reaches you through the tunnel exactly as dangerous as it was. Careful download habits and OS-level protections handle malware, while a password manager that only fills credentials on the exact matching domain is what actually blunts phishing.