VPN advertising implies that a subscription makes you invisible, safe from hackers and able to watch anything anywhere. Reality is quieter. A VPN is handy in a few specific situations and does very little against the threats most people actually face.
In short
- A VPN encrypts your connection to the VPN server and hides your IP address from websites.
- It helps on public WiFi, against ISP snooping and for secure access to a work network.
- It doesn't stop phishing, malware or account hacks.
- You're trusting the provider with your traffic, so choose carefully.
How it works
- Your device connects to a VPN server through an encrypted tunnel.
- Your traffic goes through the tunnel.
- The server forwards the request, and the website sees the server's IP.
- The reply comes back the same way.
Your ISP and local network only see that you're connected to a VPN. The provider, though, can see where you go, unless the connection is already end-to-end encrypted with HTTPS (most are).
What it does well
| Benefit | Why |
|---|---|
| Safer on untrusted networks | On cafe, airport or hotel WiFi, traffic between you and the VPN server is encrypted. |
| Hides browsing from your ISP | It can't easily see the sites you visit, though it sees you use a VPN and how much data you move. |
| Masks your IP from sites | Reduces simple location tracking. |
| Secure access to a company network | Business VPNs let remote staff reach internal systems. |
| Gets around some blocks | Where legal. Check local laws and service terms. |
What it does not do
| Threat | Does a VPN help? |
|---|---|
| Phishing and fake sites | No. Learn to spot them: phishing guide. |
| Malware | No. Update software, use reputable security tools. |
| Weak or reused passwords | No. Use a password manager and 2FA. |
| Cookie and login tracking | No. Sites still know you when you log in. |
| Breaches at companies you use | No. |
| Targeted surveillance by powerful adversaries | Not reliably. |
Do you need one?
| Situation | Verdict |
|---|---|
| Often work on public WiFi | Useful extra layer |
| Employer provides a VPN | Use it as instructed |
| Don't want your ISP seeing your sites | Reasonable, if you trust the VPN more than the ISP |
| Mostly browse at home on HTTPS sites | Optional. Basic security habits matter more |
| Want to stop hackers | Not a VPN's job. Use 2FA, updates, strong passwords |
Choosing a trustworthy one
- A clear no-logs policy, ideally independently audited.
- A transparent company with a known owner and jurisdiction.
- Modern protocols (WireGuard, OpenVPN), strong encryption, a kill switch.
- Speed and server locations that suit you.
- Avoid free VPN traps. If you aren't paying, you may be the product.
- Be wary of review sites that earn commission from the VPNs they rank. Many "top 10" lists are affiliate marketing (see how affiliate marketing works).
Better habits than a VPN alone
- HTTPS sites, updated browser and OS.
- Multi-factor authentication, ideally passkeys.
- Unique passwords from a manager.
- Careful with links and attachments.
- Your phone hotspot instead of unknown WiFi for sensitive work.
- For businesses: access control, patching, backups. See our small business security checklist.
Legal notes
VPNs are legal in most countries but restricted in some. Using one to break laws or a streaming service's terms can have consequences. Follow local rules.
Secure remote access for a team
Businesses usually need properly configured access with MFA and monitoring instead of a consumer VPN. Our cybersecurity and cloud team can design it. Get in touch.
