What is a VPN, and how does it work? A plain English guide to tunnels, encryption and protocols

A VPN, short for virtual private network, is a service that creates an encrypted tunnel between your device and a server run by the VPN provider. Everything you do online travels through that tunnel first, so your internet provider, the owner of the WiFi you are on and anyone snooping on that network see only scrambled data heading to one server. The websites you visit see the VPN server's IP address instead of yours.

That is the short answer. The longer answer is more useful, because knowing how a VPN works tells you exactly what it protects, what it does not, and why some VPNs are fast and private while others are slow or leaky. This guide explains the tunnel, the encryption, the protocols, the real benefits, the honest limits and how to pick a good service.

What is a VPN in simple terms?

Think of the internet as a public road system. Without a VPN, your data drives around in a car with your home address painted on the side. Your internet provider runs the toll booths and logs every destination, and anyone standing at the side of the road on public WiFi can read the address too.

A VPN puts that car inside a sealed, unmarked truck. The truck drives to a depot (the VPN server), where the car is unloaded and continues to its destination. Observers on the road only see a truck going to the depot. The destination only sees a car arriving from the depot. Nobody along the way sees both where you started and where you ended up, except the VPN provider itself, which is why trusting your provider matters so much.

VPNs come in two broad kinds:

• Personal (consumer) VPNs such as NordVPN, Proton VPN and Surfshark, which protect your privacy and let you choose a server location.
• Business (remote access) VPNs, which let employees reach private company networks, files and internal tools from home. These are about access, not hiding your location.

This guide focuses on personal VPNs, but the underlying technology is the same.

How does a VPN work, step by step?

When you tap Connect in a VPN app, several things happen in under a second:

1. Authentication. The app proves to the server that you are a paying customer, and the server proves it is genuinely the provider's server, using digital certificates or public keys.
2. The handshake. Your device and the server use asymmetric cryptography (a public and private key pair) to agree on a shared secret key without ever sending that key across the internet.
3. The tunnel opens. The app creates a virtual network adapter on your device and tells the operating system to send all traffic through it.
4. Encryption and encapsulation. Each data packet is encrypted with the shared key using fast symmetric encryption, then wrapped inside a new outer packet addressed only to the VPN server.
5. Forwarding. The VPN server unwraps and decrypts the packet, swaps your IP address for its own, and sends the request to the website.
6. The return trip. Replies come back to the VPN server, which encrypts them and sends them down the tunnel to your device, where the app decrypts them.

Two ideas sit at the heart of this: tunneling (wrapping one packet inside another so the real destination is hidden) and encryption (scrambling the contents so they are unreadable without the key). A VPN that does both well gives you a private lane on a public network.

What changes when you connect

The table below shows who can see what with and without a VPN, assuming the website itself uses HTTPS, as almost all sites now do.

The last two rows are the ones people forget. A VPN moves trust from your internet provider to your VPN provider, and it does nothing about what Google, Meta or your bank learn when you sign in.

VPN encryption explained

Modern VPNs rely on two well studied ciphers for the actual data:

• AES-256-GCM, the Advanced Encryption Standard with a 256 bit key. It is used by governments and banks, and most modern processors have built in hardware acceleration for it.
• ChaCha20-Poly1305, a newer cipher that is very fast in software, which makes it ideal for phones, TV sticks and older devices without AES hardware.

Both are authenticated encryption: they hide the data and also detect if anyone has tampered with it in transit. Neither has a practical known attack. A brute force attack on a 256 bit key would take longer than the age of the universe with any computer that exists today.

The weaker link is usually the key exchange during the handshake. Classical key exchange could one day be broken by a large quantum computer, which has led to a "harvest now, decrypt later" concern: someone records encrypted traffic today and decrypts it years from now. In August 2024, the US National Institute of Standards and Technology (NIST) published ML-KEM as a standard for post quantum key exchange. Several major providers, including NordVPN and ExpressVPN, now combine classical and post quantum key exchange in a hybrid design, so the session stays safe even if one layer is ever broken.

A good VPN also uses perfect forward secrecy, which means fresh session keys are generated regularly. If one key were ever stolen, it would unlock only a small slice of traffic, not your whole history.

VPN protocols: WireGuard, OpenVPN, IKEv2 and more

A VPN protocol is the rulebook that defines how the handshake, encryption and tunnel work. Most apps choose one automatically, but knowing the options helps when you troubleshoot speed or blocked connections.

WireGuard deserves a special mention. Its design, documented on the official WireGuard protocol page, uses a fixed set of modern algorithms instead of letting each side negotiate. That removes a whole class of configuration mistakes and keeps the code small enough for security researchers to review thoroughly. It is the main reason VPNs got dramatically faster over the past few years.

If your VPN connects at home but fails at school, work or in a hotel, switching to OpenVPN TCP or an obfuscated server often fixes it, because those disguise VPN traffic as ordinary web browsing.

What does a VPN actually do for you?

Here are the real, practical benefits, without the marketing gloss.

Privacy from your internet provider

Your internet provider can normally log every domain you visit. In some countries that data can be sold to advertisers or must be retained for authorities. With a VPN, the provider sees only encrypted traffic to one server.

Safety on public WiFi

Cafe, airport and hotel networks are shared with strangers. HTTPS already protects most website content, but a VPN also hides which sites you visit, protects apps that handle encryption poorly and blocks attacks that rely on tampering with unencrypted DNS lookups. The UK National Cyber Security Centre's VPN guidance explains why organisations rely on VPNs for exactly this reason.

Hiding your IP address and location

Your IP address reveals your rough location and internet provider. Hiding it stops websites, game opponents and peer to peer contacts from seeing it, which also helps protect gamers from targeted DDoS attacks, a topic covered in our best VPN for Warzone guide.

Accessing your home content while travelling

Streaming libraries and some banking and government sites change depending on your country. Connecting to a server at home lets you use your subscriptions as usual abroad. Our guide to the best VPN for HBO Max covers which services work reliably, and the best VPN for expats guide covers living abroad long term. Always check the terms of each service, because some restrict use outside your home region.

Avoiding throttling

Some internet providers slow down specific kinds of traffic, such as video streaming or torrenting. If they cannot see what the traffic is, they cannot single it out.

What a VPN cannot do

This section matters as much as the benefits. A VPN is one privacy tool, not a full security suite.

The Electronic Frontier Foundation's guide to choosing a VPN makes the same point: a VPN shifts who can see your traffic rather than making it invisible, so choosing a provider you trust is the most important decision.

Are VPNs legal?

In most countries, including the United States, the UK, Canada, Australia and the EU, using a VPN is completely legal. Businesses depend on them every day. A few countries, such as China, Russia, Iran and the UAE, restrict VPNs or allow only government approved services, and the rules there change often. Anything that is illegal without a VPN stays illegal with one. Breaking a streaming service's terms of use is not usually a crime, but it can get your account restricted.

Do VPNs slow down your internet?

A little, yes, because your data takes a detour through another server and gets encrypted on the way. How much depends on three things:

• Distance to the server. A nearby server adds a few milliseconds; one on another continent can add over 100 ms of latency.
• The protocol. WireGuard based protocols are usually much faster than OpenVPN.
• Server load and quality. Crowded or underpowered servers slow everyone down.

On a good provider with a nearby WireGuard server, most people do not notice the difference for browsing, streaming or video calls. If you want to measure it, our guide on how to check whether your VPN is working includes a simple speed test method alongside leak tests.

Key VPN features worth knowing

• Kill switch: blocks all internet traffic if the VPN drops, so your real IP never leaks during a reconnect.
• No logs policy: a promise not to record your activity. The best providers prove it through independent audits.
• DNS leak protection: forces domain lookups through the VPN instead of your internet provider.
• Split tunneling: lets you choose which apps use the VPN and which go direct, useful for local devices or banking apps.
• Obfuscation: disguises VPN traffic so restrictive networks cannot easily block it.
• Multi hop: routes traffic through two servers for extra separation, at the cost of speed.
• Port forwarding: lets incoming connections reach you through the VPN, which matters for hosting and some torrent setups. Read what VPN port forwarding is and whether you need it for the details.
• Dedicated IP: an address only you use, which reduces CAPTCHAs and blocks on banking sites.

Free vs paid VPNs

Running a global server network is expensive, so a free VPN has to pay for itself somehow. Some do it honestly with a limited free tier funded by paying users; Proton VPN's free plan is the best known example. Others cover costs by showing ads, selling bandwidth or collecting and selling browsing data, which defeats the whole point.

If you only need occasional protection on public WiFi, a reputable free tier is fine. For streaming, gaming, torrenting or daily use, a paid plan gives you more locations, faster servers and better support, usually for a few dollars a month on a long plan.

How to choose a good VPN

Use this checklist when comparing providers:

• An independently audited no logs policy, ideally with recent audits.
• Modern protocols such as WireGuard or a WireGuard based option.
• A reliable kill switch and built in leak protection.
• Apps for every device you own, including TVs and routers if you need them.
• Servers near you and in the countries you want to appear in.
• A clear money back guarantee so you can test it risk free.
• A transparent company with a clear jurisdiction and ownership.

Our ranking of the best VPNs applies these criteria to the leading providers, and if you mainly use a desktop, the best VPN for PC guide narrows the field further.

How to start using a VPN

Setting one up takes about five minutes:

1. Choose a provider and create an account.
2. Download the official app from the provider's site or your device's app store.
3. Sign in, turn on the kill switch and leave the protocol on automatic.
4. Pick a server, or use the fastest server option, and tap Connect.
5. Run a quick IP and DNS leak test to confirm everything works.

For step by step walkthroughs with screenshots of each setting, follow our guides for installing a VPN on Windows 11, installing a VPN on macOS and installing a VPN on a Fire TV Stick.

Bottom line

A VPN encrypts your traffic and routes it through a server you choose, which hides your activity from your internet provider and local network and hides your IP address from the sites you visit. It is a strong, simple privacy upgrade, especially on public WiFi and while travelling. It is not an invisibility cloak: it will not stop cookies, account tracking, malware or weak passwords, and it only works as well as the provider behind it. Pick an audited service with modern protocols and a kill switch, test it once, and you will get real protection with almost no effort.

Frequently asked questions

What does VPN stand for?

VPN stands for virtual private network. It creates a private, encrypted connection over a public network such as the internet.

Can my internet provider see what I do with a VPN on?

No. It can see that you are connected to a VPN server and how much data you use, but not which sites you visit or what you do on them.

Does a VPN make me anonymous?

Not completely. It hides your IP address and encrypts your traffic, but websites can still identify you through logins, cookies and browser fingerprinting.

Should I leave my VPN on all the time?

For most people, yes. Leaving it on with the kill switch enabled means you are always protected. Use split tunneling for any app that does not work with it.

Do I need a VPN at home?

It is less urgent than on public WiFi, but it still hides your browsing from your internet provider and your IP from websites, which many people value.

Can a VPN be hacked?

The encryption itself is extremely strong. Real risks come from outdated protocols, unpatched apps or untrustworthy providers, so keep the app updated and choose an audited service.

Is one VPN account enough for all my devices?

Usually. Most providers allow between 5 and 10 simultaneous connections, and some offer unlimited devices on one plan.