A VPN promises to make you invisible online, and that promise is only half true β which is exactly where people get hurt. A virtual private network is a genuinely useful privacy tool for a specific, well-defined problem, but it is not the all-purpose invisibility cloak it's often marketed as. Understanding exactly what a VPN encrypts, what it hides, and what it leaves completely exposed is the difference between using it as an effective layer of protection and mistaking it for a shield it was never built to be.
What a VPN Actually Encrypts
At its core, a VPN creates an encrypted tunnel between your device and a server operated by the VPN provider, and everything traveling through that tunnel β web requests, app traffic, DNS lookups, all of it β is wrapped in encryption before it ever leaves your device.
This means anyone positioned between you and that VPN server, such as the operator of the Wi-Fi network you're connected to or your internet service provider, sees only an encrypted stream of data flowing to a single IP address, not the individual websites or services you're actually reaching.
The encryption itself is not the exotic part; the same cryptographic techniques secure online banking and HTTPS websites every day. What makes a VPN distinct is that it extends that encryption to cover your entire internet connection, not just the traffic to one specific site.
The Device-to-Server Tunnel, Step by Step
When you connect to a VPN, your device and the VPN server first perform a handshake, negotiating encryption keys that will be used to scramble and unscramble data for the rest of the session.
From that point on, every outgoing packet from your device is encapsulated inside an encrypted outer packet addressed to the VPN server; the server decrypts it, reads the real destination, and forwards the original request onward to the website or service you're trying to reach.
The reply follows the same path in reverse: the destination server sends its response to the VPN server, which encrypts it and relays it back through the tunnel to your device. To anyone watching the connection between your device and the VPN server, none of that inner detail is visible.
What Your ISP Can and Can't See
Without a VPN, your internet service provider can typically see the domain of every site you visit, even on encrypted HTTPS connections, because the initial connection setup reveals which server you're contacting.
With a VPN active, your ISP instead sees an encrypted connection going to a single IP address β the VPN server β and cannot see which specific websites you're visiting behind that tunnel or read the content of your traffic.
What your ISP can still observe is that you're using a VPN at all, roughly how much data you're sending and receiving, and the timing of your sessions. A VPN hides the "what" and "where" from your ISP; it doesn't hide the fact that you're online or make your connection invisible.
How a VPN Hides Your IP From Destination Sites
From the perspective of the website or app you're connecting to, the traffic appears to originate from the VPN server's IP address rather than your own, since the server is the one forwarding your request onward.
This is genuinely useful for masking your approximate location and breaking the direct link between your home or mobile IP address and your browsing activity, which matters for avoiding IP-based tracking, location-based price discrimination, and some forms of targeted rate-limiting or blocking.
It is not, however, full anonymity. A masked IP address removes one identifier among many, and plenty of other signals β covered later in this article β can still connect your activity back to you even when your real IP never appears anywhere.
Your VPN Provider Can See What Your ISP Used To
Using a VPN doesn't eliminate the possibility of being observed; it relocates the point of maximum visibility from your ISP to your VPN provider, since all of your decrypted traffic passes through that provider's servers before continuing to its destination.
A VPN provider is technically capable of logging which sites you connect to, when, for how long, and how much data was transferred, in exactly the position your ISP occupied before you started using the VPN.
This is the single most important thing to internalize about VPNs: you're not eliminating a trust relationship, you're transferring it from your internet provider β who you probably didn't choose for privacy reasons β to a company whose entire business is supposed to be earning that trust.
DNS Leaks and Why They Defeat the Purpose
Before your device can connect to any website, it needs to translate a domain name into an IP address through a DNS lookup, and if that lookup happens outside the encrypted VPN tunnel, it can quietly undo much of the privacy benefit.
A DNS leak occurs when a misconfigured VPN app or operating system setting sends DNS queries to your regular ISP-provided DNS resolver instead of routing them through the VPN, meaning your ISP can still see every domain you're looking up even while your actual traffic is encrypted.
Reputable VPN providers run their own DNS resolvers inside the encrypted tunnel specifically to prevent this, and privacy-conscious users can check their own setup using free online DNS leak test tools to confirm queries aren't escaping the tunnel.
Split Tunneling: Choosing What Goes Through the VPN
Split tunneling is a feature that lets you choose which apps or traffic route through the encrypted VPN tunnel and which connect to the internet normally, rather than forcing every byte of network activity through the VPN at once.
A common use is routing your browser through the VPN for privacy while letting a local streaming device, printer, or work application communicate directly with your home network, since VPN traffic and local-network traffic don't mix well by default.
The tradeoff is straightforward: anything excluded from the tunnel gets none of the VPN's protection, so split tunneling is a deliberate convenience choice that narrows your protected surface in exchange for flexibility, not a way to get full protection with fewer restrictions.
Public Wi-Fi Protection vs. General Surveillance Protection
The VPN's original and still most defensible use case is protecting your traffic on public or shared Wi-Fi β coffee shops, airports, hotels β where other devices on the same network, or a malicious rogue access point impersonating a legitimate one, can potentially intercept unencrypted traffic.
Because most of the web now runs over HTTPS by default, this specific risk is smaller than it was a decade ago, but it hasn't disappeared: not all traffic is encrypted end to end, and local network-level attacks remain a real concern on networks you don't control.
"Protection from general surveillance" is a much bigger and vaguer claim than "protection on public Wi-Fi," and the two shouldn't be treated as the same thing. A VPN raises the bar against casual snooping and local network attackers, but it does not defeat a determined, resourced adversary β including a compromised or coerced VPN provider itself.
What a VPN Doesn't Protect Against: Fingerprinting and Cookies
Browser fingerprinting builds a unique identifier for your device out of dozens of small technical signals β screen resolution, installed fonts, browser version, timezone, hardware details β that remain identical whether or not your IP address is hidden behind a VPN.
Cookies and other tracking technologies tied to your browser or logged-in accounts continue identifying you across sessions and sites regardless of which IP address you're connecting from, since they don't rely on your network address in the first place.
Advertising and tracking networks have increasingly shifted toward these IP-independent methods precisely because IP addresses have become less reliable identifiers, which means a VPN alone does very little to stop the kind of tracking most people associate with online ads.
What a VPN Doesn't Protect Against: Accounts, Malware, and Phishing
Logging into an account β email, social media, a shopping site β while connected to a VPN still tells that company exactly who you are, because you identified yourself directly; hiding your IP address does nothing to hide a login you performed voluntarily.
Malware, ransomware, and phishing attacks operate at the level of your device, your inbox, and your browser, not your network connection, so a VPN doesn't scan downloaded files, block malicious attachments, or stop you from typing a password into a convincing fake login page.
Treating "I'm using a VPN" as equivalent to "I'm safe online" is one of the more common and consequential misunderstandings about the tool, since it can lead people to skip other genuinely important precautions like antivirus software, phishing awareness, and software updates.
No-Logs Claims and Why They're Hard to Verify
Most privacy-focused VPN providers advertise a "no-logs policy," meaning they claim not to record which sites you visit or what you do on their network β but from outside the company, that claim is essentially a statement of trust, not something an ordinary user can independently confirm.
Even a genuinely well-intentioned no-logs policy can be narrower in practice than it sounds, since providers may still retain connection metadata, timestamps, or aggregated usage statistics for troubleshooting, capacity planning, or billing purposes without technically violating their stated policy.
Legal proceedings and security research have occasionally revealed that some providers retained more data than their marketing suggested, which is exactly why a bare no-logs claim, without any way to verify it, deserves real skepticism rather than automatic trust.
Independent Audits: A Signal, Not a Guarantee
To address the verification problem, more established VPN providers commission independent third-party security firms to review their infrastructure and assess whether their no-logs claims and security architecture hold up, then publish the resulting report.
An audit is a snapshot of a defined scope at a specific point in time, conducted according to terms the provider itself agreed to; it's a meaningful signal of seriousness, but it doesn't guarantee that practices remain unchanged afterward or that every possible flaw was caught.
A provider with a history of recurring, published audits is a stronger signal than a provider with a single audit from years ago or no audit history at all, since repetition demonstrates an ongoing commitment rather than a one-time marketing exercise.
Jurisdiction and Legal Data Requests
The country where a VPN provider is legally incorporated determines what kinds of legal demands β court orders, subpoenas, national security requests β it can be compelled to comply with, and whether it's even legally permitted to disclose that such a request was made.
International intelligence-sharing arrangements among certain groups of allied countries are frequently discussed in this context, and while the specifics of what gets shared in practice are murky, the general principle β that jurisdiction shapes legal exposure β is well established and worth factoring in.
Many privacy-focused VPN providers deliberately incorporate in jurisdictions with strong privacy protections and no mandatory data retention laws, treating legal domicile as a real design decision rather than an afterthought.
Corporate VPNs vs. Consumer Privacy VPNs
A business or corporate VPN exists for a fundamentally different purpose than a consumer privacy VPN: it gives remote employees secure access to internal company systems, file servers, and applications that shouldn't be reachable from the open internet.
Critically, the trust relationship is reversed. Your employer's IT department can typically see and log the traffic that passes through a corporate VPN, since the entire point is giving the organization visibility and control over access to its own systems.
Mixing up these two categories causes real confusion β a work VPN is not a privacy tool protecting your personal browsing from your employer, and a consumer privacy VPN is not designed to securely bridge you into a company's internal network.
VPN Protocols in Plain English
WireGuard is the newest widely adopted protocol, built around a deliberately small, auditable codebase, and it has become the default choice for many providers because it's fast and considered easier to verify as secure than older, more sprawling alternatives.
OpenVPN is older, extensively battle-tested, and highly configurable, which has made it a long-standing trusted default even though it's generally somewhat slower than WireGuard due to its more complex processing overhead.
IKEv2/IPsec is especially good at quickly re-establishing a connection when your device switches networks, such as moving from Wi-Fi to mobile data, which is why it shows up frequently as the default protocol on phones.
The Speed Tradeoff and Why It Happens
Every VPN connection introduces some amount of overhead: your data has to be encrypted, routed to an intermediate server that may be geographically distant, decrypted, forwarded, and the whole process repeated in reverse for every response.
How much that overhead actually costs you in real-world speed depends heavily on the protocol in use, the distance to the chosen server, and how much load that specific server is currently under relative to the provider's total available bandwidth.
Modern lightweight protocols like WireGuard have narrowed the speed gap considerably compared to older protocols, but a VPN will still typically add some latency and reduce throughput compared to an unprotected direct connection β a real tradeoff, not a myth to dismiss.
Mobile VPN Considerations
Mobile VPN apps rely on the operating system's own VPN APIs to route traffic, which introduces additional considerations around battery consumption and how the app behaves when it's running in the background rather than actively in the foreground.
Phones frequently switch between Wi-Fi and cellular data as you move around, and each switch can momentarily interrupt the VPN connection, briefly exposing unprotected traffic unless the app handles the transition carefully.
This is why a kill switch β a feature that blocks all internet traffic if the VPN connection drops unexpectedly β matters disproportionately more on mobile than on a stationary desktop connection, where network changes are far less frequent.
Streaming and Geo-Unblocking Is a Different Use Case
Streaming services enforce regional content licensing by checking a visitor's IP address and blocking or redirecting connections that appear to come from outside an approved region, which is a licensing-enforcement problem, not a privacy or security one.
VPN providers and streaming platforms are locked in an ongoing back-and-forth where platforms detect and block known VPN server IP ranges and providers rotate or add new ones to stay ahead, making reliable unblocking a moving target rather than a stable guarantee.
A VPN's ability to unblock streaming content says essentially nothing about the strength of its privacy protections, no-logs practices, or security architecture β some providers have marketed themselves heavily around unblocking while offering comparatively weak privacy fundamentals underneath.
Red Flags of Shady Free VPNs
Operating and maintaining a global network of VPN servers costs real, ongoing money for bandwidth, infrastructure, and staff, so a completely free VPN service needs some way to cover those costs even without charging a subscription fee.
Security researchers have repeatedly found free VPN apps engaging in practices like selling aggregated user data, injecting ads into browsing sessions, requesting excessive device permissions unrelated to VPN functionality, or in some documented cases, quietly reselling users' idle bandwidth to third parties.
Vague or hidden ownership information, no published privacy policy, no security audit history, and unusually broad app permissions are all reasonable warning signs that a free VPN's business model may not have your privacy as its actual priority.
How to Evaluate a Legitimate VPN Provider
Look for a clearly published no-logs policy backed by recurring independent audits, transparent information about company ownership and legal jurisdiction, and support for modern, well-regarded protocols like WireGuard alongside a documented kill switch feature.
A provider's track record matters as much as its marketing claims: how it responded to past security incidents, whether it publishes transparency reports about government data requests, and whether independent security researchers have found significant unresolved issues in its apps or infrastructure.
Ultimately, match the provider to your actual threat model rather than to the flashiest ad campaign. Someone mainly worried about snooping on public Wi-Fi has very different requirements than someone facing a sophisticated, resourced adversary, and a consumer VPN alone is not sufficient for the latter.
A VPN is a real privacy tool with a specific, well-defined job: encrypting your traffic between your device and its server, and hiding your IP address from the sites you visit. It does that job well when built and configured properly. What it cannot do is anonymize you against fingerprinting, protect an account you logged into voluntarily, block malware, or defend you against a truly determined and resourced adversary. Used with realistic expectations β as one layer alongside good device hygiene, phishing awareness, and a provider chosen for a demonstrated privacy track record rather than the loudest advertising β a VPN remains one of the more genuinely useful tools in an everyday privacy toolkit.
Sources
- Electronic Frontier Foundation β Digital rights organization publishing guidance on VPNs, encryption, and online surveillance.
- NIST Special Publication 800-77 β Federal guide to IPsec VPN architecture, deployment, and security considerations.
- Mozilla Foundation, *Privacy Not Included β Independent research project evaluating the privacy practices of consumer technology products, including VPN apps.
- Consumer Reports Digital Lab β Independent testing and evaluation of VPN services for privacy, security, and marketing accuracy.
FAQ
Does a VPN make me completely anonymous online?
No. A VPN hides your IP address from the sites you visit and encrypts your traffic from your ISP, but browser fingerprinting, cookies, and logged-in accounts can still identify you regardless of which IP address you're connecting from.
Can my ISP see what sites I visit when I use a VPN?
No, not the specific sites or content. Your ISP can see that you're connected to a VPN server and roughly how much data you're sending, but the encrypted tunnel hides the destination websites and the content of your traffic.
Does a VPN protect me from malware or phishing?
No. A VPN encrypts and reroutes your network traffic; it doesn't scan downloads, block malicious attachments, or stop you from entering credentials on a fake login page. Those require separate security tools and habits.
Are free VPNs safe to use?
Many are risky. Running VPN servers costs money, and free services have repeatedly been found monetizing users through data collection, ad injection, or bandwidth reselling instead of a subscription fee.
What's the difference between VPN protocols like WireGuard and OpenVPN?
They're different technical methods of building the encrypted tunnel. WireGuard is newer, faster, and has a smaller codebase; OpenVPN is older, highly configurable, and widely trusted; both are considered secure when properly implemented.
About the Author
We reference the Electronic Frontier Foundation, NIST Special Publication 800-77, the Mozilla Foundation's *Privacy Not Included project, and Consumer Reports' Digital Lab to explain the background and current understanding of this topic.
Loved This Article?
Share it on WhatsApp β Share it on WhatsApp
Get more guides in your inbox β Subscribe to our newsletter for weekly surprising stories from Egypt, Saudi Arabia, Dubai, and beyond.