What is a VPN?

A VPN — virtual private network — builds an encrypted tunnel from your device to a server run by the VPN company, and pushes all your internet traffic through it. Your network can see that the tunnel exists, how much data is moving and when — and nothing about what’s in it. The sites you visit see the VPN server’s address instead of yours.

That’s the whole mechanism. But what is a VPN is rarely the real question — the real one is what it genuinely protects you from, the threat it quietly moves rather than removes, and the short list of situations where it’s worth paying for.

What is a VPN actually hiding?

Start here, because most VPN marketing skips it: the contents of your traffic are already encrypted. North of 95% of page loads have been HTTPS since about 2020. Your bank login, your messages, and the specific pages you read are unreadable to your ISP, your employer’s network, and the guy at the next table.

What still leaks is the addressing. Three things, specifically: the DNS lookup that turns embarrassing-forum.com into an IP address, the destination IP itself, and — usually — the server name your browser announces in the clear at the start of the TLS handshake.

That last one is being fixed, slowly. Encrypted Client Hello became a standard in March 2026 and Cloudflare switches it on for everything behind it, so a growing slice of your handshakes already hide the hostname. The rest still shout it.

So the honest version is that your ISP sees a list of who you talked to and when, not what you said. Less alarming than the ads imply, and more revealing than it sounds: a timestamped list of every domain you visited is a decent map of your life.

What a VPN actually changes

The tunnel swallows all three. Your DNS queries resolve at the other end, the destination IP your ISP sees is the VPN server’s, and the handshake happens where nobody local can read it.

Then it hands the exact same view to somebody else.

That’s the part worth sitting with. A VPN doesn’t delete the metadata trail — it relocates it, from a company you’re obligated to pay for internet access to a company you chose. Whether that’s an upgrade depends on which company, and on why you’re worried.

Sometimes it’s an obvious upgrade. US ISPs are free to sell subscriber browsing data, and the 2017 fight is why: Congress killed the FCC’s broadband privacy rules by Congressional Review Act before most of them took effect, which also bars the FCC from writing substantially similar ones. That’s not a gap waiting to be closed; it’s bolted open.

Sometimes it’s a lateral move, though — a free VPN with no revenue model is a company that monetises exactly the data you installed it to protect.

The coffee shop threat is mostly retired

The founding legend of the VPN industry is the hacker on café Wi-Fi harvesting your passwords out of the air. That attack was real. It was largely killed off by the same HTTPS rollout above, plus HSTS — a header telling your browser never to speak to this site in plaintext again, though it has a first-visit hole unless the domain ships on the browser’s preload list.

The bigger nail is newer: browsers now try HTTPS first by default, Chrome for everyone from October 2026.

What’s left on hostile networks is narrower but not zero: evil twin access points impersonating the real network, captive portals that want more from you than a room number, and the handful of apps still doing something careless with certificates.

A VPN closes most of those, with one honest exception: you have to get through the captive portal before the tunnel comes up, in the clear, on the network you don’t trust. That’s the window an evil twin wants, and it reopens every time your laptop reconnects — which is what the kill switch is for, and why it’s worth turning on the day you install anything.

It’s still a much smaller gap than “public Wi-Fi will steal your identity” implies. The airport lounge is not, in 2026, where most people lose an account — the 47 minutes it takes to claw back a hijacked Instagram usually start with a reused password.

What a VPN doesn’t do

It is not anonymity. The moment you sign into an account, the service knows exactly who you are, tunnel or no tunnel — and cookies, fingerprinting and ad-network IDs follow you across a VPN without breaking stride. If you need anonymity rather than privacy, the tool is Tor, and that’s a longer conversation.

It does nothing about phishing. Encrypting your route to a fake login page delivers your credentials to the attacker in transit-encrypted comfort. The thing that actually catches those is a password manager refusing to autofill on the wrong domain, because it matches strings and doesn’t care how convincing the logo is.

It does nothing about the two ways people actually lose accounts, either — and neither of them touches your network. Reused passwords replayed from someone else’s breach are why the 2am “found in a data breach” email has never once been solved by a VPN, and why turning on 2FA beats it comfortably on both cost and effect.

When it’s genuinely worth it

Strip out the fear and there’s still a real list:

The network operator is the problem. Your employer, your landlord, your university, a government that filters — anyone positioned to log or block your traffic and with a reason to. The strongest case, and the original one.

You’re travelling somewhere with pervasive monitoring. Same logic, higher stakes, and worth researching the destination’s laws first, because in a few countries the VPN itself is the flag.

You don’t want your ISP building a profile. A defensible preference, not paranoia — see 2017, above.

You want your torrenting decoupled from your subscriber account. People are usually too polite to list this one. It’s most of the retail VPN market.

If none of those describe you, your next $60 buys more safety spent almost anywhere else — starting with a password manager and 2FA on your email.

How to tell a real one from an ad read

If you’re in one of those buckets, four things separate a serious provider from a sponsorship budget.

An independent audit, recently. “No logs” is a claim about a configuration you cannot inspect; an audit is an outside firm confirming it on the day they looked. A provider that hasn’t repeated the exercise in three years is telling you something.

WireGuard support. Roughly 4,000 lines of code — small enough that humans have actually read all of it — against OpenVPN’s several hundred thousand, and faster besides. One catch: plain WireGuard pins each client to a static internal IP, which is a logbook whether anyone wanted one or not. Serious providers wrap it in double NAT to break that link, and it’s fair to ask which you’re getting.

A business model you can see. You are paying with money or you are paying with traffic. And ignore “military-grade encryption” — a phrase with no technical content, usually standing in for AES-256, except that over WireGuard you aren’t using AES at all. You’re using ChaCha20-Poly1305, which doesn’t negotiate and doesn’t need an adjective.

Jurisdiction and ownership you can look up. An audit tells you what the servers did last November. The holding company three layers up tells you who can change that on a Tuesday, and which government can make them — both public information, and roughly nobody checks.

The mainstream paid options clear these bars, and the differences between them are smaller than their ad spend suggests. All three run RAM-only servers, all three offer WireGuard, and all three have repeated independent no-logs engagements — NordVPN is on its sixth. ExpressVPN charges more, mostly for its Lightway protocol and the longest audit paper trail.

Now apply that last test to the names I just gave you. Surfshark and NordVPN have shared a parent company since their 2022 merger, so picking one of each is not the hedge it looks like — and ExpressVPN has belonged to Kape Technologies since 2021, whose pre-VPN history is worth ten minutes of your own reading. I’d rather you check than take my word for it.

So, do you need one?

A VPN moves your metadata from your ISP to a company you picked, and closes a real but shrinking gap on networks you don’t control. A genuine product doing a genuine job — just a narrower job than the sponsorship reads suggest, and not the one most people are shopping for.

Decide which of the four buckets above you’re in. If you’re in none of them, close the tab and go spend ten minutes turning on 2FA for your email instead — that’s the upgrade the coffee shop was never going to give you.