What is a VPN and how does it work?

A VPN puts one encrypted detour between you and the internet. Instead of your phone or laptop talking to every website directly — in view of whoever runs the network you’re on — the VPN app scrambles your traffic and sends all of it to a single server, which passes it on and relays the answers back. Every service in our full VPN rankings works this way; the differences are who runs the servers, what they log, and how the tunnel is built.

What happens to your traffic, step by step?

Four things happen every time you load a page with a VPN on:

1. Encryption on your device. The VPN app scrambles your traffic before it leaves your phone or laptop. Anyone watching the local network — the café’s router, another guest, your ISP — sees an unreadable stream headed to a single address.
2. The tunnel. That encrypted stream travels across the internet to the VPN server you picked. The protected connection between your device and that server is the “tunnel”: data inside it can’t be read or tampered with in transit.
3. The handoff. The server decrypts your request and forwards it to the website using its own IP address. The site answers the server, not you — so it sees the server’s IP and location, never yours.
4. The return trip. The reply goes back to the VPN server, gets encrypted, and comes down the tunnel to your device, where the app decrypts it.

That’s the entire trick. Your traffic still crosses the same internet — it just makes one protected stop first, and the wider web sees the stop instead of you.

What is a VPN protocol?

The set of rules for building and encrypting that tunnel. WireGuard and OpenVPN are the two big open-source protocols, and providers build their own variants on top: NordVPN’s NordLynx runs on WireGuard, ExpressVPN’s Lightway is its own open-source design, and Mullvad dropped OpenVPN entirely in January 2026 to run WireGuard alone. Which protocol your app uses affects speed and compatibility more than security in day-to-day use — our WireGuard vs OpenVPN guide covers how they differ.

What does a VPN actually hide?

A VPN doesn’t erase information — it moves it. Each party in the chain sees something different once the tunnel is up:

Who can see what, with and without a VPN

Who is looking	Without a VPN	With a VPN
Wi-Fi owner and anyone on the local network	Which sites you connect to, plus anything sent unencrypted	One encrypted stream to a single server
Your ISP	Which sites and services you connect to	That you use a VPN and how much data moves — not what is inside
Websites you visit	Your real IP address and rough location	The VPN server's IP address and location
Your VPN provider	Nothing — it is not in the path	Your traffic now flows through its servers
Advertisers, cookies, and accounts you log in to	Your browsing habits, tied to you	The same — the tunnel does not touch cookies or logins

The provider row is the one most explainers skip. A VPN doesn’t remove the middleman who can watch your traffic; it swaps your ISP for a company you chose. That trade only makes sense if the company you chose logs less than your ISP would — which is why the audit section below matters more than any feature list.

What can’t a VPN do?

The marketing says “become invisible online”. The mechanics say otherwise. A VPN does nothing about:

• Your accounts. Sign in to Google or Facebook and you’ve identified yourself. The platform tracks you by your login, whatever your IP address says.
• Cookies and fingerprinting. Trackers that live in your browser travel through the tunnel untouched.
• Phishing and malware. An encrypted tunnel delivers a scam page exactly as efficiently as a real one.
• A dropped connection. If the tunnel fails, your traffic falls back to the open network until it reconnects. Catching that moment is the whole job of a kill switch — our VPN kill switch guide explains how.
• Leaks. A misconfigured setup can let DNS lookups — the requests that turn a site name into an address — travel outside the tunnel, exposing which sites you visit.

The honest summary: a VPN protects your traffic in transit and hides your IP address from the sites you visit. Anything that identifies you inside your browser or inside an account is untouched.

How do you know a VPN isn’t logging your traffic?

From the outside, you can’t — that is the honest starting point. Once your traffic exits through a provider’s servers, “no logs” is a promise. Two things turn the promise into evidence you can weigh.

Jurisdiction. Where the company is registered decides which laws it answers to. NordVPN operates from Panama, Proton VPN from Switzerland, and Private Internet Access from the United States, a member of the Five Eyes intelligence alliance — three very different legal backdrops for the same promise.

Independent audits. Outside firms are hired to check no-logs claims, but “audited” covers wildly different work. Compare what the word means at five providers:

What 'audited' actually means, per vendor announcements (as of 23 Jul 2026)

Provider	Most recent check	What it actually was
Proton VPN	Securitum, 2026	Fifth annual no-logs infrastructure audit; every report published in full
NordVPN	Deloitte, 2025	Sixth no-logs assurance engagement (ISAE 3000); full report requires a Nord Account login
ExpressVPN	KPMG, 2025	Assurance over its no-logs policy and RAM-only servers; report gated behind KPMG's terms
Mullvad	Cure53, 2024	Infrastructure security audit scoped to privacy — not a formal no-logs attestation
Windscribe	Packetlabs, 2024	Security and privacy pen test of its server stack — not a no-logs attestation

Before trusting the label, check three things: who audited, when, and whether you can actually get the report. Our guide to no-log VPN audits breaks down what each type of engagement does and doesn’t verify.

When is a VPN genuinely useful?

Where it earns its keep:

• Untrusted networks. On hotel, airport, or café Wi-Fi, encryption is applied before data leaves your device, so the network owner or a snooping guest gets nothing readable. Is public Wi-Fi safe without a VPN covers the real risks.
• Keeping browsing habits from your ISP. Your provider sees one encrypted stream instead of your list of destinations.
• Changing your visible location. Sites treat you as if you were where the server is, because that is the IP address they see.
• Remote work. Corporate VPNs use the same tunnel idea to extend a company network, so employees reach internal systems securely from anywhere.

Where it doesn’t: any threat that lives inside your browser or your accounts. A VPN is transport security, not identity protection.

Frequently asked questions

Frequently asked questions

What does a VPN do to your IP address?

It masks it from the sites you visit. Your traffic exits through the VPN server, so websites see the server's IP address and location instead of yours.

Can your ISP see what you do when you use a VPN?

Your ISP can see that you are connected to a VPN and how much data you move, but the traffic itself is encrypted, so it cannot read which sites you visit or what you send.

Is a VPN the same as incognito mode?

No. Incognito mode only stops your browser from saving history and cookies on your device — your network, ISP, and the sites you visit see everything as usual. A VPN encrypts traffic and changes the IP address sites see. They solve different problems.

Does a VPN make you completely anonymous?

No. It hides your IP address from websites and encrypts traffic in transit, but logins, cookies, and browser fingerprinting still identify you, and your VPN provider can see your traffic. Treat it as privacy in transit, not anonymity.

Does a VPN slow down your internet?

It can. Traffic gets encrypted and takes a detour through the VPN server, which adds work and distance. How much you lose depends on the server's distance, its load, and the protocol — there is no universal number.

Why do people use a VPN?

The main reasons: protecting data on public or untrusted Wi-Fi, keeping browsing destinations private from the ISP, appearing in a different location, and reaching workplace systems securely from outside the office.

Does a VPN hide your location?

From websites, mostly — they see the VPN server's region instead of yours. It does not remove every location signal: apps with GPS access and accounts you are signed in to can still report where you are.