Key Takeaways
- A VPN encrypts traffic between your device and a VPN server, hiding it from your internet provider.
- VPNs do not make you anonymous online; websites and services can still identify you through other means.
- Malware, phishing, and weak passwords are threats a VPN cannot defend against.
- Public Wi-Fi is a legitimate use case where a VPN provides meaningful protection.
- Your VPN provider can see your traffic, so choosing a trustworthy one matters significantly.
How a VPN actually works
A VPN, or virtual private network, creates an encrypted tunnel between your device and a server operated by the VPN provider. When you use one, your internet traffic travels through that tunnel before reaching its destination. To your internet service provider (ISP), the traffic looks like a single connection to the VPN server, not a series of visits to individual websites.
This has two practical effects. First, your ISP cannot read the contents of your traffic or see which sites you visit. Second, the websites you visit see the VPN server's IP address rather than your own. That is the full scope of what the technology does at its core. Everything else follows from those two facts, including both the genuine benefits and the genuine limits. For a broader look at how online privacy concepts connect, see this plain-language starting point on internet privacy.
Common myths and what the evidence actually shows
VPNs are surrounded by marketing claims that stretch well beyond what the technology can deliver. The myth-and-fact pairs below address the most widespread ones.
Myth
A VPN makes me completely anonymous online.
Fact
A VPN hides your IP address and encrypts your traffic, but websites can still identify you through cookies, login sessions, and browser fingerprinting.
Anonymity requires that no party can connect your online activity to your identity. A VPN removes your IP address from that picture, but it leaves several other identifiers intact. If you are logged into Google, Facebook, or any other account, those platforms know exactly who you are. Cookies stored in your browser link sessions across sites. Browser fingerprinting assembles a profile from dozens of technical details about your device and software that are unrelated to your IP. A VPN addresses one signal out of many.
Myth
A VPN keeps me safe from hackers.
Fact
A VPN encrypts data in transit, which helps on untrusted networks, but it provides no protection against malware, phishing, or compromised accounts.
The word 'hacker' covers a broad range of threats, most of which do not involve intercepting network traffic. Phishing emails, malicious downloads, weak passwords, and data breaches at the services you use are far more common attack vectors. A VPN does nothing to address any of them. Its protection is specific: it secures the path between your device and the VPN server. Threats that originate at your device, or at a server you have already connected to, are outside that scope entirely.
Myth
A VPN protects everything on my device.
Fact
A VPN only covers traffic routed through it. Apps that bypass the VPN, DNS leaks, and activity that happens before the VPN connects are all unprotected.
Most VPN apps route all traffic through the tunnel by default, but exceptions exist. Some apps use their own network paths and bypass the VPN entirely. A DNS leak, where your device sends domain name queries outside the encrypted tunnel, can reveal your browsing to your ISP even when the VPN is active. If the VPN connection drops and the app lacks a kill switch (a feature that blocks all traffic when the VPN is offline), your real IP address becomes visible until the connection restores. These are real technical gaps, not theoretical ones.
Myth
All VPNs are equally trustworthy.
Fact
VPN providers vary enormously in their logging practices, jurisdiction, ownership, and security track record.
Using a VPN moves your traffic away from your ISP and toward your VPN provider. That trade is only worthwhile if the provider is more trustworthy than the ISP. Some providers keep detailed connection logs that can be subpoenaed or sold. Others have been audited by independent security researchers and maintain verifiable no-log policies. Jurisdiction matters because providers in countries with mandatory data retention laws may be legally required to store information regardless of their stated policy. Ownership structure also matters; some VPN apps have been acquired by data-brokerage companies whose business model depends on collecting user information.
Myth
Using HTTPS already makes a VPN redundant.
Fact
HTTPS encrypts the content of each connection, but your ISP can still see which domains you visit and when. A VPN hides that metadata.
HTTPS encrypts the data exchanged between your browser and a website, which is important protection. However, the domain name you connect to is visible to your ISP even on an HTTPS connection, because the initial handshake that establishes the connection reveals the destination. A VPN wraps that handshake inside the encrypted tunnel, so your ISP sees only traffic going to the VPN server, not the individual sites you visit. The two tools address different parts of the same problem and work well together rather than being alternatives.
Where a VPN genuinely helps
Public Wi-Fi networks, such as those in coffee shops, airports, and hotels, are the strongest legitimate use case. On an unencrypted public network, other users on the same network can potentially intercept unencrypted traffic. A VPN removes that exposure by encrypting everything before it leaves your device.
A VPN also prevents your ISP from building a detailed log of your browsing activity. In the United States, ISPs are permitted to collect and sell certain anonymized usage data. A VPN limits what they can observe. It also masks your IP address from the websites you visit, which reduces one method those sites use to track you across sessions. That said, IP masking is only one layer of identity, as the myth-and-fact section below explains. The relationship between encryption and site identity is covered in more depth in the article on HTTP vs HTTPS and what the padlock means.
What a VPN cannot do
A VPN does not protect you from malware or phishing. If you click a malicious link and download harmful software, the VPN tunnel provides no defense because the threat is already inside your device. Antivirus software, cautious link habits, and strong passwords address those risks; a VPN does not.
A VPN also does not stop websites from tracking you through cookies, browser fingerprinting, or login sessions. When you sign into a service, that service knows who you are regardless of which IP address your traffic arrives from. Browser fingerprinting, where a site identifies your device by combining details like your screen resolution, installed fonts, and browser version, works independently of your IP address entirely. For a related comparison, the article on what incognito mode actually does covers similar limits around the assumption of anonymity.
Finally, using a VPN shifts trust rather than eliminating it. Your ISP can no longer see your traffic, but your VPN provider now can. A provider that keeps detailed logs, operates in a jurisdiction with broad data retention laws, or has poor security practices can expose your data just as readily as any other intermediary. The provider's logging policy and jurisdiction are the most consequential things to understand before choosing one.