VPN Glossary: 45 Privacy and Security Terms, Explained Simply

VPN apps and privacy guides love jargon: tunnels, handshakes, leaks, ciphers and a wall of acronyms. You shouldn’t need a networking degree to understand what’s protecting your data, so we wrote this VPN glossary to translate the terms you’ll actually run into.

Start with the big one. VPN stands for virtual private network: a service that encrypts your internet traffic and routes it through a server run by the VPN provider, so your local network and internet provider can’t read it.

Below you’ll find 45 VPN terms and privacy terms in plain English, grouped alphabetically, plus a table of the settings you’re most likely to see in a VPN app.

How to use this VPN glossary

Each term gets a short definition of one to three sentences. Where we’ve written an in-depth guide on the topic, the term links to it so you can go deeper.

A–C

AES

Advanced Encryption Standard, a widely used cipher (a method for scrambling data) that the US National Institute of Standards and Technology (NIST) standardized in 2001. It protects everything from HTTPS connections to encrypted hard drives, and “AES-256” simply means the version that uses a 256-bit key.

Bandwidth

The maximum amount of data your connection can carry per second, usually measured in megabits per second (Mbps). A VPN can’t give you more bandwidth than your internet plan provides, and a crowded VPN server can leave you with less; here’s why a VPN can slow your connection and how to fix it.

Browser fingerprinting

A tracking technique that identifies your browser by combining details it shares with websites, such as screen size, fonts, time zone, language and browser version, into a profile that’s often unique. It doesn’t rely on your IP address or cookies, so a VPN doesn’t stop it. Privacy-focused browsers and settings can reduce it, and our online privacy tips cover other ways to cut tracking.

Captive portal

The sign-in or terms page that appears when you join hotel, airport or café Wi-Fi, before the network lets you online. Most VPNs can’t connect until you’ve completed it, so accept the portal first and then switch your VPN on. For more ways to stay safe on the road, see our travel cybersecurity tips.

ChaCha20

A modern cipher that’s fast in software, usually paired with the Poly1305 authenticator (which detects tampering) as ChaCha20-Poly1305. WireGuard uses it, TLS 1.3 supports it, and it performs especially well on phones and other devices without hardware acceleration for AES.

Cookie

A small file a website stores in your browser to remember you: keeping you signed in, saving your cart or, in the case of third-party cookies, tracking you across sites. Cookies live in your browser, so a VPN doesn’t block or delete them; see how incognito mode compares with a VPN.

D–E

DNS

The Domain Name System, the internet’s address book, which translates names like example.com into the numeric IP addresses computers use. By default, these lookups often go unencrypted to your ISP’s servers, which reveals the sites you visit.

DNS leak

A problem where your DNS lookups bypass the VPN tunnel and go to your ISP or another outside server, revealing the sites you visit even though the rest of your traffic is encrypted. Learn how to test for a DNS leak and fix it.

DNS over HTTPS (DoH)

A standard published in 2018 that encrypts DNS lookups by sending them inside ordinary HTTPS traffic, so people on your network can’t read or tamper with them. Many browsers and operating systems support it, but it hides only the lookup, not the IP addresses you then connect to.

Encryption

The process of scrambling data so that only someone with the right key can turn it back into readable form. HTTPS, VPN tunnels and messaging apps all depend on it; our guide to how encryption keeps your data safe explains it in plain English.

End-to-end encryption

Encryption in which only the sender and the intended recipient can read the content, not the app maker or anyone in between. A VPN isn’t end-to-end: the VPN server removes its layer of encryption before forwarding your traffic, so anything not separately protected, for example by HTTPS, is readable there.

Evil twin hotspot

A fake Wi-Fi network set up to imitate a real one, often by copying a café’s or airport’s network name, so that people connect and send their traffic through the attacker’s equipment. A VPN keeps your traffic encrypted even on a rogue network, but it’s still worth confirming the exact network name with staff. Read more about the real risks of public Wi-Fi.

F–I

Firewall

Software or hardware that allows or blocks network connections based on a set of rules. Most operating systems and home routers include one; a firewall filters connections, while a VPN encrypts them, so the two do different jobs.

Handshake

The quick exchange at the start of a secure connection in which two devices confirm each other’s identity and agree on encryption keys. Every HTTPS connection and every VPN connection begins with one.

HTTPS

The secure version of HTTP, the protocol browsers use to load web pages, which uses TLS to encrypt the connection between your browser and a website. It protects what you send and receive, but your network and ISP can usually still see which site you’re connecting to.

IKEv2/IPsec

A VPN protocol that pairs Internet Key Exchange version 2 (which sets up the connection and its keys) with IPsec (which encrypts the data). It’s built into many operating systems and copes well with switching between Wi-Fi and mobile data, which makes it popular on phones.

IP address

The numeric address that identifies your internet connection, such as 203.0.113.42, assigned by your ISP. Websites can use it to estimate your general location and see which provider you use; a VPN swaps it for the server’s address, and there are other ways to hide your IP address too.

IPv6 leak

IPv6 is the newer, longer format of IP address. An IPv6 leak happens when a VPN only tunnels older IPv4 traffic, so connections made over IPv6 slip outside the tunnel and can expose your real address.

ISP

Your internet service provider: the company that connects your home or phone to the internet. All your traffic passes through it, so without a VPN it can typically see which sites you visit; here’s what your ISP can see.

K–N

Kill switch

A VPN app setting that blocks internet traffic if the VPN connection drops, so nothing travels outside the tunnel until it reconnects. Some versions block all traffic, while others cut off only selected apps.

Latency

The time it takes data to travel to a server and back, measured in milliseconds and often shown as “ping” in apps and speed tests. A VPN adds a detour through its server, so choosing a nearby VPN location keeps latency low.

Malware

Short for malicious software: viruses, ransomware, spyware and other programs designed to damage your device or steal your data. A VPN doesn’t detect or remove malware; system updates and reputable security software do that job.

Man-in-the-middle attack

An attack in which someone secretly places themselves between you and the service you’re using, so they can read or change your traffic. Fake hotspots are a classic setup, and HTTPS and VPNs both make this attack much harder to pull off.

No-logs policy

A VPN provider’s promise not to keep records of what you do while connected, such as the sites you visit. Providers define “logs” differently, so read the privacy policy for specifics and treat independent audits as stronger evidence than a slogan; our guide to whether free VPNs are safe covers what else to check.

O–P

Obfuscation

Techniques that disguise VPN traffic so it looks like ordinary web traffic, used on networks that try to detect and block VPNs. It changes how traffic looks, not what’s allowed, so check whether using a VPN is legal where you are.

OpenVPN

A long-established, open-source VPN protocol first released in 2001. It uses TLS to set up connections, can run over UDP or TCP and works on almost every platform; see how it stacks up in WireGuard vs OpenVPN.

Packet

A small chunk of data sent across a network, labeled with where it came from and where it’s going. Everything you do online is split into packets, and a VPN wraps each one inside an encrypted packet addressed to the VPN server.

Phishing

A scam that tricks you into handing over passwords, payment details or other information, usually through a fake email, text message or website that imitates someone you trust. A VPN can’t tell a fake login page from a real one, so check links carefully and use two-factor authentication.

Port

A numbered endpoint on a device that tells incoming data which service it’s for; HTTPS, for example, normally uses port 443. Some networks block unusual ports, which is why some VPN apps can switch to a common one.

Protocol

A set of rules that devices follow to communicate. In a VPN app, “protocol” means the method used to build the tunnel and encrypt your data, today usually WireGuard, OpenVPN or IKEv2/IPsec.

Proxy server

A server that forwards your requests to websites on your behalf, so sites see the proxy’s IP address instead of yours. Unlike a VPN, a proxy usually covers a single app or browser and often adds no encryption of its own; compare them in VPN vs proxy.

Public-key cryptography

A system built on pairs of linked keys: a public key you can share with anyone and a private key you keep secret. It lets two devices that have never met verify each other and agree on a shared secret over an open network, which is how HTTPS and VPN handshakes begin. WireGuard, for example, uses Curve25519 key pairs.

S–T

Server location

The place where the VPN server you connect to is based, and so the location websites will think you’re in. Picking a location near you usually gives the best speed, and you can browse our VPN locations to see the network as it grows.

Split tunneling

A VPN setting that lets you choose which apps or sites use the VPN and which use your regular connection, such as sending your browser through the tunnel while a local printer connects directly. Anything you exclude loses the VPN’s protection.

TLS

Transport Layer Security, the encryption protocol behind HTTPS and many other secure connections, and the successor to the older SSL. The current version, TLS 1.3, was published in 2018 with faster handshakes and outdated ciphers removed.

Tor

A free, volunteer-run network that routes your traffic through three relays and encrypts it in layers, so no single relay knows both who you are and where you’re going. It’s usually used through Tor Browser from the Tor Project; it’s designed to make tracking much harder than a VPN does, but it’s slower, and no tool guarantees anonymity.

Tunnel

The encrypted connection between your device and the VPN server. Your traffic travels inside it, so anyone watching the network sees scrambled data heading to one server rather than the sites you’re actually visiting.

Two-factor authentication (2FA)

A sign-in method that asks for a second proof of identity on top of your password, such as a code from an authenticator app, a security key or a text message. It blocks many attacks that rely on a stolen password, which a VPN can’t do, and app-based codes and security keys are safer than text messages.

U–W

UDP vs TCP

Two ways of sending packets across the internet. TCP confirms that every packet arrives and resends any that don’t, which is reliable but slower; UDP skips those checks, which makes it faster and usually the better fit for VPN tunnels, calls and games. WireGuard runs only over UDP, while OpenVPN can use either.

VPN

Short for virtual private network: a service that encrypts your internet traffic and routes it through a server run by the VPN provider, so your network and ISP can’t read it and websites see the server’s IP address instead of yours. Our full guide explains what a VPN is and how it works, and a companion piece covers whether you really need one.

VPN client

The app on your device that connects to the VPN server, handles the encryption and lets you choose a location. Most providers offer clients for Windows, macOS, Android, iOS and Linux, and our guide shows how to set up a VPN on each of them.

VPN server

The computer at the far end of your VPN tunnel. It decrypts your traffic, sends it on to the internet from its own IP address and relays the responses back to you, which is why the company running it needs to be trustworthy.

WebRTC leak

WebRTC is a browser technology for real-time features such as video calls in a web page. In some setups it can reveal your real IP address to a website even while a VPN is on, so it’s worth testing; our guide covers how to check if your VPN is working.

WireGuard

A modern VPN protocol created by Jason A. Donenfeld and merged into the Linux kernel in version 5.6 in 2020. It uses a small set of modern cryptography (Curve25519, ChaCha20-Poly1305 and BLAKE2s), runs over UDP and is known for speed and quick reconnections; learn more on the official WireGuard site or in WireGuard vs OpenVPN.

WPA2/WPA3

The security standards that protect Wi-Fi networks by encrypting traffic between your device and the router. WPA3 is the newer, stronger version, so use it on your home router if your devices support it. Neither protects your traffic beyond the router or hides it from whoever runs the network.

Terms you’ll see in VPN settings

Most VPN apps tuck a handful of these terms into their settings. Here’s what each one controls:

The bottom line

You don’t need to memorize all 45 terms. Remember three ideas: encryption scrambles your data, a tunnel carries it to a VPN server, and that server’s IP address stands in for yours. Nearly everything else is detail about how well that’s done and who you’re trusting to do it.

If you’d like to see those ideas in practice, OqusFreeVPN is a 100% free VPN built on WireGuard, with no ads and no account required. Apps for Windows, macOS, Android, iOS and Linux are rolling out in Early Access, and you can follow along on the download page.