What Is a VPN? How It Works, What It Hides and When You Need One

Maybe your phone warned you that the café Wi-Fi was unsecured, or a coworker mentioned turning one on at the airport. Either way, it’s a fair question: what is a VPN, and does it actually do what the ads say?

A VPN, or virtual private network, is a service that sends your internet traffic through an encrypted tunnel to a server run by the VPN provider, which then passes it on to the rest of the internet. Because of that tunnel, your Wi-Fi owner and your internet service provider (ISP) can’t read your traffic, and the websites you visit see the VPN server’s IP address instead of yours.

Below, you’ll follow a web request with and without a VPN, see exactly what a VPN hides and from whom, and learn what it can’t do and how to pick one you can trust.

VPN meaning: where the name comes from

VPN stands for virtual private network. The technology was built for businesses, letting traveling employees and branch offices reach a company’s internal network over the public internet instead of costly dedicated lines. It’s “virtual” because the private link is created in software on top of shared infrastructure, and “private” because encryption keeps outsiders from reading what passes through it.

Consumer VPN services, the kind you install on a phone or laptop, use the same technology for a different goal: they connect you to the provider’s server, which forwards your traffic to the open internet. A VPN your employer gives you for remote work is the original kind; its main job is reaching internal systems, and your employer can typically see the traffic that passes through it.

How does a VPN work?

The easiest way to see what a VPN changes is to follow one request, like opening a news site, without a VPN and then with one.

Without a VPN

1. Your device asks a DNS server, the internet’s address book, to translate the site’s name into an IP address, the numeric address computers use to find each other. By default, that lookup often goes to your ISP, unencrypted.
2. Your request travels from your device to the Wi-Fi router, then on to your ISP.
3. Your ISP routes it across the internet to the website’s server.
4. The website sees your public IP address, which points to your ISP and your approximate location, and sends the page back along the same path.

Along the way, whoever runs the Wi-Fi network and your ISP can see which sites you connect to and when. If the site uses HTTPS, the encrypted version of web browsing that most sites now use, they can’t read the page itself, but the destination is still visible.

With a VPN

1. The VPN app on your device encrypts the request, including the DNS lookup if the VPN handles DNS for you, as most VPN apps do.
2. The encrypted data passes through the Wi-Fi router and your ISP like any other traffic, but it’s addressed to the VPN server and its contents are scrambled.
3. The VPN server decrypts the request and sends it to the website from the server’s own IP address.
4. The website replies to the VPN server, which encrypts the response and sends it back to you through the tunnel.
5. The VPN app decrypts the response and your browser shows the page, usually with only a small added delay.

What does a VPN do? Its three core jobs

Every VPN does three things: it encrypts your data, tunnels it to a server and masks your IP address. Here’s the whole VPN explained with an everyday analogy.

Imagine you want to mail a letter without the mail carrier or your building’s mailroom learning where it’s going, and without the recipient learning where you live. You lock the letter in a pouch that only a trusted forwarding office can open, put the pouch in an envelope addressed to that office and drop it in the mail. The office unlocks the pouch, sends your letter on with its own return address and forwards any reply back to you the same way.

Encryption: the locked pouch

Encryption scrambles data so that only someone with the right key can read it. When you connect, the VPN app and server agree on keys in a quick exchange called a handshake, and from then on everything between them is unreadable to anyone in the middle. Our guide to how encryption keeps your data safe explains the idea in plain English.

Tunneling: the outer envelope

Your data travels in small chunks called packets, each labeled with where it’s going. A VPN wraps each packet, real destination and all, inside a new encrypted packet addressed only to the VPN server. Anyone watching the network sees a stream of scrambled data heading to one place, which is why this wrapping is called a tunnel.

IP masking: the forwarding office’s return address

Your IP address reveals your ISP and your approximate location. When the VPN server unwraps your packets and sends them on, it uses its own IP address, so websites see the server’s address and location rather than yours. Replies return to the server, which passes them back to you through the tunnel.

The analogy has one more lesson. The forwarding office knows your home address and sees where every letter is going, though it can’t read letters you sealed in their own envelope, which is what HTTPS does. A VPN provider sits in that same position of trust.

What a VPN hides, and from whom

A VPN doesn’t make your traffic invisible; it changes who can see what.

The first three rows are where a VPN earns its keep: the networks you use learn almost nothing about your browsing, and websites never see your real IP address. For more on the ISP side, see what your internet provider can see.

The last two rows are the honest part. Your VPN provider moves into the position your ISP used to hold, and what it records depends on its policies. Signing into an account identifies you no matter which IP address you connect from.

What a VPN can’t do

VPN marketing sometimes blurs these lines, so here’s what sits outside a VPN’s reach:

• It won’t make you anonymous. Your VPN provider knows your real IP address, and websites have plenty of other ways to recognize you.
• It won’t stop cookies. These small files in your browser identify you to sites and ad networks whatever IP address you use. Clearing them and blocking third-party cookies helps; a VPN doesn’t.
• It won’t defeat browser fingerprinting. Sites can combine details like your screen size, fonts, time zone and browser version into a profile that’s often unique to you.
• It won’t stop phishing. A fake login page works just as well over a VPN, so check web addresses and turn on two-factor authentication, a second sign-in step such as a code from an app.
• It won’t remove or block malware. System updates and reputable security software protect your device.
• It won’t hide activity inside your accounts. Your email provider, social networks and online stores still see what you do while signed in.
• It won’t get past monitoring software. On a work or school device, management tools can see your activity before it’s encrypted.

What is a VPN used for?

Most people use a VPN for a few everyday reasons.

Public Wi-Fi

Café, airport and hotel networks are run by people you don’t know and shared with strangers. A VPN hides which sites you visit from the network, protects apps that are less careful than your browser and makes “evil twin” hotspots, fakes set up to imitate a real network’s name, far less useful to an attacker. Our guide to the real risks of public Wi-Fi goes deeper.

Travel

On a trip you lean on hotel, airport and conference networks, and a VPN protects you on all of them. Some services at home, such as banks, may flag sign-ins from abroad, which a VPN location back home can sometimes help with. VPN rules vary by country, so check local law before you go.

Privacy from your ISP

At home, your ISP can see every site you connect to, and the rules on how it may use that data vary by country. With a VPN on, it sees only a connection to the VPN server and how much data you use.

Shared networks

Dorms, apartment buildings, coworking spaces and office guest Wi-Fi all have someone else in charge of the router. A VPN keeps your browsing between you and the sites you use.

Not sure any of these apply to you? Our honest take on whether you really need a VPN covers seven situations where it helps and four where it doesn’t.

VPN protocols in brief

A VPN protocol is the set of rules your app and the server use to build the tunnel, agree on keys and move your data. You’ll mostly see three:

• WireGuard is the newest. Created by Jason A. Donenfeld and merged into the Linux kernel in version 5.6 in 2020, it uses a small set of modern cryptography (Curve25519, ChaCha20-Poly1305 and BLAKE2s) and runs over UDP, a lightweight way of sending data. It’s known for speed and quick reconnections when you switch networks, and its small code base is easier to review.
• OpenVPN has been around since 2001. It’s open source, uses TLS (the same technology that secures HTTPS) to set up connections, can run over UDP or TCP and works on almost every platform. It’s flexible and proven, though usually slower than WireGuard.
• IKEv2/IPsec is built into many operating systems and handles switching between Wi-Fi and mobile data smoothly, which makes it common on phones and in workplace setups.

Older protocols such as PPTP have known security weaknesses and are best avoided. For a deeper comparison of the two most popular options, read WireGuard vs OpenVPN, or visit the official WireGuard site for the technical details.

How to choose a VPN you can trust

Because your VPN provider sees what your ISP used to see, trust is the feature that matters most. Look for:

1. Transparency. You should be able to find out who runs the service and read a plain-language privacy policy that says what data is collected, why and for how long. Independent security audits are a plus where they exist.
2. A modern protocol. WireGuard, OpenVPN or IKEv2/IPsec. Steer clear of services that still rely on PPTP.
3. Apps for the devices you use. Native apps for your phone and computer, with sensible defaults. A VPN that’s fiddly to turn on is one you’ll stop using.
4. Honest marketing. Be skeptical of promises of total anonymity or “unhackable” protection. A trustworthy provider tells you what its product can’t do.
5. A clear answer on funding. Paid VPNs run on subscriptions, while free ones need another way to cover their servers. If you can’t tell how a free VPN pays for itself, be cautious: some make money from the very data you’re trying to protect. Our guide to whether free VPNs are safe explains what to check.

Where OqusFreeVPN fits

Here’s our own app, described plainly. It’s 100% free, with no subscriptions, paid tiers, trials or credit card, and there are no ads in the app. You don’t need an account to use it. It’s built on WireGuard, connects with one tap and picks sensible defaults, so there’s nothing to configure.

It does the core job this guide describes: your traffic goes through an encrypted tunnel to the VPN server, websites see a VPN location’s IP address instead of yours, and you get added protection on public Wi-Fi and other shared networks. It won’t make you anonymous, and we won’t claim otherwise.

Apps for Windows, macOS, Android, iOS and Linux are rolling out in Early Access, free on every platform, and we explain why it’s free on our site.

The bottom line

A VPN is a simple idea with a specific job: it encrypts your traffic, tunnels it to a server and swaps your IP address for the server’s. That keeps your browsing private from the network you’re on and from your ISP, and it stops websites from seeing your real IP address.

It isn’t an invisibility cloak. Cookies, fingerprinting, logins, phishing and malware all need their own defenses, and your VPN provider deserves the same scrutiny you’d give any company that handles your data. If you’d like a free, ad-free place to start, OqusFreeVPN is rolling out in Early Access, and you can follow along on the download page.