A VPN, short for virtual private network, encrypts everything your device sends and passes it through a server operated by the VPN company. Websites then see that server’s IP address instead of yours, and your ISP sees an encrypted connection with no record of the sites you visited.
People use one on public Wi-Fi, to keep browsing away from their ISP, and to appear in another country for streaming or travel. The encryption has limits, though: signing in to an account still tells that site exactly who you are, and a VPN doesn’t scan files for malware.
What Is a VPN?
VPN stands for virtual private network, and the meaning is literal. Virtual, because the private network exists in software instead of cables. Private, because its traffic is encrypted and unreadable to the network operator or an eavesdropper. Network, because your device joins the VPN company’s network and receives an IP address there.
Two things change the moment you connect:
- Your IP address. Sites, apps, and trackers record the server’s IP address in the country you picked, instead of the one your ISP assigned.
- Your traffic. Everything between your device and that server is encrypted. An ISP, a network administrator, or a stranger on the same Wi-Fi sees only encrypted data going to one destination.
Businesses have used the same technology for decades to let staff open internal systems from outside the office. Consumer VPNs apply it to ordinary browsing.
How Does a VPN Work?
Every connection goes through three steps:
- Authentication. The app proves your account to the VPN server, and the two sides agree on the encryption keys for the session. NordVPN, ExpressVPN, and Surfshark now add post-quantum key exchange at this step, which protects recorded traffic from future quantum computers.
- Encryption. The connection is wrapped in AES-256 or ChaCha20, the same class of cipher banks and governments use. Intercepted traffic is unreadable.
- Encapsulation. Each data packet is placed inside another packet. The outer layer takes the traffic to the VPN server, which unwraps it and passes the request on. People call this encrypted, wrapped connection the VPN tunnel.
Without a VPN, websites see the IP address your ISP assigned, and your ISP sees every domain you request. HTTPS hides the content of most pages, but your ISP still sees which sites you visit and when. In the UK, ISPs can be required to keep those connection records for up to a year. In the US, ISPs are allowed to use browsing data for advertising.
DNS lookups require the same protection. A good VPN answers them on its own servers, so your ISP never receives a list of the domains you visit.
What Is a VPN Server?
A VPN server is a computer in a data center that receives your encrypted traffic and decrypts it. It then sends each request on to the website using its own IP address. Replies come back the same way. VPN companies operate thousands of them, so you can choose the country websites see: NordVPN has servers in 152 countries and Proton VPN in 149.
Some locations are virtual. The server is in a neighboring country, while its IP address is registered to the one you picked, so websites treat you as local. Several VPNs, including NordVPN and ExpressVPN, also use RAM-only servers, which means a reboot erases everything stored on them.
What Does a VPN Do?
- Hides your IP address from sites you visit. Advertisers, forums, and streaming services log the server’s IP address instead of your home one.
- Encrypts public Wi-Fi sessions. Hotel, airport, and cafe networks are shared with strangers, and encryption makes intercepted traffic worthless.
- Keeps browsing away from your ISP. It sees a connection to a VPN server and nothing about the sites behind it.
- Changes which region a service sees. A server in another country unblocks that country’s Netflix catalog or lets you sign in to home banking while you travel.
- Covers torrent traffic. A VPN for torrenting keeps your IP address out of the swarm, so other peers see the VPN server’s IP address instead.
- Works around network filters. School, office, and national blocks work on the destination, and with a VPN, the only destination they see is the VPN server.
What a VPN Doesn’t Do
- It doesn’t make you anonymous. Signing in to an account identifies you regardless of your IP address. Google knows it’s you when you’re signed in, whichever country the connection appears to come from.
- It doesn’t stop cookies or browser fingerprinting. Trackers that identify your browser instead of your IP address keep working. A private window and a tracker blocker deal with those.
- It doesn’t remove malware. Some VPNs filter known malicious domains, which helps, but nothing in the tunnel scans files or cleans an infected computer.
- It doesn’t hide your activity from the VPN company. You move trust from your ISP to the VPN, so check that its no-logs policy has been independently audited.
- It doesn’t change what’s legal. Copyright law, local law, and a website’s terms apply exactly as they did before you connected.
Types of VPN
- Personal VPN. The consumer apps described here. You subscribe, install the app, and connect to the company’s servers for privacy and region changes.
- Browser extension. A VPN’s Chrome or Firefox add-on covers traffic in that browser only, while other apps stay on your normal connection. Extensions generally lack a kill switch.
- Remote access VPN. What employers deploy so staff can open internal systems from home. The destination is the company network, and the open internet stays outside it.
- Site-to-site VPN. A permanent encrypted link between two office networks, configured on routers and firewalls instead of on your laptop.
VPN Protocols Compared
The protocol is the set of rules for building the tunnel, and each one balances speed and compatibility differently. Most apps choose one automatically, and the default works for everyday use. On a network that blocks VPNs, switch to an obfuscated protocol instead.
| Protocol | Strength | Best for |
| WireGuard | Fast, modern, small codebase | Everyday use on any device |
| NordLynx | NordVPN’s version of WireGuard | Everyday use on NordVPN |
| Lightway | ExpressVPN’s own protocol | Quick reconnects on mobile |
| OpenVPN | Older, widely audited | Routers and restrictive networks |
| IKEv2 | Reconnects quickly after a network change | Phones moving between Wi-Fi and mobile data |
| Stealth, NordWhisper | Makes VPN traffic look like regular web traffic | Networks that block VPNs |
Does a VPN Slow Your Connection?
Yes, slightly. Encryption adds a small amount of work to every data packet, and traffic passes through the VPN server on its way to the website. On a nearby server, the difference is hard to notice: in October tests from Europe on a 190.36 Mbps connection, NordVPN kept 97% of the speed on a UK server, 95% on a US server, and 84% on a server in Japan. Distant servers also increase ping, which affects calls and online games, while video playback stays smooth.
Are VPNs Legal?
Yes, in most countries, including the US, the UK, Canada, Australia, and the EU member states. A short list of countries restricts or bans them, including China, Russia, Iran, Turkmenistan, Belarus, and Oman. A VPN changes who can observe your activity, and the law covering that activity stays the same: an illegal act is still illegal with the VPN connected. Our guide to VPN legality covers the country list in detail.
How Much Does a VPN Cost?
Long plans cost the least per month:
- NordVPN: under $3.50 a month on the two-year Basic plan
- Proton VPN: under $3 a month on the two-year VPN Plus plan
- ExpressVPN: under $3 a month on the two-year Basic plan
These rates cover the first term only. Renewals cost 2.3 to 3.3 times the introductory rate, and month-to-month billing costs 3.3 to 5 times as much. NordVPN and ExpressVPN refund the full price within 30 days, and Proton VPN refunds the unused part of the term. Proton VPN also has a free plan with no data cap, though it chooses the server country for you. Our free VPN rankings cover the alternatives.
Do VPNs Protect Against Viruses?
Not by themselves. A VPN encrypts traffic, but it doesn’t inspect downloads or scan your drive. Several now include filters that help at the edges. Proton VPN’s NetShield blocks known malware, ad, and tracker domains, and ExpressVPN includes Advanced Protection. NordVPN’s Complete and Prime plans add next-gen antivirus, which scans downloaded files.
Treat these as an extra layer, with antivirus software still doing the scanning. For antivirus and a VPN in one subscription, see our list of VPNs with built-in antivirus.
How Do You Use a VPN?
- Subscribe and create an account.
- Install the app on the device you browse from.
- Sign in and enable the kill switch, which blocks your internet if the VPN connection drops.
- Connect to a server nearby for speed, or in a specific country for that region’s services.
- Check your IP address on a lookup site such as ipleak.net, which should show the server’s country and DNS servers from the VPN company.
Our full setup guide covers phones, smart TVs, consoles, and routers, including the settings to change on the first connection.
How to Choose a VPN
- An audited no-logs policy. An independent firm should have checked the VPN’s servers and confirmed it keeps no activity records.
- A kill switch and leak protection. They keep your IP address and DNS requests in the tunnel when the connection drops.
- Speed on nearby servers. A good VPN keeps over 90% of your connection’s speed on a server close to you.
- Server countries. Check that the VPN covers the countries you want to appear in, for streaming or travel.
- The renewal price. Find it before checkout, since the advertised rate covers the first term only.
Our ranking of the best VPNs applies these criteria to each VPN on the list.
Conclusion
A VPN encrypts the traffic leaving your device, replaces the IP address websites see, and keeps your browsing history away from your ISP. Done well, it costs little speed on a nearby server. It won’t make you anonymous to accounts you’re signed in to, scan files for malware, or change what’s legal where you are.
For a first VPN, NordVPN covers 152 countries and adds Double VPN and an app-level kill switch. Proton VPN lets you start for free, and its paid plan adds Secure Core servers and streaming support.
Frequently Asked Questions
What does VPN stand for?
VPN stands for virtual private network. The name describes a private network built in software, which a device joins over the internet to encrypt its traffic and use another IP address.
What is a VPN connection?
A VPN connection is an encrypted link between a device and a VPN server. Websites see the server's IP address, and networks along the way see only encrypted data.
What is a VPN app?
A VPN app is the software that creates the encrypted connection on a phone, computer, or TV. It handles sign-in, server choice, and protocols, plus features such as the kill switch.
What is a VPN used for?
A VPN is used to encrypt traffic on public Wi-Fi, hide browsing from the ISP, change the country websites see while traveling, and keep an IP address out of torrent swarms.
Does a VPN make you anonymous?
No. A VPN hides the IP address and encrypts traffic, but account sign-ins, cookies, and browser fingerprinting still identify the user to websites and advertisers.
Does a VPN slow down the internet?
Yes, slightly. Encryption and the extra connection to the VPN server cost some speed, mostly on servers in faraway countries. On a nearby server with a modern protocol, the slowdown is hard to notice.
Can a VPN stop viruses?
No, not on its own. Encryption protects data in transit and does nothing about infected files. Proton VPN's NetShield blocks malicious domains, and NordVPN's Complete plan adds antivirus, but neither replaces security software.