What Is a VPN? How It Works, What It Hides and Where It Falls Short

What is a VPN and how does it work?

A virtual private network (VPN) is a service that routes all of your device's internet traffic through an encrypted tunnel between your device and a VPN server; the traffic then leaves that server for its final destination ^[1]. Encryption scrambles data so that only someone with the right key can read it. Because your requests appear to come from the VPN server, the VPN masks your IP address, the numerical address that indicates your general location and can be used to identify you ^[1].

Cloudflare describes the connection in four steps: the VPN client (the app on your device) connects through your internet service provider (ISP) using an encrypted connection; the ISP passes that connection to the VPN server; the VPN server decrypts the data and connects to the website on your behalf; and the encrypted link between the client and server is what is called the VPN tunnel ^[2]. Web servers then log only the IP address of the VPN server ^[2].

What happens on the device?

Technically, a VPN client creates a virtual network interface, a software-only network adapter, and uses it to encrypt and decrypt traffic before handing it to the real Wi-Fi or Ethernet hardware ^[3]. If all traffic goes through the tunnel it is called a full-tunnel VPN; if some traffic, such as local network traffic, is allowed to bypass it, it is called a split-tunnel VPN ^[3].

What are VPNs used for?

The Electronic Frontier Foundation (EFF), a digital-rights group, says VPNs are best suited for one thing, routing your connection through a different network, which is useful in two situations: getting around censorship on a network that blocks sites, and connecting to an office network from elsewhere ^[1]. Cloudflare adds protection on public Wi-Fi and getting around location-based content restrictions to the list of common uses ^[2].

What does a VPN hide, and from whom?

A VPN hides your outgoing traffic from your ISP and from the owner of the local network, such as a coffee shop or hotel ^[1]. Because the tunnel passing through the ISP is encrypted, the ISP cannot see what you are doing inside it ^[2]. From a website's point of view, you appear to be wherever the VPN server is ^[1].

The trade-off is simple and often missed: while a VPN hides your browsing from the ISP, all of it is visible to the VPN provider ^[1]. EFF notes that a provider could sell that information, just as an ISP could ^[1]. Cloudflare's own explainer says users can only feel secure with a VPN if they trust the VPN provider, because a dishonest provider could sell user information or leave users open to attacks ^[2].

A VPN also does not protect your data from the operator of the private network you join. On a corporate VPN, whoever runs the corporate network sees your traffic; on a commercial VPN, whoever runs the service does ^[1]. In short, a VPN moves trust from one company (your ISP or Wi-Fi owner) to another (the VPN provider); it does not remove the need for trust.

What can a VPN not protect you from?

Advertising for VPNs often claims they stop criminals, malware, government surveillance and online tracking; EFF says these advertisements vastly oversell the benefits ^[1]. The main limits are:

• Tracking. A VPN is not a tool for anonymity. Companies can still track you through GPS, web cookies, tracking pixels or fingerprinting ^[1].
• Accounts and history. A VPN does nothing to stop law enforcement from obtaining browsing history saved in your browser or in an account you are logged into ^[1].
• Legal requests to the provider. VPN providers are themselves subject to law enforcement requests, and many save as much information as ISPs do ^[1]. The provider must follow the laws of the countries where it does business ^[1].
• Payment links. Paying by credit card links your identity to the account, and the provider may still collect your IP address ^[1].

Can traffic leak out of a VPN?

Yes. In May 2024, Leviathan Security Group published TunnelVision (CVE-2024-3661), a technique that uses a built-in feature of DHCP, the protocol that hands out network settings, to force a user's traffic off the VPN tunnel so it is sent unencrypted ^[3]. The US National Vulnerability Database describes the issue: DHCP option 121 can add routes to a device's routing table, and an attacker on the same local network can read, disrupt or possibly modify traffic that was expected to be protected by the VPN ^[4].

In the researchers' tests, the VPN always continued to report as connected and the kill switch (a feature that blocks traffic if the VPN connection drops) never engaged ^[3]. Android was unaffected because it does not implement DHCP option 121 ^[3]. The researchers concluded that VPNs were not designed to mitigate attacks on the physical local network and that promising otherwise is dangerous ^[3].

What about speed?

Some users see slower connections, depending on the provider's server capacity, and a VPN server far from both the user and the website adds delay ^[2].

Do you need a VPN on public Wi-Fi?

Not always. EFF says it used to be standard advice to use a VPN on public Wi-Fi, but this is no longer as necessary for everyone because the majority of web traffic is now encrypted with HTTPS ^[1]. HTTPS is the padlock-protected version of the web protocol, which encrypts what you send and receive with a site.

HTTPS protects the content of communications, not the metadata ^[1]. On an HTTPS site, parties along the path can usually see the domain name (for example wikipedia.org) and when you visit it, plus the sizes of pages and files, but not the specific page, your login name or your messages ^[1]. A VPN could hide that metadata from someone listening on the local network, but the VPN provider would see it all ^[1].

EFF suggests a VPN may be useful when you must use a public network you do not trust and you have a VPN you do trust ^[1]. The US Federal Trade Commission (FTC) has likewise warned that free public Wi-Fi networks are often insecure, and its 2018 tips for VPN apps were framed around securing information sent over public Wi-Fi ^[5]. Note that an out-of-date VPN app may not protect you well even then; EFF cites TunnelVision as an example ^[1].

Which VPN protocols are safe?

A protocol is the set of rules a VPN uses to build and encrypt the tunnel. If a VPN uses broken encryption such as the Point-to-Point Tunneling Protocol (PPTP), data flowing through it can be easily decrypted and viewed ^[1]. EFF points to OpenVPN and WireGuard as the two protocols that have become common for consumer services ^[1].

WireGuard's developers describe it as a simple, fast and modern VPN that uses state-of-the-art cryptography, such as the Noise protocol framework, Curve25519 and ChaCha20, and say it has been reviewed by cryptographers ^[7]. It is designed to be small enough to be comprehensively reviewed by one person, unlike much larger IPsec or OpenVPN codebases ^[7].

For organisations, the UK National Cyber Security Centre (NCSC) says the most widely used protocols are TLS and IPsec, recommends IPsec for VPN access because it is an open standard built into many operating systems, and notes that WireGuard seems promising but is yet to be proven in enterprise contexts ^[6]. The NCSC also warns that some third-party networks restrict or block IPsec traffic, while TLS VPNs can be more reliable through enterprise firewalls ^[6].

Apple's iCloud Private Relay is sometimes confused with a VPN. It is designed to protect browsing in Safari, sends requests through two separate relays so that no single party, not even Apple, sees both who you are and which sites you visit, and is not available in all countries or regions ^[10].

How do you choose a trustworthy VPN?

The FTC's four checks before using a VPN app are: research the app before you get it, review its permission requests, make sure it encrypts your information, and check whether it shares your information with third parties ^[5]. EFF adds further questions ^[1]:

1. Read the privacy policy. A provider might log your data if it does not specifically rule that out, and a claim of no logging is not a guarantee ^[1].
2. Ask how it makes money. Some VPNs are free but sell your data; others use freemium data caps or recurring subscriptions ^[1].
3. Look for public audits. Independent security audits are a good sign, but practices can change after an audit ^[1].
4. Find out who runs it. Be sceptical of a VPN that no one stakes their reputation on, and check its about page for founders or staff ^[1].
5. Check the country. The provider is bound by the laws where it operates, including rules on government data requests ^[1].

Is an app store listing enough?

No. EFF warns not to assume a VPN app is safe because it is in Google Play or the Apple App Store ^[1]. Apple's App Review Guidelines say VPN apps may not sell, use or disclose data to third parties for any purpose ^[9]. Yet the Tech Transparency Project reported on 1 April 2025 that 20 of the top 100 free VPNs in the US App Store during 2024 were owned by Chinese companies, none of which clearly disclosed that ownership, and that those apps had been downloaded more than 70 million times ^[8]. Google Play shows a Verified badge for some VPNs, which EFF describes as a small glimpse into the app's security promises rather than a replacement for research ^[1].

Are VPNs legal everywhere?

No. EFF advises keeping up to date on specific countries' VPN policies, including bans, and notes that streaming platforms increasingly block devices that appear to use a VPN ^[1]. Apple requires developers who offer a VPN app in a territory that requires a VPN licence to provide that licence information ^[9]. This is general information, not legal advice; check the law where you live.

What is the situation in Iran?

Freedom House's Freedom on the Net 2024 report says many Iranians rely on VPNs to reach international services blocked by the authorities ^[11]. In February 2024 the Supreme Council for Cyberspace prohibited the use of unlicensed VPNs and said individuals would need to apply to purchase licensed VPNs with government approval ^[11]; analysts quoted in the report say it criminalised not only the distribution and sale but also the use of VPNs ^[11]. The same report says the ICT Ministry announced in October 2022 that anyone selling or using illegal VPNs could be charged under Article 753 of the penal code, and that services such as NordVPN, Proton VPN and TunnelBear were inaccessible during its coverage period ^[11]. Freedom on the Net 2025 adds that a near-total, nationwide internet shutdown was imposed in June 2025 ^[12].

Are business VPNs different?

Yes. A business VPN connects staff to internal systems rather than masking their location. The NCSC notes that VPN services are part of an organisation's internet-exposed attack surface and must be updated swiftly when security patches are released ^[6]. It also says there is little benefit in a VPN for an organisation that has fully adopted a zero-trust approach, in which no device is trusted by default ^[6].

Cloudflare, which sells such alternatives, argues that traditional VPNs can lead to a castle-and-moat model where anything inside the network is automatically trusted, and says many businesses have moved to secure access service edge (SASE) designs instead ^[2]. For individuals, EFF's view is that for many people a VPN is not the most important security step; it lists end-to-end encrypted messaging among more impactful measures ^[1].