You have probably seen the adverts. A VPN will keep you safe, they say. It will make you invisible online, protect you from hackers, and stop anyone from ever tracking you. It sounds like one small app can solve your whole privacy problem.
The truth is more ordinary, and more useful. A VPN is a real tool that does a real job — but only one job. It protects the connection between your device and the internet. It does not make you anonymous, it does not stop websites from tracking you, and it does not replace the other habits that keep your accounts safe.
This guide explains what is a VPN in plain English: what it is, how it works, what it can and cannot do for your privacy, when it is worth using, and how to choose one without falling for the sales pitch.
What is a VPN?
VPN stands for Virtual Private Network. In simple terms, it is a private, encrypted connection that runs over the public internet.
Normally, when you open a website, your traffic travels from your device to your internet provider, then on to the website. Anyone watching that first stretch — for example, someone on the same public Wi-Fi network — may see which sites you visit and, if the connection is not encrypted, some of what you send.
A VPN changes that first stretch. It builds an encrypted tunnel between your device and a server run by the VPN provider. Your traffic travels through it scrambled, and the website sees the server’s address, not yours. Think of it as a sealed envelope instead of an open postcard.
A VPN is one part of staying safe online, not the whole story. Our beginner’s guide to cybersecurity explains the other pieces that matter just as much: https://darknet.cards/what-is-cybersecurity-beginners-guide/
How a VPN works
You do not need the technical details to use a VPN well, but a rough picture helps you see both its strengths and its limits.
1. You connect to the internet as usual. Your phone or laptop joins a Wi-Fi network or uses mobile data. Nothing is protected yet.
2. You switch on the VPN. The app connects to one of the provider’s servers and agrees how to scramble your traffic.
3. Your traffic is encrypted. Everything your device sends is scrambled before it leaves, so anyone snooping on the same Wi-Fi sees scrambled data, not the sites you visit. The server then unscrambles it and passes it to the website, which sees the server’s address, not yours.
Two things matter. First, encryption only covers the stretch to the VPN server — after that, traffic travels as normal, so websites still need their own encryption, the padlock in your browser. Second, the VPN provider can now see your traffic, just as your internet provider could before.
What a VPN does
A VPN is genuinely useful in several everyday situations. Here is what it actually does for you.
It encrypts your traffic on untrusted networks. This is its main job, and it does it well. On public Wi-Fi in a cafe, hotel, airport or train, a VPN stops others on the same network from easily reading your traffic.
It hides your internet address from websites. They see the VPN server’s address instead, so it is harder for a site to work out roughly where you are.
It hides your browsing from your internet provider and the local network. Without a VPN, your provider can see which sites you visit; with one, it only sees the VPN connection.
None of this is magic. It is one practical layer of protection, and it works best with the other habits that protect your accounts — starting with strong passwords: https://darknet.cards/how-to-create-strong-passwords-password-manager/
What a VPN does not do
A VPN has clear limits, and the limits are where people get caught out.
| What people expect | What a VPN actually does |
|---|---|
| Makes me anonymous | No. Cookies, trackers and your account sign-in can still identify you. |
| Stops websites tracking me | No. Cookies and your account sign-in still follow you, with or without a VPN. |
| Protects me from phishing | No. A VPN does nothing about a fake email or a fake website. |
| Replaces antivirus or updates | No. It does not scan files or fix problems on your device. |
| Hides my activity from everyone | No. The VPN provider itself can see your traffic. |
| Makes a bad password safe | No. If someone steals your password, a VPN will not stop them signing in. |
It does not make you anonymous. Hiding your internet address is only one piece of how you are identified. Cookies and your account sign-in matter more — sign in through a VPN, and the service still knows who you are.
It does not stop cookies and account tracking. Most tracking relies on files on your device and the accounts you sign in to, not your internet address. A VPN removes neither. See our guide to digital privacy: https://darknet.cards/what-is-digital-privacy-and-why-does-it-matter/
It does not protect you from phishing, or protect your device. A VPN cannot tell whether a website is genuine — type your password into a fake login page, and it will encrypt it on its way to the scammer. Spot those messages here: https://darknet.cards/how-to-identify-and-avoid-phishing-attacks/
It does not hide your activity from the VPN provider. Your traffic is hidden from the Wi-Fi network and your internet provider, but the provider can see it instead. One with a poor privacy policy or detailed logs can be worse than no VPN at all.
When a VPN is worth using
You often use public Wi-Fi. This is the strongest case for a VPN. Cafes, hotels, airports and trains run networks you do not control, and some have no password at all.
You travel a lot. Travelling means new networks, hotel Wi-Fi and airport lounges. A VPN gives you a more private connection while you are away.
You work away from home. If you work from cafes or shared spaces, a VPN adds a layer of protection. Many employers provide their own — if yours does, use it for work.
You share a network you do not trust. A shared house, a rented flat or a student hall can all be reasons to encrypt your connection.
In these situations, a VPN is a sensible, practical step.
When a VPN is not needed
At home, on your own trusted Wi-Fi. Your traffic is already protected by your Wi-Fi password and by the encryption most websites now use — the padlock in your browser.
As a replacement for other security habits. Weak or reused passwords, no two-factor authentication, clicking links in unexpected messages — a VPN will not save you from any of these. Two-factor authentication is one of the strongest free protections available: https://darknet.cards/what-is-two-factor-authentication/
For hiding wrongdoing, or on every device, all the time. A VPN is not a way to hide illegal activity — providers can be asked to hand over logs. Leaving one running constantly just routes everything through one company, all the time.
How to choose a VPN
1. Look for a clear no-logs policy. A good provider explains, in plain language, what it does and does not record, and whether that claim has been independently audited. If the policy is vague, that is a warning sign.
2. Check who runs it and where it is based. A provider should say who it is and which country’s laws apply. One that hides its owners is asking for trust without giving you a reason.
3. Be wary of free VPNs. Running servers costs money, and a free service has to cover it somehow — sometimes with adverts or by selling data about your activity.
4. Look for a kill switch. It blocks your internet if the VPN drops, so your traffic does not suddenly travel unprotected. Most reputable paid VPNs include one.
5. Check it works on your devices, and download it from the official source. Get the app only from the provider’s website or your device’s app store, never from a link in an email or an advert.
6. Do not choose on price alone, and ignore the biggest promises. The provider’s privacy policy, reputation and independent audits matter far more than price. Any provider claiming to make you completely anonymous is overselling.
The UK’s National Cyber Security Centre publishes guidance on choosing and configuring VPNs: https://www.ncsc.gov.uk/guidance/using-ipsec-protect-data
How to set up a VPN
Setting up a VPN takes only a few minutes.
1. Choose a provider and sign up on its official website. Go to the provider’s own website, not a link from an advert or an email. Use a strong, unique password, and turn on two-factor authentication if it is offered.
2. Download the app from the official source. Install it on each device you want to protect, from the provider’s website or your device’s app store. Do not download VPN software from anywhere else.
3. Sign in and choose a server. Most apps suggest a server, often the nearest one, which is usually fastest. Travelling and want to appear at home? Pick a server in your home country.
4. Turn on the kill switch. Find the setting in the app and switch it on, so your device stops sending traffic unprotected if the VPN drops.
5. Connect before you use public Wi-Fi. Switch the VPN on before you join a public network, not after you have started browsing.
6. Check it is working, and keep the app updated. The app should show you are protected and which server you are connected to. Turn on automatic updates. At home, you can switch the VPN off.
Common VPN myths
“A VPN makes me completely anonymous.”
No. A VPN hides your internet address, but cookies, trackers and your account sign-ins can still identify you.
“A VPN makes me invisible to the police or the government.”
No. A provider can be asked to hand over information, and many keep some logs. A VPN is for everyday privacy, not hiding from the law.
“A free VPN is just as good as a paid one.”
Not usually. Running servers costs money, and a free service has to cover it — sometimes with adverts or by selling data about its users.
“I only need a VPN if I have something to hide.”
No. A VPN is useful for ordinary reasons: working from a cafe, using hotel Wi-Fi, or travelling.
“A VPN slows my internet to a crawl.”
It can slow your connection a little, since traffic takes an extra step. With a good provider and a nearby server, you often will not notice it.
“Once the VPN is on, I am safe from everything.”
No. A VPN protects the connection, and only the connection. It does not stop phishing, fix weak passwords, block malware, or make a website trustworthy.
Frequently asked questions
What is a VPN in simple words?
A VPN, or Virtual Private Network, is an encrypted connection between your device and a VPN server. It scrambles your traffic, so people on the same Wi-Fi cannot easily read it.
Does a VPN make me anonymous online?
No. A VPN hides your internet address, but websites can still identify you through cookies, trackers and the accounts you sign in to.
Should I use a VPN on public Wi-Fi?
Yes — this is the best reason to use one. Public Wi-Fi is a network you do not control, and a VPN encrypts your traffic on it. Connect before you start browsing.
Does a VPN protect me from phishing?
No. A VPN encrypts your connection, but it cannot tell whether a website is genuine. If you type your password into a fake page, a VPN will not stop that.
Is a free VPN safe to use?
It depends on the provider. Some free VPNs are limited versions of reputable paid services. Others pay with adverts or by selling data — check who runs it first.
Do I need a VPN at home?
For everyday browsing at home, usually not. Your home Wi-Fi is protected by its password, and most websites encrypt their own connections — the padlock in your browser.
The bottom line
A VPN is a useful, honest tool — as long as you judge it on what it actually does. It encrypts your connection, which makes it genuinely valuable on public Wi-Fi and while travelling. It hides your internet address from websites, and your browsing from the local network and your internet provider.
What it does not do is just as important. It does not make you anonymous, stop cookies or account tracking, or protect you from phishing, weak passwords or an out-of-date device. And it does not hide your activity from the VPN provider itself — you are trusting that company with your traffic, so choose one that has earned that trust.
Use a VPN where it helps, keep your passwords strong and different for each account, turn on two-factor authentication, and stay careful about unexpected messages and links.