What Does a VPN Actually Protect You From?

What it does cover

Someone reading the network you are on — at the airport, in a hotel, on shared wifi — sees only the encrypted tunnel to your provider's server. Your internet provider loses the destination log it would otherwise keep. Your public address stops appearing wherever it would otherwise be published, such as a peer-to-peer swarm.

It also removes the geography of your connection: sites see a server in the country you picked, which is how people read the catalogue they pay for while travelling, and how a site that blocks your region's addresses lets you in.

Each of those is a specific, checkable benefit. Someone on the same wifi stops being able to read or redirect your requests; your provider's destination log stops growing; the address that appears in public is a shared server rather than the one tied to your line.

What it does not cover

Phishing: you still type the password into the wrong site, and the tunnel delivers it faithfully. Malware: the download still runs. A breached shop: your email and password are in a database regardless of where you connected from. Account takeover: whoever has your session does not need your address.

Nor does it stop someone watching both ends, a browser that fingerprints you, or an employer or school device that manages what you install. The layer above the tunnel — your accounts, your browser, your files — is untouched by it.

The boundary is easy to state: the tunnel protects the connection, not the content you hand over once you arrive. Anything you type, upload or install passes through it untouched, and the VPN has no way to distinguish the safe request from the careless one.

Threat, and the layer that answers it

The useful way to think about it is as a mapping rather than a single tool:

No single product answers all of these, and treating a VPN as if it did is how people end up disappointed with it.

• Eavesdropping on open wifi — a VPN answers this completely.
• Your ISP keeping a destination log — a VPN answers this while it is on.
• Your address appearing in a torrent swarm — a VPN answers this.
• Region locks and IP-based blocking — a VPN usually answers this.
• Phishing, weak passwords, breached databases — a password manager and two-factor authentication answer these.
• Malware and ransomware — updates, careful downloads and backups answer these.
• Being tracked while signed into sites — only not signing in, or a tracker-blocking browser, addresses this.

The layer that usually matters more

For most households the highest-return security spending is unglamorous: a password manager so every site gets a unique secret, two-factor authentication on the accounts that matter, updates applied without delay, and a backup that restores after something goes wrong.

A VPN sits alongside those rather than in front of them. It is the layer that protects the connection itself, which is why we weight privacy — what the provider does with your data — as the largest single component of the score: How we test.

None of that is expensive, and none of it competes with the VPN for attention once it is set up. The pattern that works is a short list you finish rather than a long one you abandon: unique passwords, a second factor on the accounts that matter, updates applied without delay, and a backup you have actually restored once.

Choosing the layer you will actually use

A protection that requires a decision every time is one you will skip. This is the practical argument for leaving a VPN on by default rather than per site: the tunnel is either up or it is not, and a habit beats an intention.

If you are picking which provider deserves that default position on your devices, all eleven are compared on privacy, speed and price with the weights shown: Compare. The beginner's path through the whole setup is here: Best VPN for beginners.

That ordering matters when money is involved. A household that buys a VPN and skips a password manager has bought the second most useful layer and left the first one on the table — and the first one is cheaper.