What Is a VPN and How Does It Work?

What the tunnel actually is

A VPN is software — an app on your phone, a client on your laptop, or a profile on your router — that opens an encrypted connection to a server run by the VPN provider. The two ends agree on keys in the first second of the connection, and from then on everything you send is wrapped before it leaves your device and unwrapped only at that server.

Your device keeps its normal network address; the tunnel sits on top of it. Your internet provider still carries your packets, but they now go to one destination only: the VPN server. From the outside your computer looks like a second machine sitting next to that server, in whatever city and country you picked.

What changes the moment you connect

Four things, and they are worth separating. The address a website sees becomes the server's address. Your DNS lookups travel inside the tunnel instead of to your internet provider's resolvers. The traffic between you and the VPN server is unreadable to anyone in the middle. And every request from your device now leaves from the same source, so sites can group your visits under one address.

That last point cuts both ways. The server's address is shared with everyone else using it at that moment, so a streaming service sees a crowd rather than a person — which is exactly why most of them try to block it, and why your own traffic blends into a queue of other people's.

There is one more change people notice first: pages stop asking whether they may know your location, because the answer they get back describes the server. Everything the site infers from the address — country, city, roughly which part of a town — now describes the VPN server rather than your street.

Who can still see what

A VPN moves one party out of the middle and puts another one in. Which party that is decides how much the tunnel is worth to you:

None of these four see the same picture, and confusing them is how most VPN advice goes wrong.

• Your internet provider: that you are connected to a VPN server, its address, and roughly how much data moves. Not which sites you visit.
• The VPN provider: every destination you ask for, tied to your account, unless it runs a no-logs policy that has survived an audit.
• The site you visit: the VPN server's address, plus your logins, your cookies and your browser as usual.
• Anyone on the same wifi: nothing readable. The tunnel was encrypted before it touched the network.

What a VPN does not do

It does not make you anonymous. The sites you sign into still know who you are, your browser still prints a fingerprint, and an account you have held for ten years does not become new because the address changed.

It does not protect you from the rest of the internet's bad luck either: phishing, malware, a reused password, a breach at the shop you bought from. And it does not hide you from the VPN provider itself — the provider is now the party in the middle, which is why an auditable no-logs policy matters more than a feature list.

It does not speed anything up. Our speed component is an estimate read off the architecture — protocol support, server density, distance — rather than a benchmark we ran ourselves, and How we test says so in plain words.

How to judge one in five minutes

If you check five things, check these: does the provider publish an audit of its no-logs policy with a named firm and a date, and are the servers RAM-only so that nothing sits on a disk waiting to be seized. Which country the company answers to. Whether it supports WireGuard, which is the modern default. And what the plan costs in the second year, not the first — the discount almost always ends.

All eleven providers we cover are compared on exactly those components, with the weights printed next to them: Compare. If privacy is the only job you have, Best VPN for privacy re-weights the same five components for that job.

One more question earns its place: what happens after the first year. Introductory pricing on a three-year plan hides the real number until it is too late to compare, so read the renewal price before the discount rather than after it — the providers in this business almost all raise the price at renewal, and the honest ones print it in the same table.