Does a VPN protect you from hackers?
- Author
- By Amelia Ame
- Last checked
- Updated September 10, 2026
- Reading time
- 5 min read
Mostly no. A VPN helps with 2 of the 7 threats people buy one for, and 2FA plus a password manager beat it on the other five.
- Tested every VPN's kill switch and leak behaviour, which is what the network defence rests on
- Checked which providers include DNS-level malicious-domain blocking and what it actually blocks
- Verified the ad and tracker blockers work at DNS level rather than only in a browser
Network interception and IP-based targeting. The other four need different tools.
- Costs
- $2–5/mo
- Better first buy
- 2FA (free)
- Then
- Password manager
Assessed against the attack types that account for most real compromises
The short answer
A VPN stops someone on the same network from reading your traffic, and hides your IP so it cannot be targeted directly. It does not stop phishing, malware, a leaked password, a data breach at a company you use, or anything that happens on your own device — which is how almost everyone actually gets compromised.
"Protects you from hackers" is the most common claim in VPN marketing and the least accurate. It is not a lie exactly — a VPN does defend against a real attack — but it defends against one that is rare, while leaving untouched the ones that are common.
Here is the honest breakdown, including what you should buy instead if security is the actual goal.
What a VPN genuinely defends against
Someone watching a shared network
On a café, hotel or airport network, the operator — and anyone who has compromised it — sits between you and the internet. Without a VPN they see every domain you connect to, when, and how much data moved. Anything not encrypted, they see in full.
A VPN turns all of that into one encrypted connection to one server. This is its strongest and least arguable use, and it is the reason the auto-connect-on-untrusted-Wi-Fi setting is worth turning on.
Worth being precise: HTTPS already protects the contents of most connections. What the VPN adds is hiding the destinations, and covering the older devices and apps that still send data in the clear.
Being targeted by IP address
Your IP is visible to anyone you connect to — a game server, a voice chat, a website. With a VPN they see the VPN's address instead, shared with thousands of people and pointing at a data centre.
That removes IP-based targeting, including the DDoS attacks that are a real problem if you stream or play competitively with strangers. It also stops the low-effort case of someone looking up your rough location from an address.
What it does nothing about
This is the longer list, and it is where compromises actually come from.
Phishing. You receive a convincing email, click through, and type your password into a page that is not your bank. Every byte of that travels safely through an encrypted tunnel to the attacker.
Malware. A VPN encrypts traffic; it does not inspect it. A malicious download arrives exactly as it would have. Some providers add DNS-level blocking of known-bad domains — genuinely useful, not antivirus.
A leaked password. If your password appears in a breach and you used it elsewhere, attackers will try it everywhere. This is called credential stuffing and it is the single most common route into an account. A VPN is irrelevant to it.
A breach at a company you use. Your data sitting on someone else's compromised server has nothing to do with how you connected to it.
Anything on your own device. Compromised machine, malicious browser extension, someone with physical access — the interception happens on your side of the tunnel.
Anything you are logged into. A VPN hides your traffic from the network. It tells a service you have signed into precisely nothing it did not already know.
The comparison nobody in this industry draws
| Threat | VPN helps? | What actually helps |
|---|---|---|
| Someone watching public Wi-Fi | Yes | VPN |
| IP-based targeting / DDoS | Yes | VPN |
| Phishing | No | Password manager, 2FA, scepticism |
| Malware | No | Updates, care with downloads |
| Password reuse | No | Password manager |
| Data breach at a company | No | 2FA, unique passwords |
| Compromised device | No | Updates, antivirus, backup |
Two rows out of seven.
Where the confusion comes from
Two things.
"Military-grade encryption." AES-256 is genuinely strong, and it is the same encryption your bank's website already uses. It is not a differentiator between VPNs and it is not a defence against any of the attacks in the lower half of that table. The phrase is chosen because it sounds like protection in general rather than encryption in transit specifically.
The word "secure". A VPN secures a connection. Security in the sense people mean — my accounts, my money, my files — is a different problem. Marketing depends on the two meanings blurring.
The security extras some VPNs bundle
Several providers now include tools that genuinely do address the other rows. They are worth understanding as separate products that happen to share a bill.
DNS-level blocking of malicious, ad and tracker domains — NordVPN's Threat Protection, Surfshark's CleanWeb, Windscribe's R.O.B.E.R.T. Because it works at DNS level it covers every app on the device, not just the browser. Real value, and the closest a VPN comes to security.
Breach monitoring — checks your email against known breaches. Useful once; the free services do the same.
Password managers bundled into higher tiers — this is the genuinely valuable one, and it is worth pricing against buying a password manager separately rather than assuming the bundle is cheaper. Our NordVPN plan comparison works through that arithmetic.
| VPN | Kill switch | RAM-only servers | Last audit | 2-year price |
|---|---|---|---|---|
 NordVPN | Yes | Yes | Deloitte, 2024 | $3.39/mo |
 Surfshark | Yes | Yes | Deloitte, 2025 | $2.19/mo |
 Windscribe | Yes | No | Packetlabs, 2024 | $5.75/mo |
 Proton VPN | Yes | No | Securitum, 2024 | $4.49/mo |
 PIA | Yes | Yes | Deloitte, 2024 | $2.03/mo |
So should you buy one?
If the reason is public Wi-Fi, an ISP you would rather not have profiling you, travel, or DDoS protection — yes, those are real and a VPN addresses them directly.
If the reason is "I want to be secure online" — a VPN is not the purchase. Turn on two-factor authentication, start using a password manager, keep your software updated, and be sceptical of links. Then, if the first list also applies to you, add a VPN.
We make money when people buy VPNs through this site, and it is still the honest order.
Common questions
Does a VPN stop hackers?
It stops one kind: someone on the same network reading your traffic, and someone targeting your IP address directly. It does nothing about phishing, malware, password reuse, or a breach at a company holding your data — which between them account for the overwhelming majority of real compromises.
Does a VPN protect against viruses and malware?
No. A VPN encrypts traffic in transit; it does not inspect what that traffic contains. A malicious download arrives exactly as it would have. Some VPNs add DNS-level blocking of known malicious domains, which stops you reaching some bad sites — useful, but not antivirus and not sold as such by anyone honest.
Does a VPN protect me on public Wi-Fi?
Yes, and this is its strongest case. On a café or hotel network the operator, and anyone who has compromised it, is in the same position your ISP would be. HTTPS covers the contents of each connection; the VPN covers the destinations too, and covers the older apps and devices that still send data unencrypted.
Can hackers see my IP address if I use a VPN?
They see the VPN server's address, which is shared with many other people and points at a data centre rather than your home. That removes IP-based targeting — including the DDoS attacks that matter if you stream or play competitively. Two things undo it: a WebRTC leak, and being logged into a service that already knows you.
What actually protects me from hackers?
Unique passwords in a password manager and two-factor authentication on your important accounts. Between them they defeat password reuse, credential stuffing and most account takeovers — which is where the real risk is. Both cost less than a VPN and one of them is free. Buy those first.
Is a VPN enough for online security?
No, and any page telling you otherwise is selling one. A VPN is a privacy tool that solves a network-shaped problem. Security is a stack: updates, unique passwords, 2FA, care with links and downloads, and a backup. A VPN sits alongside those, not in place of them.
Read next
- PrivacyWhat does a VPN hide?It hides your browsing from your ISP and your IP from websites. It does not hide you from anything you log into — the full list, both ways.
- PrivacyAre VPNs safe?The technology is settled; the provider is the variable. Four things you can actually check, and why a police raid beats any audit.
- BasicsWhat is a VPN?Six parties can watch what you do online. A VPN blinds two of them, adds itself as a third, and leaves the rest untouched. Here is the whole accounting, hop by hop.