What does a VPN hide?
- Author
- By Amelia Ame
- Last checked
- Updated September 10, 2026
- Reading time
- 5 min read
It hides your browsing from your ISP and your IP from websites. It does not hide you from anything you log into — the full list, both ways.
- Ran DNS, IPv6 and WebRTC leak tests on all ten VPNs across four platforms
- Tested each kill switch by killing the tunnel mid-transfer
- Checked which providers offer obfuscation, which hides VPN use itself
DNS, IPv6 and WebRTC — the three ways a connected VPN still gives you away.
- Commonest leak
- DNS on Windows
- Kill switch
- 10 of 10
- Hides VPN use
- 9 of 10
Re-tested monthly on Windows, macOS, iOS and Android
The short answer
A VPN hides your browsing activity from your internet provider and your real IP address from the websites you visit. It does not hide your identity from any service you log into, does not hide the fact that you are using a VPN, and does not stop malware, phishing or tracking that follows your account rather than your address.
Most VPN marketing answers this question with the word "everything", and most VPN criticism answers it with "nothing". Both are wrong, and the accurate answer is specific enough to be useful.
What it hides from your internet provider
This is the strongest and least arguable part.
Without a VPN your ISP sees every domain you connect to — even over HTTPS, because the destination is named in the DNS lookup and in the TLS handshake before encryption begins. It sees every DNS lookup if you use its resolvers, which most people do. It sees volume and timing, enough to distinguish streaming from browsing from a large download. And it sees any unencrypted traffic in full.
With a VPN it sees an encrypted connection to one address, how much data moved, and when. Not the sites. Not the pages, searches or videos. Not the downloads.
What it can still see is that you are using a VPN — a steady encrypted connection to a known VPN address is easy to identify. In most countries that is unremarkable. Where it is not, obfuscation disguises the tunnel as ordinary HTTPS.
| VPN | Stealth mode | Based in | Last audit | RAM-only servers |
|---|---|---|---|---|
 Proton VPN | Yes | Switzerland | Securitum, 2024 | No |
 Mullvad | Yes | Sweden | Assured, 2024 | Yes |
 NordVPN | Yes | Panama | Deloitte, 2024 | Yes |
 Surfshark | Yes | Netherlands | Deloitte, 2025 | Yes |
 ExpressVPN | Yes | British Virgin Islands | KPMG, 2024 | Yes |
 Windscribe | Yes | Canada | Packetlabs, 2024 | No |
 CyberGhost | No | Romania | Deloitte, 2024 | Yes |
What it hides from websites
Your real IP address, and with it your rough location and your ISP's identity. A site sees the VPN server's address instead — which is shared with many other people, so it is a weak identifier of anyone.
That is genuinely useful. It is also the piece most easily undone, in two ways.
WebRTC. The browser feature behind video calls needs to discover your real IP to work, and it will hand it to any page that asks — tunnel or no tunnel. Your ISP learns nothing new; the websites you visit learn everything you were hiding. Our WebRTC test compares what the browser reveals against what the server sees; a mismatch is a leak.
Being logged in. Covered below, because it is the big one.
What it does not hide, at all
Anything you log into. Sign in to Google, Amazon or Facebook and the VPN hides your traffic from your ISP while telling that service nothing it did not already know. Accounts, cookies and browser fingerprints identify a returning visitor regardless of the address they arrive from. A VPN changes who can watch the pipe; it does not make you anonymous to a service holding your name.
Your own device. Browser history, cookies, downloads, cached files — all still on your machine. A VPN and private browsing solve completely different problems, and neither solves the other's.
Malware, phishing and bad downloads. A tunnel does not inspect what travels through it. Some VPNs add DNS-level blocking of known malicious domains, which helps at the margin; none of them make a dangerous download safe.
Your billing details, address or identity. Anything you have typed into a form is out. A VPN applied afterwards does not retrieve it.
Activity from before you installed it. Whatever record exists, exists.
Traffic on a device someone else controls. On a managed work laptop, monitoring software or an installed certificate can see traffic before it is ever encrypted. No VPN defeats that, because the interception happens on your side of the tunnel.
The four ways people leak anyway
Each of these puts you back roughly where you started, and none is visible from inside the app.
DNS leaks. Your traffic goes through the tunnel; your DNS lookups go to your ISP's resolver instead. Your ISP now has a timestamped list of every domain you visited — exactly what you were preventing — while the app shows a green "connected". Windows is the usual culprit, because it queries every network adapter at once and takes the fastest answer. Every VPN we rate blocks this; check the setting is on and then verify with a leak test.
WebRTC leaks. As above. Browser-level, and the reason to run the test rather than assume.
The tunnel dropping. Connections fail — you change Wi-Fi, the laptop wakes, a server restarts. For the seconds before reconnection everything goes out in the clear. A kill switch blocks traffic during that gap. All ten VPNs we rate have one; not all enable it by default.
Being signed in. The one no configuration fixes.
The part that is a transfer, not an erasure
Worth stating plainly: a VPN does not make your browsing record disappear. It moves who holds it.
Without one, your ISP has it — a company that in some countries is legally required to retain it and in others is legally permitted to sell it. With one, the VPN provider is in that position instead.
That is a real improvement, because a VPN provider's entire business depends on not keeping it, whereas an ISP's does not. But it is an improvement only to the extent the provider genuinely does not keep it — which is why the audit, the jurisdiction and the RAM-only servers in the table above are the things to check, and why "no logs" written on a homepage is not evidence of anything.
The honest summary
A VPN hides what you do from the network you are doing it on, and who you are from sites you have not identified yourself to.
It does not hide you from services you use, does not secure your device, and does not make you anonymous. Within those limits it is genuinely useful — on public Wi-Fi, against an ISP that profiles or throttles you, when travelling — and outside them it is being sold as something it is not.
Common questions
Does a VPN hide my browsing history?
From your internet provider, yes — it sees an encrypted connection to one server and nothing about which sites are inside it. From your browser, no: your own history, cookies and downloads are stored on your device exactly as before. And from a site you log into, no — an account identifies you regardless of the address you arrive from.
Does a VPN hide my IP address?
Yes. Websites see the VPN server's address instead of yours, which also hides your approximate location and your ISP's identity. Two things can undo it: a WebRTC leak, which lets a browser reveal your real address to any page that asks, and simply being logged in.
Can my ISP tell I am using a VPN?
Almost always. A steady encrypted connection to a known VPN IP address on a VPN port is easy to identify. That is not a problem in most countries — VPNs are legal and ordinary. Where it matters, obfuscated servers disguise the traffic as regular HTTPS, and nine of the ten VPNs we rate offer them.
Does a VPN hide me from Google?
Not if you are signed in. Google knows who you are from the account, not the IP address, and cookies and browser fingerprints identify a returning visitor regardless of where they connect from. A VPN hides your traffic from the network operator; it does not make you anonymous to a service you have handed your name to.
Does a VPN hide my activity from my employer?
On their network, it hides the contents the same way it hides them from an ISP. On a device they own, assume it hides nothing — a managed laptop may have monitoring software or a certificate installed that sees traffic before it is ever encrypted. That is not something a VPN can defeat.
Does a VPN hide me from the police?
It removes the ordinary mechanism by which an IP address is traced back to a subscriber, provided the VPN genuinely keeps no logs. It is not immunity, it does not apply retroactively to activity before you installed it, and a serious investigation has methods that do not depend on your IP address. Anyone selling a VPN as protection from law enforcement is misleading you.
Read next
- PrivacyCan your internet provider see your history if you use a VPN?It hides the domains you visit, not that you're using a VPN. We ran 40 leak tests to find where the line actually falls — and where it silently moves.
- BasicsIs a VPN worth it?For four jobs, yes. For the two most people buy one for, no. What $2–5 a month actually gets you, judged against what it is supposed to fix.
- BasicsWhat is a VPN?Six parties can watch what you do online. A VPN blinds two of them, adds itself as a third, and leaves the rest untouched. Here is the whole accounting, hop by hop.