What is a VPN?

Almost every explanation of this starts with a tunnel metaphor and ends before the interesting part. The mechanism takes two paragraphs. What is worth your time is the accounting: who could see your traffic before, who can see it after, and who gets added to that list.

The mechanism, in two paragraphs

Normally your device talks to each website directly. Your traffic passes through your router, your internet provider's network, and a chain of other networks before it arrives. Every one of those can see where it is going, even when the contents are encrypted — the destination has to be readable or the packet cannot be delivered.

With a VPN, your device first builds an encrypted connection to one server run by the VPN company. Everything you do afterwards goes inside that connection: requests to websites, DNS lookups, app traffic, all of it. To anyone watching the first stretch — your router, the café Wi-Fi, your internet provider — there is one connection to one address, and its contents are unreadable. The VPN server unwraps your traffic at the far end and sends it on to the actual destination under its own address, then carries the replies back.

That is it. Everything a provider advertises on top of this — kill switches, split tunnelling, obfuscation, multi-hop — is a refinement of the same idea.

Where this came from, and why it matters

The technology was not built for any of the reasons people buy it now. A virtual private network was a way for an employee to reach the office file server from home as though they were sitting at their desk — private network, extended virtually. Businesses have run them since the late 1990s and still do.

The consumer product is that same plumbing pointed at a different problem. Instead of tunnelling into your employer's network, you tunnel into a company's server farm and come out the other side. Nothing about the engineering changed; the reason for using it did.

This is worth knowing for one reason. The technology is mature and well understood; the industry selling it to consumers is twenty years younger and much less settled. When a VPN fails people, it is almost never the encryption — it is a provider that logged what it said it would not, an app that leaked DNS, or a marketing claim that was never true. Which is why the checks further down this page are all about the company rather than the cryptography.

Who can see what

This table is the page. Most of what people get wrong about VPNs is a row in it they did not know about.

Who is watching	Without a VPN	With a VPN
Your device (malware, extensions, your employer's software)	Everything, before encryption	Everything, unchanged
The Wi-Fi you are on (café, hotel, office, landlord)	Every domain you visit, timing, volume	One encrypted connection to one address
Your internet provider	Every domain you visit, timing, volume	That you use a VPN, which server, how much, when
The VPN company	Nothing — it is not in the path	Everything your provider used to see
Sites you do not log into	Your IP address and device fingerprint	The server's IP; fingerprint unchanged
Sites you log into (Google, your bank, your email)	Exactly who you are	Exactly who you are, unchanged

Three rows deserve saying out loud.

Your device is not affected at all. A VPN encrypts traffic after it leaves your applications. Anything running on the machine — a browser extension, malware, monitoring software on a work laptop — sees your activity before encryption happens and is entirely unaffected by the tunnel.

The VPN company is a new entry on the list. You have not removed an observer; you have swapped one for another and chosen who it is. That is a real improvement if the company keeps no logs and your provider does — and no improvement at all if it keeps logs too.

Logging in undoes the IP change. Signing into your own account through a VPN tells that service precisely who you are. The address changed; the identity did not.

The VPN company is the whole question

Since you are handing one company the view your internet provider had, everything depends on whether that company keeps it. Four things are checkable, and they are what our privacy score is built from:

VPN	Based in	Last audit	RAM-only servers	Our score
Mullvad	Sweden	Assured, 2024	Yes	8.0/10
Proton VPN	Switzerland	Securitum, 2024	No	8.9/10
NordVPN	Panama	Deloitte, 2024	Yes	9.7/10
ExpressVPN	British Virgin Islands	KPMG, 2024	Yes	9.1/10
Surfshark	Netherlands	Deloitte, 2025	Yes	9.4/10
PIA	United States	Deloitte, 2024	Yes	8.3/10
Windscribe	Canada	Packetlabs, 2024	No	7.8/10
CyberGhost	Romania	Deloitte, 2024	Yes	8.1/10
PureVPN	British Virgin Islands	KPMG, always-on	No	8.4/10
IPVanish	United States	Leviathan, 2022	No	7.6/10

The strongest evidence is not on the table, because it cannot be scheduled. Mullvad's servers were seized by Swedish police in 2023 and nothing useful was found on them. Private Internet Access has been subpoenaed more than once and produced nothing. A no-logs claim tested by someone hostile is worth more than any audit, and the pages for each provider go through that record in full — are VPNs safe is the version that compares them side by side.

What a VPN does not do

Five things, and each one is sold as though it does.

It does not stop malware or viruses. Some providers bundle a blocklist that filters known-bad domains, which helps a little. The tunnel itself does nothing.

It does not stop phishing. If you type your password into a convincing fake, the VPN carries it there securely.

It does not stop tracking by companies you have accounts with. Google, Meta and every retailer you have logged into identify you by your account, not your address.

It does not protect against a data breach. When a company you use is breached, your data leaks from their systems. Where you were sitting when you signed up is irrelevant.

It does not make you anonymous. It makes you pseudonymous to the sites you have not identified yourself to, which is a much narrower and much more honest claim. For genuine anonymity the tool is Tor, with the speed cost that implies — the VPN vs Tor comparison sets out when each is right.

Things it gets confused with

Four tools that overlap in people's heads and barely overlap in practice.

	What it actually does	Where it differs
Private / incognito mode	Stops your browser saving history, cookies and form data on your device	Your provider, the network and the sites all see exactly what they would otherwise. It hides you from the next person to use your laptop, nothing more
A proxy	Changes the address a site sees, usually for one browser or app	Normally no encryption, so the network still sees every destination — the full comparison
Tor	Routes through three volunteer relays, none of which knows both ends	Genuinely anonymising, and slow enough that most people stop using it — when each is right
Antivirus	Inspects files and processes on your device	Operates where a VPN does not, on problems a VPN never touches. The two are complements, not alternatives

The incognito one causes the most trouble, because the browser's own wording implies more than it delivers. It is a local-history feature. It is not privacy from anyone outside the room.

What people actually use one for

Four jobs, in rough order of how often they are the real reason:

Watching something that is not available where you are. A streaming service shows the catalogue of the country your address is in, so a server in that country changes what you can watch. This is the most common reason people buy and the one providers compete hardest on — 14 services tested monthly, and the results move.

Keeping browsing away from an internet provider. In several countries providers may legally sell or retain browsing records. This is the use a VPN is genuinely, structurally good at, and what your ISP can still see covers exactly where the line falls.

Networks you do not control. Hotel, airport, café, a landlord's shared connection, a campus. You have no idea who runs them or what they log, and a VPN removes the need to care.

Torrenting. Your address is visible to every peer in a swarm without one. Is torrenting safe with a VPN is the honest version, including the four of ten providers that still offer port forwarding.

What it costs you

Two prices, and the one people notice is not the one they expect.

That range sounds alarming and mostly is not. 4K streaming needs 25 Mbps; the slowest of the ten still delivered 445. The cost you will actually feel is latency, which is what makes calls talk over each other and games feel spongy:

NordVPN+4 ms

Surfshark+6 ms

ExpressVPN+7 ms

Mullvad+8 ms

Proton VPN+9 ms

PIA+10 ms

PureVPN+11 ms

CyberGhost+12 ms

IPVanish+13 ms

Windscribe+14 ms

All ten are under 15 ms on a nearby server, which is imperceptible. The three-figure latencies people complain about come from connecting to a server on the other side of the world and leaving it there — the server location guide has the numbers, and our server picker will tell you which country you actually want.

The money is more straightforward, and more misleading:

VPN	2-year price	Money-back	Devices	Our score
PIA	$2.03/mo	30 days	Unlimited	8.3/10
Surfshark	$2.19/mo	30 days	Unlimited	9.4/10
PureVPN	$2.14/mo	31 days	10	8.4/10
CyberGhost	$2.19/mo	45 days	7	8.1/10
NordVPN	$3.39/mo	30 days	10	9.7/10
Proton VPN	$4.49/mo	30 days	10	8.9/10
ExpressVPN	$4.99/mo	30 days	8	9.1/10

Every one of these has a money-back guarantee and we have claimed all ten, so the real cost of finding out whether you want one is a few days of admin. What a VPN actually costs covers the renewal trap in full.

Telling a good one from a bad one

Four checks, in order of how much they tell you:

1. Has the no-logs claim been audited — and were the running servers examined, not just the policy? A document review is not the same thing.
2. Are the servers RAM-only? A machine that loses everything on reboot cannot hand over months of history.
3. Where is the company incorporated? Jurisdiction decides what it can be compelled to produce, whatever its policy says.
4. Does it leak? A VPN that is connected but sending your DNS to your provider has undone the main thing you bought it for. Our DNS leak test and WebRTC test each take a minute.

And one anti-check: free VPNs. Running servers costs money, so a free service is funded some other way — advertising, selling browsing data, or in several documented cases routing other people's traffic through its users' connections. Two of the ten we rate have genuinely usable free tiers backed by a paid business; free vs paid explains how to tell those apart from the rest.

Where to go from here

This page is the map. The detail lives in the pages it points at:

If you want	Go to
To decide whether to buy one at all	Is a VPN worth it
Exactly what it hides, and from whom	What does a VPN hide
To set one up and use it	How to use a VPN
To know whether yours is working	How to check if your VPN is working
Whether they are safe to trust	Are VPNs safe
The technology underneath	VPN protocols explained
A recommendation for your situation	The VPN finder, five questions

The one-paragraph version

A VPN puts everything you do inside one encrypted connection to a server run by a company you choose. Your internet provider and the network you are on stop being able to watch you; that company starts. The sites you visit see a different address, unless you log in, in which case they see you. It does nothing about malware, phishing or anything on your own device. Whether that is a good deal comes down entirely to whether the company you picked deserves the view you just handed it.