What is a VPN, and how does it work?
What is a VPN? A VPN, or virtual private network, is an encrypted connection between your device and a VPN server. Your internet traffic travels through that tunnel, so the network you’re on and your internet provider can’t read it, and websites see the VPN server’s location instead of yours.
The short version
- A VPN routes your traffic through an encrypted tunnel to a server run by your employer or a VPN service.
- It hides your traffic from your internet provider and the local network owner, such as a coffee shop or hotel, and hides your IP address from websites.
- It doesn’t make you anonymous. The VPN provider can see the traffic your internet provider no longer sees.
- Windows, macOS and Android have VPN settings built in, but you still need connection details or an app from your employer or VPN service.
- Free VPNs have to make money somehow. The Electronic Frontier Foundation (EFF) warns that some sell your data.
What is a VPN, in plain terms
The US National Institute of Standards and Technology (NIST) defines a VPN as “a virtual network built on top of existing physical networks that can provide a secure communications mechanism” for data sent between networks or devices. The UK’s National Cyber Security Centre (NCSC) puts it more simply: “VPNs are encrypted network connections.”
There are 2 common kinds. A work VPN connects you to your company’s network from outside the office. A consumer VPN service, usually installed as an app, sends your everyday browsing through the provider’s servers. Microsoft says a VPN can be used for either work or personal purposes.
How does a VPN work?
When you turn on a VPN, your device first connects to a VPN server. According to the EFF, the VPN then “routes all your web traffic through an ‘encrypted tunnel’ between your devices and the VPN server.”
That has 2 effects:
- Your traffic is unreadable on the way to the VPN server. Mozilla says a VPN encrypts traffic “between you and your VPN provider,” so other people on the same network can’t read it.
- Websites see the VPN server, not you. The EFF says that “from a website’s point of view, it appears your location is wherever the VPN server is.” Mozilla says a VPN also conceals your IP address.
The NCSC notes that “only traffic which is routed over the VPN will be protected by it,” and warns that split tunneling increases the risk that sensitive data will be exposed to an unprotected network.
What a VPN hides, and what it doesn’t
Here’s who can see what, based on the EFF’s guidance:
| Who | With a VPN turned on |
|---|---|
| Your internet provider | Can’t see your outgoing traffic |
| The local network owner (coffee shop, hotel) | Can’t see your outgoing traffic |
| Websites you visit | See the VPN server’s location instead of yours |
| The VPN provider | Can see your browsing data |
The EFF says “a VPN is not a tool for anonymity” and that while a VPN hides your browsing from your internet provider, “it’s all visible to the VPN provider.”
A VPN also doesn’t make a scam website safe. The US Federal Trade Commission (FTC) warns that if you visit a scammer’s website, your data may be encrypted on its way there but “it won’t be safe from scammers operating the site.” See our guide to spotting phishing.
The EFF says that in many cases a VPN isn’t the most important security step to take, and it lists two-factor authentication among the steps that matter more.
Do you need a VPN?
For work
If your employer gives you a VPN, use it. Microsoft says a VPN can help provide a more secure connection and access to a company’s network.
On public Wi-Fi
The FTC says that “most websites do use encryption to protect your information” and that, because encryption is so widespread, “connecting through a public Wi-Fi network is usually safe.” Mozilla, which sells a VPN, takes a more cautious view: it calls public Wi-Fi “a risky endeavor” because you can’t be sure someone else on the network isn’t snooping.
For privacy from your internet provider
Mozilla notes that your internet provider “can track and share your online activities,” and that a VPN can prevent that by encrypting your traffic to the VPN provider. The trade-off, as the EFF points out, is that the VPN provider now sees that data instead, so the provider you choose matters.
Free vs paid VPNs
The EFF says some VPNs “can be entirely free, but sell your data,” while freemium services are free to join and charge once you pass a data cap. Mozilla also says some VPNs log your online activity to sell it to marketing firms.
The EFF suggests asking these questions before you pick a VPN:
- How does it make money? A VPN that doesn’t sell its service still has to stay in business.
- What does its privacy policy say about logs? The EFF says a provider might log your data if its policy doesn’t specifically rule that out, and that even a no-logging claim “is not a guarantee of good behavior.”
- Has it been audited? Some providers publish the results of third-party security audits.
- Does it publish transparency reports? These tell users whether the company has received requests for their information.
- Where does it do business? The EFF says to note the countries a provider operates in.
The EFF also warns that an app’s presence in an official app store doesn’t make it safe.
VPN types: IPsec, IKEv2, TLS and WireGuard
These are the VPN types you’ll see in device settings and VPN apps:
- IPsec and IKEv2. Apple describes IPsec as a set of security protocols and IKEv2 as a protocol that sets up a security association in IPsec. The NCSC recommends IPsec for VPN access and notes it’s built into many operating systems, though some networks restrict or block IPsec traffic.
- TLS VPNs. The NCSC says these usually need a third-party client and server and can be more reliable when passing through network address translation (NAT) devices.
- WireGuard. Its developers describe it as a “simple yet fast and modern VPN” that aims to be simpler than IPsec and “considerably more performant than OpenVPN.” It runs on Windows, macOS, BSD, iOS, Android and Linux.
For a work VPN, use the type your IT team specifies.
How to use a VPN on Windows, Mac and Android
Each system needs connection details from your employer or VPN service before you can connect. Google notes that on Android you may need to install a VPN app instead, and Microsoft says to check a personal VPN service’s website or app for its settings.
Windows 11
- Open Settings and go to Network & internet > VPN > Add VPN.
- Set VPN provider to Windows (built-in), then enter a Connection name and the Server name or address.
- Choose the VPN type and Type of sign-in info your company or VPN service uses, then select Save.
- To connect, select the Network, Volume, Battery icon on the taskbar, then VPN. Microsoft says “Connected” appears under the VPN’s name when it’s on.
Mac
- Choose Apple menu > System Settings, then click Network in the sidebar.
- Click the Action pop-up menu, choose Add VPN Configuration, then choose your VPN type.
- Enter a name in the Display Name field, fill in the settings from your administrator or provider, then click Create.
- Use the VPN status menu in the menu bar to connect.
Android
- Open Settings and tap Network & internet > VPN. If you can’t find it, search for “VPN.”
- Tap the add icon at the top right, enter the details from your administrator and tap Save.
- To connect, tap the VPN, enter your username and password and tap Connect. If the VPN uses an app, the app opens instead.
Android has an Always-on VPN switch in each VPN’s settings, though Google says it isn’t available for VPNs set up through an app. Some steps need Android 14 or later.
Frequently asked questions
Is a VPN worth it?
For work, yes, if your employer requires one. For personal use, it helps if you want to keep your browsing from your internet provider or a network you don’t trust, and you’re comfortable trusting the VPN provider instead. The EFF says that in many circumstances a VPN isn’t the most important security step.
Does a VPN slow down your internet?
It can. Mozilla says some VPNs can slow you down or restrict your bandwidth, so speed depends partly on which provider you choose.
Can a VPN be tracked?
Yes. The EFF says VPN providers are subject to law enforcement requests and that many save as much information as internet providers do. A VPN hides your IP address from websites, but it doesn’t hide your activity from the VPN company.
What is the difference between a VPN and a proxy?
Mozilla says a web proxy only protects what you do in your browser. A VPN, by contrast, protects all your traffic, including your browser, on any device where it’s installed and turned on.
Is there a free VPN on Android phones?
Google says Pixel 7 and later phones and the Pixel Tablet include a built-in VPN by Google at no extra cost where the service is available. On other phones, check with the manufacturer or use a VPN app, keeping the EFF’s questions above in mind.
More in Security
- What is a passkey, and how do you use one?
- What is phishing? How to spot a phishing email or text
- What is two-factor authentication, and how do you turn it on?