You've seen the ads. A sponsor read on every tech YouTube channel promises that a VPN will "stop hackers," "make you anonymous," and "keep you safe online." Most of that is marketing. A VPN is a genuinely useful tool with a narrow, well-defined job — and understanding that job is the difference between spending $60 a year on real protection and spending it on a false sense of security.

Here's the honest version, without the affiliate-link enthusiasm.

What a VPN actually does

A VPN (virtual private network) creates an encrypted tunnel between your device and a server run by the VPN provider. Your traffic goes into that tunnel, pops out at the provider's server, and continues to its destination from there.

That changes exactly two things:

The local network can't read your traffic. Whoever runs the Wi-Fi — the coffee shop, the airport, your ISP — sees an encrypted stream to one VPN server. They can't see which sites you visit or what you send.
The destination sees the VPN's IP, not yours. Websites log the exit server's address instead of your home or mobile IP.

That's the whole product. Everything else marketed around a VPN is either a side effect of those two facts or an outright exaggeration.

The mental model: a VPN moves trust, it doesn't remove it

This is the single most important idea, and almost no ad mentions it.

Without a VPN, you trust your ISP and the local network operator to carry your traffic without snooping or tampering. With a VPN, you take that trust away from them and hand it to the VPN provider instead. Your traffic still exits somewhere, and whoever runs that exit point can see the same metadata your ISP used to see: which servers you connect to, when, and how much.

So the real question isn't "does a VPN hide my traffic?" It's "do I trust this VPN company more than I trust my ISP or this airport Wi-Fi?" Sometimes the answer is clearly yes. Sometimes — a sketchy free VPN app funded by selling user data — the answer is emphatically no, and you've made things worse.

What a VPN does not protect

A tunnel protects data in transit between you and the exit server. It does nothing about what happens at either end.

Malware. Download and run a trojan and the VPN faithfully encrypts its traffic to the attacker's server. The tunnel doesn't inspect payloads.
Phishing. Type your password into a convincing fake login page and the VPN encrypts that delivery perfectly — straight to the attacker. The tunnel has no idea the site is fake.
Logged-in tracking. If you're signed into Google, Meta, or Amazon, they know it's you regardless of your IP address. Account identity beats IP every time.
Browser fingerprinting. Your screen size, fonts, timezone, and GPU form a signature that follows you even after you switch VPN servers. That's a separate tracking problem the tunnel does nothing about.
The endpoint. A VPN protects the wire, not the person on the other side. Whoever receives your message — and whatever service ultimately stores it — sees plaintext.

That last point matters more than people realize. HTTPS already encrypts the content of your traffic end to end. On any modern site, your ISP could only ever see the domain you connected to, not the pages or form data. So the incremental privacy a VPN buys on top of HTTPS is mostly hiding which domains you visit from your ISP — real, but narrower than the ads suggest.

When you actually need one

There are legitimate, concrete reasons to run a VPN:

Untrusted networks. Hotel, airport, conference, and cafe Wi-Fi are worth tunneling out of — not because HTTPS is broken, but because you don't control the network and DNS-level snooping is trivial there. We wrote up the specific threats in the dangers of public Wi-Fi.
Hiding browsing from your ISP. In some countries ISPs legally sell browsing histories. A VPN moves that visibility to a provider you chose.
Bypassing censorship or geo-blocks. Reaching a blocked news site or a service that isn't available in your region.
Separating your IP from an activity where linking the two would put you at risk — journalism, research, activism.

Notice what's not on that list: "general safety," "stopping hackers," and "becoming anonymous."

Common mistakes

Trusting free VPNs. Running a global server network costs real money. If you aren't paying, your data or bandwidth usually is the product. A free VPN is often a worse privacy deal than no VPN.

Believing "no-logs" claims on faith. A no-logs policy is a promise, not a technical guarantee. The ones worth trusting have survived a subpoena with no data to hand over, or published an independent audit. Marketing copy alone isn't evidence.

Thinking a VPN makes you anonymous. It changes your IP. It does not clear cookies, log you out of accounts, or defeat fingerprinting. Anonymity is a much harder problem — Tor territory, not a consumer VPN. If you assumed incognito mode covered this, read incognito mode myths.

Leaving verification to vibes. Curious what you're actually exposing right now — IP, DNS, headers? Run a quick privacy check with the VPN off, then on, and compare. Measuring beats assuming.

Where the tunnel ends and encryption begins

Here's the gap a VPN can't close. Suppose you're on a trusted VPN and you paste an API key or a database password into Slack, email, or a Google Doc. The tunnel protected that key on its way to the server — and then the server stored it in plaintext, forever, readable by the platform and anyone who later breaches it. The VPN did its job and the secret still leaked.

A VPN secures transport. Sensitive content needs end-to-end encryption that the destination itself can't read. That's a different tool. When you have to actually hand someone a credential, encrypt it so only the recipient can open it, on a link that self-destructs after one read — the approach we detail on the security page. The tunnel and the payload are two separate layers, and you want both.

Quick FAQ

Do I need a VPN at home on my own Wi-Fi? For security, no — HTTPS already covers content. For privacy from your ISP, maybe. It's a preference, not a necessity.

Does a VPN protect my passwords? In transit, HTTPS already does. It does nothing about weak passwords, phishing, or a breach at the service. Use a manager and unique passwords instead — a strong password generator is the higher-leverage fix.

Should it be always-on? On untrusted networks, yes. Everywhere else, it's a trade-off between marginal privacy and the trust you're placing in the provider.

Is a VPN enough by itself? No. It's one layer. Endpoint hygiene, unique passwords, 2FA, and encrypting the sensitive things you actually send matter more.

A VPN is a privacy tool with a specific job, not a security cure-all. Use it where it fits, and don't let it lull you into skipping the layers it was never designed to cover.

When the thing you're sending is a password, key, or file, don't rely on the tunnel — encrypt the payload itself. Share it as a self-destructing, end-to-end-encrypted link so even the server can't read it.