What you'll learn
Quick Answer
A VPN encrypts your traffic to a server and sends it onward from there, so your network sees only the tunnel and the destination sees the VPN's address. It shifts who can observe you rather than making you anonymous.
How it works
Normally your traffic goes from your device, through your network and internet provider, to the destination. Anyone along that path sees which servers you connect to, and — without HTTPS — the contents.
With a VPN, your device establishes an encrypted tunnel to a VPN server. All traffic goes through that tunnel, and the VPN server forwards it on.
The result:
- Your local network and ISP see an encrypted connection to the VPN server, and nothing about what is inside it.
- The destination site sees a connection from the VPN server's address, not yours.
- The VPN provider sees everything your ISP used to see.
That last point is the one marketing understates. You have not eliminated an observer — you have chosen a different one. Whether that is an improvement depends entirely on whether you trust the VPN provider more than your ISP.
Corporate VPNs: a different purpose entirely
The original use, and still the most common in professional settings.
A company has internal systems that should not be exposed to the internet — internal applications, databases, admin panels. Rather than opening them publicly, they are reachable only from the corporate network.
A VPN extends that network to remote employees. Connect, and your device behaves as though it is inside the office network, so internal addresses resolve and internal services are reachable.
This is about access, not privacy. The goal is reaching protected resources, and the encryption is a means to that end. It is also why company VPNs often route only internal traffic — split tunnelling — leaving your ordinary browsing on your normal connection.
The developer equivalent at small scale is an SSH tunnel, which achieves the same thing for one service without any VPN infrastructure.
Consumer VPN claims, examined
"Protects you on public wifi." Partly true and much less relevant than it was. When most traffic was unencrypted HTTP, café wifi was genuinely dangerous. Now that nearly everything is HTTPS, an attacker on the same network already cannot read your traffic — see HTTP vs HTTPS. A VPN additionally hides which sites you visit from that network, which is a real but smaller benefit.
"Makes you anonymous." No. Sites identify you by your logged-in account, cookies and browser fingerprint, none of which change with your IP address. Logging into an account over a VPN identifies you completely.
"Hides your browsing from your ISP." True, and it is the clearest genuine benefit. Your ISP sees only a connection to the VPN.
"No logs." Unverifiable by you. Some providers have had these claims tested in court and some have been contradicted. Treat it as a promise, not a property.
Changing apparent location works, and is the reason many people actually use one.
What a VPN does not do
- It does not protect against malware. Downloading something harmful through an encrypted tunnel delivers it just as effectively.
- It does not stop phishing. A convincing fake login page works identically over a VPN.
- It does not secure a badly built application. Encryption in transit says nothing about how a service stores your data.
- It does not defeat account-based tracking. Signed in is signed in.
- Free VPNs frequently make things worse. Running a VPN service costs money; if you are not paying, the business model is usually selling the data you routed through it — which is precisely what you were trying to avoid.
A VPN moves trust rather than eliminating it. The honest question is never "is a VPN secure" but "do I trust this provider more than my current network".
What developers actually use them for
Beyond corporate access, a few genuinely useful cases:
- Reaching a private database or internal service without exposing it publicly. Frequently an SSH tunnel is simpler.
- Testing geographic behaviour — how a site behaves from another country, for CDN or localisation work.
- Restrictive networks. College and office networks that block ports or protocols you need.
- Self-hosted access to your own network — WireGuard is small, fast and straightforward to run, and it is a genuinely good weekend project for understanding networking.
WireGuard is worth knowing by name: a modern protocol with a small enough codebase to be audited properly, and simple key-based configuration. Setting one up teaches you more about routing and NAT than reading about them.