What is a VPN? How it works, benefits and limits

1. You read an article in a café

On your own device, you open a news website over HTTPS. That is an encrypted connection between your browser and the website. The café cannot simply read the article content or your transmitted password. This is true without a VPN too.

A VPN, short for “virtual private network”, adds an encrypted tunnel to another network. One use is reaching a company network while away from the office. Our example shows another use: visiting a public website through a VPN server.

2. Without a VPN: who sees what?

The café network and internet provider see connections to destination IP addresses, their timing and the amount of data. The website’s name can often be identified too. Whether it is directly visible depends on the connection and settings. That is different from the exact article page or its content.

The website sees your internet connection’s public IP address: the café’s address in this case. It knows which article you request from it. If you sign in, it can link the visit to your account.

3. With a VPN: trust moves along the route

For traffic routed through the VPN, the café first sees a connection to the VPN server, along with its timing and the amount of data. The destinations beyond it are hidden in the tunnel. The related name lookups must travel through it too: these translate website names into network addresses.

The VPN provider sees your incoming public IP address and the outgoing destination IP addresses. Website names can often be identified too. It can link connections by their timing and record such data. The VPN provider is now the additional party you trust.

The website usually sees the VPN server’s IP address. Your IP address changes for this connection; your account or browser does not automatically become a different one. This explanation only covers traffic actually routed through the VPN.

4. HTTPS remains a separate layer

In the picture, the HTTPS band reaches from browser to website. The shorter VPN tunnel ends at the VPN server. Properly working HTTPS protects the transmitted article content, exact page path and form entries from the VPN provider too.

Without HTTPS or another separate encryption layer, that protection is missing after the VPN server. Equally, HTTPS does not automatically make a website trustworthy: it can read what you send to it. Encryption protects the journey, not against every misleading promise a website makes.

5. A different IP is not a fresh start

A login means signing in to an account. If you are signed in to the news website, it is still the same account after you turn on the VPN.

Cookies are small pieces of stored data that your browser can send back to a website. They can contain an identifier that helps the website recognise the browser. A VPN tunnel does not delete this data.

Browser features such as language or screen size remain too. Websites can combine several features to recognise browsers, a method called fingerprinting. This is not certain proof of which person is using the device.

6. VPNs and Tor do different jobs

A VPN connects you to another network, whose operator you trust. Tor spreads a connection across several relays. On the usual route to a public website, no single relay knows both your original IP address and the destination.

The Tor Project does not recommend VPN plus Tor as the standard setup for beginners. Combining them requires experience; an incorrect setup can weaken protection. Neither a VPN nor Tor guarantees anonymity. Signing in still tells the visited website which account you use.

7. Check your understanding

You turn on the VPN in the café and stay signed in to the news website. Does the website now lose track of your account? No: the IP address may change, but the login remains.

Does that let the VPN provider read your password sent over HTTPS? Not with properly working HTTPS. But it can still see connection data. That is the useful distinction: content, connection data and recognition are three different things.

Do I need a VPN at all?

Start with a task rather than an advertisement. Access to your company network may require its VPN. A public HTTPS page already encrypts its content; additional needs concerning connection metadata are a separate question.

Check who operates a provider, what connection data it retains and what published audits actually examine. “No logs” starts as a claim. An audit of a particular app version does not automatically answer every question about the servers.

What do kill switch and split tunneling mean?

A kill switch is meant to block connections if the VPN tunnel fails. Whether it works, and for which connections, depends on the product and configuration. The name alone is not proof.

Split tunneling means only selected apps or destinations use the tunnel. For example, company access uses the company VPN while another request goes directly. “VPN on” therefore does not prove that every app communicates through it.

Which question does each tool answer?

HTTPS: can outsiders read content in transit? VPN: which other network does my connection use, and whom do I trust? Tor: how can knowledge of source and destination be distributed across several relays?

Reading a recipe in a café, accessing a company network and researching a personal question may call for different choices. None of these tools replaces deciding what information you willingly send to whom.