VPN Basics for Beginners
What a VPN actually does, what it does not do despite the advertising, when it is genuinely worth using, and how to set one up sensibly.
VPNs are marketed with more hyperbole than almost any other consumer software, which makes it genuinely hard to work out what one does. The honest version is narrower than the advertising and more useful than the backlash suggests.
What it actually does
Normally, your device talks to websites through your internet provider. That provider can see every domain you connect to, and on any network you do not control — a café, a hotel, an airport — the operator of that network can see the same thing.
A VPN puts an encrypted tunnel between your device and a server run by the VPN provider. Your traffic is encrypted before it leaves your device, travels through that tunnel, and emerges at the VPN server, which forwards it on.
Two things change. First, the network you are sitting on can no longer see what you are doing — only that you are connected to a VPN server. Second, websites see the VPN server's IP address instead of yours, so they see the server's location rather than your own.
That is the whole mechanism. Everything a VPN can legitimately do follows from those two facts.
What it does not do
This is the part the advertising skips.
It does not make you anonymous. The moment you sign in to anything — email, a social network, a shop — that service knows exactly who you are, VPN or not. Browser fingerprinting and cookies identify returning visitors without needing your IP address at all.
It does not stop tracking. Advertising networks follow accounts and browser fingerprints, not IP addresses. A VPN barely touches this. Browser settings and content blockers do far more.
It does not protect you from malware or phishing. An encrypted tunnel to a malicious site is still a connection to a malicious site.
It does not add much on sites that already use HTTPS. Nearly all of the web is encrypted end-to-end now, so the "hackers on public Wi-Fi stealing your password" scenario is largely a period piece. What the network can still see is which sites you visit, and that is what a VPN hides.
It moves trust, it does not remove it. Your provider cannot see your traffic any more, but the VPN operator now sits in the same position. Choosing a VPN is choosing who you would rather trust.
When it is genuinely worth using
- On networks you do not control. Hotel, café, airport and conference Wi-Fi. You have no idea who runs them or what they log.
- Travelling. Some networks abroad interfere with traffic or block services. A VPN routes around that.
- To keep browsing away from your provider. Some providers sell aggregated browsing data. A VPN takes you out of that pool.
- To appear elsewhere. Accessing your own bank or government services from abroad, checking how a site looks in another country, or testing region-specific behaviour.
- On unmanaged home networks shared with people or devices you would rather not share a broadcast domain with.
Setting one up sensibly
Installation is deliberately unremarkable: download the app for your platform, sign in with the credentials your provider issued, choose a location, connect. Our setup guide covers Windows, macOS, iOS, Android, Linux and routers.
Three settings are worth finding straight away.
The kill switch blocks all traffic if the tunnel drops, so nothing escapes unencrypted in the gap. Without it, a brief reconnection can leak exactly the traffic you were trying to protect.
Auto-connect on untrusted networks means you do not have to remember. The moment you join unfamiliar Wi-Fi, the tunnel comes up.
Split tunnelling lets chosen apps bypass the VPN. Banking apps sometimes refuse VPN traffic outright, and local devices like printers need to be reachable on your own network.
Protocols, in one paragraph
WireGuard is modern, fast and the right default on almost every network. OpenVPN is older and slower but gets through restrictive networks that block other protocols — try it if WireGuard cannot connect on hotel or corporate Wi-Fi. IKEv2 reconnects fastest when a phone moves between Wi-Fi and mobile data, which makes it a good choice on the move. Pick WireGuard, and switch only when something does not work.
Speed, realistically
Encrypting traffic and routing it through another location always costs something. On WireGuard with a nearby server the loss is usually small enough to ignore. Connecting to a server on the other side of the world will always be noticeably slower, because physics is not negotiable.
If a VPN feels slow: pick a closer server, make sure you are on WireGuard, and test your speed with the VPN off so you know what the underlying connection is actually capable of.
A word about streaming
Streaming platforms actively detect and block VPN traffic, and which servers work with which services changes constantly. Any provider promising reliable access to a specific catalogue is promising something they cannot control. We sell VPN subscriptions for privacy on untrusted networks, and we do not guarantee any particular streaming service will work.
Where to start
If you are trying one for the first time, a one-month subscription is the low-risk way in. Install it, turn on the kill switch, set it to auto-connect on unfamiliar Wi-Fi, and see whether you notice it. If you do not — which is the intended outcome — the longer terms cost considerably less.