What Is a VPN? How It Works, What It Hides and Its Limits
Below: where to find services that use it in our rankings.
A VPN, short for virtual private network, is an app (or a built-in client in your phone or computer) that encrypts all traffic between your device and a VPN server, then forwards it from there. Websites see the server's address, your broadband company sees only scrambled data heading to one machine, and the café router sees ciphertext. Practically every strength and weakness of a VPN follows from that one arrangement.
How the tunnel works
After you tap connect, your device and the chosen server agree on encryption keys. Every packet gets locked on the device before it touches the local network. The server unlocks each one, swaps the source IP for its own and sends it onward; replies travel back the same way. Domain lookups (DNS) belong inside that tunnel too. If they escape it, the so-called DNS leak, your internet provider keeps logging every domain you open despite the encryption.
What it hides, and from whom
| Watcher | Without a VPN | With a VPN |
|---|---|---|
| Internet provider / mobile carrier | Domains, timestamps, data volume | One encrypted connection; timing and volume remain |
| Hotel, café or airport Wi-Fi operator | Domains, any unencrypted traffic | Encrypted data only |
| Websites | Your real IP and rough location | The VPN server's IP and its location |
| VPN provider | Nothing | Your real IP and the sites you reach |
The last row matters most: trust shifts from your internet provider to the VPN company.
What a VPN does not do
Sign into Gmail or a shop, and they know exactly who you are regardless of the IP. Cookies, tracking pixels and browser fingerprinting run untouched inside the encrypted stream. Malware downloads just as before, so the VPN is no antivirus. Full anonymity stays off the table: the provider can link your account and payment to your traffic. On public Wi-Fi, HTTPS already protects page contents, so the tunnel mainly fills the gap left by domain names and by pages that never moved to HTTPS.
What people actually use it for
- Untrusted shared Wi-Fi at hotels and airports.
- Keeping browsing records away from a home ISP.
- Reaching home-country services while travelling, or getting past blocks on school, office or national networks.
- Torrenting, where the swarm would otherwise see your real address.
- Remote work: staff connect to internal systems, site-to-site setups link office networks, and self-hosted servers let you reach your own home network.
Protocols and where they differ
| Protocol | Strength | Weak spot |
|---|---|---|
| WireGuard | Small codebase, fast, reconnects quickly | By default the server keeps the peer's IP in memory unless the provider adds a workaround |
| OpenVPN | Mature, runs over TCP or UDP, works almost everywhere | Heavy on CPU for phones and routers |
| IKEv2/IPsec | Built into most operating systems, solid on mobile | Fixed ports make it easy to block |
| PPTP | Simple to set up | Broken, obsolete encryption; avoid |
Networks that run deep packet inspection (DPI) spot standard protocols fast, so on censored networks you need a stealth or obfuscation mode that disguises VPN traffic as something else. For the standards behind IPsec, see the NIST guide to IPsec VPNs.
Downsides and risks
Every packet takes a detour, so speed drops, and distance plus server load decide by how much. Streaming platforms, banks and shops block known VPN addresses or greet you with CAPTCHAs. A dropped tunnel without a kill switch exposes your real IP, which is what the switch prevents by cutting all traffic until the connection returns. Using a VPN is legal in the UK, the EU and the US; some countries restrict or license VPN use, and anything illegal stays illegal through one.
How to judge a provider
The VPN firm ends up seeing what your ISP used to see, so its logging policy comes first. Anyone can write "no logs" on a landing page; an independent audit costs real money and lets outsiders read the servers. VPNRadarLab's main ranking scores 377 consumer VPNs, and only 35 of them back their no-logs claim with such an audit, while 44 admit to storing connection IP addresses. Next, confirm a working kill switch, protection against DNS leaks, support for WireGuard or OpenVPN, and where the company is registered. Price can wait. A proxy server covers one app and often skips encryption entirely, so it suits a single browser tab rather than a whole device.
FAQ
Is a VPN legal in the UK?
Yes. Illegal activity remains illegal with or without a tunnel; the tool itself breaks no law.
Can you be tracked while using a VPN?
Yes, through account logins, cookies and fingerprinting, and by the provider itself if it keeps records.
Do I need antivirus if I have a VPN?
Yes. Encryption in transit does nothing about a malicious file already on your disk.
Are VPNs free?
Of the 377 services in the ranking, 158 have a free plan. Free tiers usually cap data, speed or locations, and some are funded by ads or by selling user data.
Short answer
A VPN wraps your device's traffic in an encrypted tunnel to a provider's server, so sites see that server's IP while your ISP and local network go blind and the VPN company gains the view. Pick a provider by audited logging, a kill switch and modern protocols, and accept a modest speed loss as the cost.