A VPN makes you completely anonymous online. It’s the single most repeated claim in every VPN ad you’ve ever scrolled past, and it isn’t true. Understanding how a VPN works — what it actually hides, and what it doesn’t — matters more than picking a brand name, especially now that VPN use has spiked for reasons that have nothing to do with coffee-shop Wi-Fi. Here’s what a VPN really does, where its limits are, and when it’s genuinely worth turning one on.
What a VPN Does
As Cloudflare’s own explainer puts it, a VPN (virtual private network) routes your internet traffic through an encrypted tunnel to a server run by the VPN provider before it reaches the wider internet. Two things follow from that. First, anyone sitting between your device and that server — your internet provider, or someone else on the same network — sees only encrypted traffic, not what sites you’re visiting or what’s in it. Second, the websites you visit see the VPN server’s IP address and location instead of your own, which is why VPNs are commonly used to appear as though you’re browsing from a different country.
That’s genuinely useful, and it’s the whole feature set. It’s not a cloak of invisibility — it’s an encrypted relay with a different exit point.
What a VPN Doesn’t Protect You From
This is where most of the marketing overpromises. A VPN doesn’t stop websites from tracking you through cookies, your account logins, or browser and device fingerprinting — all of that keeps working exactly as before, VPN or not. It won’t protect you from malware, phishing, or a scam you click into yourself. And the “protect yourself on public Wi-Fi” pitch is weaker than it used to be: the vast majority of websites now use HTTPS encryption by default, which already protects your traffic in transit whether or not you’re on a VPN. A VPN adds a layer on an open network, but it isn’t rescuing you from a threat that’s anywhere near as common as it was a decade ago.
There’s also a live, current example of VPNs being oversold as a fix: as various regions roll out age-verification laws for adult content and some social platforms, some people reach for a VPN to route around them. As the Electronic Frontier Foundation has documented, this often doesn’t hold up in practice — enforcement varies by region, sites can and do block traffic from known VPN IP ranges instead of exempting them, and a VPN was never built to function as an identity or age-verification bypass tool in the first place.
When It’s Genuinely Worth Using One
A VPN earns its place in a few specific situations: when you want your traffic to look like it’s coming from a different country for a legitimate reason (accessing your own accounts while traveling, for instance), when you specifically don’t want your internet provider building a browsing profile tied to your home connection, or when you’re on a network you genuinely don’t trust and want an extra layer beyond HTTPS. It’s a useful, narrow tool — not a general-purpose security fix, and not a replacement for the basics that actually stop most attacks: a password manager, passkeys where they’re offered, and knowing how to spot a phishing attempt before you click it.
Free vs. Paid, and What to Watch For
A VPN service has to make money somehow, and if you’re not paying for it, that’s worth pausing on. Some free VPNs fund themselves by logging and selling the same browsing data a VPN is supposed to hide from your ISP — which defeats the point entirely. Paid options aren’t automatically trustworthy either, but a subscription model at least removes the most obvious incentive to monetize your traffic. Before trusting any provider, it’s worth checking three things: whether they’ve published the results of an independent security audit, which country’s laws they operate under (since that determines what a government can legally compel them to hand over), and whether their no-logging claims have actually held up when tested, rather than just being a marketing line.
Choosing One If You Decide You Need It
Beyond price, look for a provider with a track record — one whose founders and security practices are public rather than anonymous, and one that’s been independently audited rather than just claiming to be secure. Being available in an app store isn’t proof of anything on its own; plenty of low-quality or data-harvesting VPN apps pass app store review. And pair whatever VPN you choose with the fundamentals it can’t replace, since strong unique passwords and staying alert to phishing links stop far more real-world attacks than a VPN ever will. If security software in general is on your radar, our roundup of antivirus software worth using covers the layer that actually catches malware, which a VPN doesn’t touch.
FAQs
Does a VPN make me anonymous online?
No. A VPN hides your IP address and encrypts your traffic from your internet provider, but websites can still track you through cookies, account logins, and device fingerprinting regardless of whether a VPN is running.
Do I need a VPN for public Wi-Fi?
Less than you’d think. Most websites now use HTTPS by default, which already encrypts your traffic on public networks. A VPN adds a modest extra layer, but it’s no longer the critical protection it was before HTTPS became the norm.
Can a VPN get around age-verification requirements on websites?
It’s an increasingly unreliable workaround. Enforcement differs by region, and many sites now detect and block traffic from known VPN server ranges rather than treat it as a valid location. VPNs also were never designed to function as identity or age-verification tools.
Are free VPNs safe to use?
Some are, but many free VPN services cover their costs by collecting and selling the browsing data they’re supposed to protect, which undermines the reason to use one at all. Checking a provider’s business model and any independent audits matters more than whether it’s free or paid.
Will a VPN protect me from viruses or phishing scams?
No. A VPN only encrypts your connection and masks your IP address — it does nothing to block malware or stop you from clicking a malicious link. That protection comes from antivirus software and being able to recognize a phishing attempt yourself.
Discussion about this post