What Is a VPN?
A VPN builds an encrypted tunnel between your device and a server you choose, so the network in between carries ciphertext. What that hides, and what it does not.
A VPN is an encrypted tunnel between your device and a server you choose. Your traffic leaves your device looking like ciphertext heading to that one server; the server decrypts it and makes a second, separate connection to wherever you actually wanted to go. The network in between can see that one connection instead of seeing your browsing.
Short answer#
A VPN changes three things and leaves the rest of the problem alone.
It hides the contents of your traffic from the network between you and the server.
Your destination is hidden from that network too, which sees one remote address instead of every site you visit.
Every site you reach sees a different IP address, because the destination sees the server, not you.
What it does not change: what websites know about you through your accounts, what you do on the connection, whether the tunnel is visible to a network that is looking for tunnel traffic, and the fact that one party, whoever operates the server, can see both ends.
The mechanism#
Three parts, and the middle one is the point.
A client on your device captures the traffic you want protected.
A tunnel carries it to the server. It is encrypted end to end, so nobody in between can read it or change it without the change being detected. WireGuard, for example, sends all of its packets over UDP and derives session keys from the Noise IK handshake, with an optional pre-shared key mixed in. OpenVPN takes the same overall shape, running its layer 3 tunnel over TLS.
A server decrypts it, then originates a fresh connection to the destination on your behalf.
The consequence is that your ISP, the café router, or a national network sees this:
you ⟶ encrypted tunnel ⟶ VPN server ⟶ websites
instead of this:
you ⟶ wikipedia.org, github.com, your bank, …
The metadata does not disappear; it moves to the far end of the tunnel. That is what a tunnel is, not a flaw in the design.
What a VPN changes#
Your address, as seen by destinations: every site receives the server’s address. Two consequences follow, and they point in opposite directions. Geolocation and IP-based rate limits stop working on you, and services that flag or block known VPN ranges start flagging you.
The contents of your traffic, from anyone on the local path.
Your destination list, from anyone on the local path.
Traffic from the local network to you, in one direction: replies arrive from one address instead of many, which removes a mapping you might rather not have exposed.
What a VPN does not change#
Your accounts. You are logged in to your email, your bank, your social network. Every one of those services identifies you exactly as it did before. This is the point at which most “anonymous VPN” claims stop.
The site you are visiting, once you get there. The destination receives a request from the tunnel; everything about how you behave inside it is unchanged.
What is in the tunnel. A tunnel protects the transport. It does not make a malicious download safe, and it does not make a convincing phishing page less convincing.
Whether anyone can tell there is a tunnel. A VPN is a recognisable thing on the wire. Networks that are looking for VPN traffic can find it, which is a topic of its own and the reason censorship-resistant protocols exist.
Whether the tunnel operator is trustworthy. A tunnel that hides you from your ISP necessarily exposes you to the operator. There is no configuration that removes this, because the operator has to be able to read the data to forward it.
Who can still see what#
| Observer | Without a VPN | With a VPN |
|---|---|---|
| Your ISP | your IP, your DNS lookups, every destination, all timings | your IP, the VPN server’s address, and the size and timing of your traffic |
| The café or campus network | everything your ISP sees | the same, since encryption begins at your device |
| The VPN operator | nothing — they are not on the path | your IP, your timings, your destinations, unless they do not log |
| Every website you visit | your IP, your accounts, your behaviour | the server’s IP, your accounts, your behaviour |
| A network looking for censorship | your destinations, in cleartext | the tunnel, if it recognises it |
Read that table as a relocation of risk rather than a reduction. The row that matters is the third one.
Self-hosted or commercial#
This is the decision with the largest effect on that table, and it is not primarily about price.
Self-hosted means you operate the endpoint. Nobody sits between you and the exit. Nobody has your metadata, because there is no second party to hold it. In exchange, the server is yours to patch, monitor, place in a jurisdiction you trust, and keep out of abuse blacklists, which are the operational tax most people underestimate, because one complaint about your server can cost you an address range.
Commercial means someone else runs the infrastructure, keeps it patched, holds many locations, and handles the operational work. In exchange you are trusting an organisation with your metadata, and the strength of that trust depends on its jurisdiction, its logging policy, and whether anyone has independently checked.
There is a third option, between them: paying for infrastructure you operate yourself, hosted with a provider that does not know who is using it. It removes the commercial logging question without taking on server administration.
Common misconceptions#
“A VPN makes me anonymous.” It does not. It gives you privacy from your network, and it introduces a party who can see both ends. Privacy versus anonymity covers that difference properly, and VPN, proxy or Tor puts the alternatives side by side.
“A VPN is just encryption.” The encryption is how the tunnel is protected, but the tunnel is what changes the shape of your traffic. Anyone who can see that you have a persistent encrypted connection to a single address already learns a great deal, because metadata survives inside the tunnel too.
“It hides me from my government.” It hides your destinations from your network. Depending on where the server is and who runs it, the destination may now be visible to a different government, and to the operator.
“Free VPNs are fine because I have nothing to hide.” A free service has costs to recover, and the cheapest currency is your metadata. Nothing here says every free VPN is dishonest. The reason to ask is what the operator is selling and how you know.
“More locations is always better.” Location matters for latency and for reaching a service that blocks certain ranges. It does not change the trust question, and a server in a friendly country with an operator under a hostile jurisdiction is not a contradiction the number of locations resolves.
Related#
- What Does Your ISP See? — the list this article is answering
- Privacy vs Anonymity — what a tunnel gives you, and what it does not
- VPN vs Proxy vs Tor — how a tunnel compares with the other two tools
- What Is Internet Censorship? — the reason a tunnel stops being enough
- What Is a VPN Protocol? — the specification behind the tunnel in this article
Sources
Last reviewed October 7, 2026. Corrections and additions are welcome.