What Is a VPN and Does It Keep You Safe Online?

Issue type: Tech explainer — understanding what a VPN actually does, how it protects your connection, and what threats it cannot defend against

Short answer: If you are asking what is a VPN and does it keep you safe, the honest answer is: partly. A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a server in another location, hiding your real IP address from websites and encrypting your traffic from your ISP. It does not make you anonymous, does not protect you from malware or phishing, and does not prevent websites from tracking you through browser fingerprinting or cookies. It’s a privacy tool with specific, limited use cases — not a complete security solution.

What is a VPN and does it keep you safe?

Before using a VPN, understand which problem you’re actually trying to solve — because a VPN is the right tool for some of these and the wrong tool for others:

Your ISP can see connection metadata and, unless DNS is encrypted, many domain lookups: A VPN reduces this visibility. Your ISP mainly sees an encrypted connection to the VPN server, not your direct traffic to each site. The VPN provider becomes the party you trust instead.

You’re on public Wi-Fi and worried someone might intercept your data: A VPN adds a useful protection layer. HTTPS already encrypts most modern websites, but a VPN hides more local-network metadata and helps protect traffic that is not otherwise encrypted.

A website or streaming service is blocked in your country: A VPN may bypass this by routing traffic through a server in a different country — though many streaming services actively block known VPN IP ranges.

You want to be completely anonymous online so no one can ever trace you: A VPN does not fix this. Your VPN provider sees your real IP, your accounts identify you, and your browser leaves a fingerprint. A VPN is privacy, not anonymity.

You downloaded malware and want to remove it: A VPN does nothing for this. You need antivirus software.

What to do first

1. Understand what a VPN technically does to your connection. When you connect to a VPN, your device establishes an encrypted tunnel to a VPN server. All your internet traffic travels through that tunnel — encrypted — to the VPN server, and exits from there to the actual destination. Websites see the VPN server’s IP address, not yours. Your ISP sees encrypted data going to the VPN server, not the sites you visit. The VPN provider sees your traffic instead of your ISP. This is the fundamental trade-off: you’re shifting trust from your ISP to your VPN provider. Cloudflare’s explainer on what a VPN is breaks down the tunnel model and how VPN routing changes what networks and websites can see.
2. Understand what a VPN cannot protect you from — this is what most users get wrong. A VPN does not protect you from: malware or viruses (use antivirus), phishing attacks that steal your passwords (use 2FA), websites tracking you via cookies or browser fingerprinting (use a tracker blocker), data breaches where a service you use is hacked (use unique passwords and a password manager), or surveillance by your VPN provider itself (they can log your activity). A VPN specifically and only encrypts the path between you and their server. Everything outside that path, and everything about your accounts and browser identity, is unchanged.
3. Choose a VPN based on trust and technical standards — not marketing claims. The key factors: a strict no-log policy that has been independently audited (not just claimed), the use of WireGuard or OpenVPN protocol (faster and more secure than PPTP or L2TP), jurisdiction outside Five Eyes countries for maximum legal privacy protection, and a kill switch that blocks all traffic if the VPN drops. Avoid free VPNs — they typically monetize by selling your data, which defeats the purpose. Paid options with verified no-log audits include Mullvad, ProtonVPN, and NordVPN. Cloudflare’s WARP (based on WireGuard) is another option for general privacy: Cloudflare WARP documentation.
4. Set up a VPN on Windows 11 correctly. Most commercial VPNs provide a dedicated app — download it from the provider’s official website only. Install it, log in, and select a server. For basic privacy: choose a server in your own country for minimum latency. For accessing geo-blocked content: choose a server in the target country. After connecting, verify the VPN is working: visit whatismyip.com and confirm the IP address shown matches the VPN server’s country, not your real location. If your real IP still shows, the VPN tunnel isn’t active. Windows 11 also has a built-in VPN client under Settings > Network & internet > VPN — useful for connecting to corporate VPNs using IKEv2 or L2TP protocols.
5. Enable the kill switch and check for DNS leaks. A VPN kill switch cuts all internet access if the VPN connection drops — preventing your real IP from being exposed during brief connection interruptions. Enable it in your VPN app’s settings. Then test for DNS leaks: with the VPN connected, visit dnsleaktest.com and run the extended test. If the DNS servers shown are from your ISP rather than your VPN provider, your DNS queries are leaking outside the encrypted tunnel — your VPN is not fully protecting your browsing history. Fix this in the VPN app’s settings under DNS or Advanced options, and set DNS to the VPN provider’s servers or a trusted resolver like 1.1.1.1. For context on why DNS matters, the fix for Ethernet connected but no internet demonstrates how DNS errors break the entire browsing experience independently of your physical connection.
6. Know when to turn the VPN on and off. Always on: when using public Wi-Fi, when accessing sensitive accounts on untrusted networks, when your ISP throttles streaming traffic, or when accessing region-restricted content. Can turn off: at home on a trusted network when using services that block VPNs (some banking apps, streaming services, game servers), or when you need maximum connection speed for latency-sensitive tasks. A VPN adds 10–50ms of latency and 5–20% speed reduction depending on server distance — usually imperceptible for browsing but noticeable in competitive games.

Common mistake

Using a VPN and assuming you’re now “safe” from all online threats. This is the most dangerous misconception about VPNs. A VPN protects one specific thing: the path your data takes from your device to the VPN server. It does nothing about the destination server’s security, your own account passwords, the browser extensions you’ve installed, the links you click, or the cookies that identify you on every site you visit. Someone who uses a VPN but reuses weak passwords, clicks phishing links, and installs shady browser extensions is not safer than someone without a VPN who uses a password manager, enables 2FA, and practices basic security hygiene. The VPN is one layer of privacy — not a complete protection strategy.

Best next step

Use the VPN provider’s DNS while the VPN is connected, then use DNS-over-HTTPS (DoH) when browsing without the VPN. DoH encrypts DNS queries between your device and the DNS resolver, but manually forcing third-party DNS while a VPN is connected can sometimes create DNS leaks if the VPN app is not handling DNS correctly. In Windows 11: Settings > Network & internet > your connection > DNS server assignment > Manual > enable DNS over HTTPS > use a trusted resolver such as 1.1.1.1 or 8.8.8.8. After changing DNS, run a DNS leak test with the VPN on and off. For browser-level tracking protection, install uBlock Origin in your browser (blocks ads, trackers, and malicious scripts) — this addresses the cookies and fingerprinting threats that a VPN cannot. These three tools together — VPN, DoH, and an ad/tracker blocker — cover the vast majority of realistic privacy threats for most users.

Quick Q&A

Does a VPN slow down my internet connection?

Yes, measurably but usually not noticeably. The VPN adds encryption and routing overhead, plus the physical distance to the VPN server. Modern protocols like WireGuard minimize the overhead — expect 10–20% speed reduction and 10–30ms additional latency with a good paid VPN. The impact is larger with distant servers (connecting to a server on another continent from your location adds the physical routing time for every packet). For streaming and browsing, the reduction is imperceptible. For competitive online games where every millisecond matters, connect to the geographically closest server — or don’t use a VPN during gameplay.

Can my employer see what I’m doing if I’m using a VPN on their device?

If it’s a personal VPN on a work device: your employer can still monitor the device through installed software (MDM agents, endpoint monitoring tools) regardless of VPN use. The VPN encrypts the network path but doesn’t prevent software on the device itself from logging activity. If it’s a corporate VPN your employer provided: yes, all your corporate VPN traffic routes through your employer’s servers and they can log it. Corporate VPNs are for giving you access to company resources — they’re not privacy tools for employees. For personal privacy on a work device, the safest approach is to use your personal device for personal activities.

Does a VPN prevent websites from knowing who I am?

It prevents them from seeing your real IP address and approximate location — but that’s it. If you’re logged into a Google or Facebook account, those services know exactly who you are regardless of what IP you’re using. Browser fingerprinting (your unique combination of browser version, screen resolution, installed fonts, time zone, and other characteristics) identifies you with high accuracy even without an IP address or cookies. A VPN hides your IP — it doesn’t create a new identity. True anonymity requires not logging into any accounts, using a browser specifically configured against fingerprinting (like Tor Browser), and significant operational security steps that go far beyond a VPN.

Is it legal to use a VPN?

In most countries, yes — VPN use is completely legal. However, a few countries restrict or ban VPN use: China (only government-approved VPNs), Russia (VPNs must register with the government), Iran, North Korea, and a few others. In countries where VPNs are legal, using one to access geo-blocked content (like streaming libraries) may violate the terms of service of the streaming provider, but it’s not illegal under most jurisdictions. Using a VPN to commit illegal activity is still illegal — the VPN doesn’t provide legal immunity, just technical privacy.

Should I use a free VPN or pay for one?

Avoid free VPNs for anything privacy-sensitive. A VPN provider must pay for servers, bandwidth, and staff. If you’re not paying, you’re the product — free VPNs typically monetize through data collection, injecting ads into your traffic, or selling your browsing history to data brokers. This directly defeats the privacy purpose of the VPN. Reliable paid VPNs cost $3–8 per month. If cost is the main barrier, choose a reputable provider with a clear privacy policy, independent audits where available, and a business model that does not depend on selling browsing data.