What is a VPN?

The VPN app on your device opens a connection to one of the provider's servers and agrees an encryption key with it, using a protocol such as WireGuard, OpenVPN or IKEv2/IPsec. From then on, every packet your device sends is wrapped inside that encrypted connection, the tunnel. Your home router, the café's Wi-Fi, your internet provider and every router between you and the VPN server see only encrypted traffic going to one address: the server. The server unwraps each packet and sends it on to its real destination with its own address as the source; replies travel back the same way.

Three consequences follow. To the website, you are the VPN server: its address, its country, its provider. To your internet provider, you are someone exchanging encrypted data with a VPN server; the destinations and the DNS lookups are inside the tunnel. And to the VPN provider, you are exactly as visible as you were to your ISP before: it sees every destination, so it is the one party you must trust. The original VPNs were corporate: a laptop at home joining the office network as if it were plugged in there, which is still what the "private network" in the name refers to. Consumer VPNs reuse the technology to change where your traffic enters the public internet.

Protocols matter less than marketing suggests. WireGuard is the modern choice: a small codebase, fast handshakes, modern ciphers (ChaCha20-Poly1305). OpenVPN is older, slower and supported everywhere. IKEv2/IPsec is built into phones and reconnects well when you move between Wi-Fi and mobile data. All three are secure when configured properly; the differences you will notice are speed and how quickly the tunnel recovers after a network change.

Hidden from websites and services: your IP address and, with it, your approximate location, your provider and the type of your connection. They see the VPN server's instead, and many sites recognize it as a VPN address, because commercial VPN ranges are published and sit in hosting networks.

Hidden from your provider and the local network: every destination, every DNS lookup, every server name. They see the volume of encrypted traffic and the VPN server you talk to, nothing more. This is the VPN's strongest effect, and the reason to use one on public Wi-Fi.

Not hidden:

• Who you are to sites you log in to. Your account, your cookies and your browser fingerprint identify you regardless of the address you arrive from. A VPN changes the address, not the person.
• Anything from the VPN provider. It sees what your ISP used to see. A provider with a credible, audited no-logging policy keeps nothing; a free provider usually pays for itself with your data.
• The content of your traffic after the server. Between the VPN server and the website, protection comes from HTTPS, exactly as without a VPN. The VPN's encryption ends at its server.
• Traffic that goes around the tunnel. A DNS lookup sent to your provider's resolver, a WebRTC request from your browser's real interface, or IPv6 traffic the VPN does not carry all reach the internet with your real address. These are leaks, they are common, and they are what the tests on this site look for: what is a DNS leak and what is WebRTC cover the two most frequent.
• Your time zone and language. The browser still reports your device's time zone and languages; a VPN address in one country with a device clock in another is a signal that fraud and streaming systems use.

In one sentence: a VPN hides your network location from websites and your destinations from the network, and nothing else.

Worth it:

• On public or shared Wi-Fi: hotels, airports, cafés, conference venues. The tunnel removes the metadata the network could collect and defeats fake-network tricks (public Wi-Fi safety).
• When you do not want your provider, a workplace or a landlord's network to see your destinations.
• When you need to appear in another country for a service you are entitled to use, such as your own streaming subscription or your bank's site while traveling.
• For remote access to a company or home network, the original use.
• When your home connection sits behind carrier-grade NAT and you need a stable, reachable address; some VPN providers offer a dedicated address for this.

Not worth it:

• As a general "security" layer on a trusted home network with HTTPS everywhere: there is little left for it to protect.
• For anonymity. A VPN shifts trust from your ISP to the VPN provider; it does not remove the party that can see you. Tor exists for that, with its own trade-offs.
• Because an advertisement said your data is "exposed". Your IP address is always visible to the sites you use; that is how the internet works, and it reveals less than the advert implies (what can someone do with your IP).

Costs to weigh: a monthly fee, somewhat lower speeds (a detour plus encryption; small with a nearby server and WireGuard, large with a distant or crowded one), captchas and blocks on sites that treat VPN addresses with suspicion, and the need to choose a provider you trust more than your ISP. Free VPNs that are not run by an organization you can name are usually the product being sold.

Connect the VPN, then look at the card below. The first line must show the VPN server's address and its provider, not your ISP; if it shows your ISP, the app is not carrying your traffic at all (common after a sleep or a network change). The WebRTC line should show either nothing or the same address as the first line; a second, different address is your real one leaking from the browser. The DNS line should list the VPN's resolver or a public one reached through the tunnel; your ISP's resolver there is a DNS leak. The IPv6 line should be empty or belong to the same network as the VPN address; an IPv6 address from your home provider means the VPN tunnels only IPv4.

The full VPN test runs the same checks with more detail and names the fix for each failure: most are a setting in the VPN app ("block DNS outside the tunnel", "kill switch", "disable IPv6") or a browser setting for WebRTC. Test on each device and browser separately, because the result belongs to that device, and test again after every app update. A VPN that passes once and leaks later is more common than one that never worked.