A VPN masks your location and internet provider, but it doesn't make you invisible

A VPN (virtual private network) routes your internet traffic through a server run by the VPN company instead of directly through your internet service provider. This means websites see the VPN server's location instead of yours, and your ISP sees encrypted traffic instead of which sites you visit. It's useful for specific situations — using public WiFi, hiding your browsing from your ISP, accessing content blocked in your region — but it's not a magic shield against all tracking.

The trade-off is real: you're trusting the VPN company instead of your ISP. They can see everything your ISP could see. If the VPN company keeps logs of your activity, sells data to advertisers, or gets hacked, your privacy is compromised in a different way. You've moved the problem, not solved it.

Whether a VPN makes sense for you depends on what you're actually trying to protect against. A VPN on public WiFi at a coffee shop is sensible. A VPN to hide from your ISP that you're reading about a medical condition is reasonable. A VPN as a substitute for not using strong passwords or keeping your software updated is a waste of money.

Key Takeaways

  • A VPN hides your location and browsing from your internet service provider, but the VPN company itself can see your traffic if they choose to log it.
  • Public WiFi is the clearest use case for a VPN — it prevents people on the same network from intercepting your passwords and data.
  • Paid VPNs with no-log policies are more trustworthy than free ones, which often make money by selling your data to advertisers.
  • A VPN does not hide your identity from websites you log into, protect you from malware, or replace the need for strong passwords and software updates.
  • Your choice of VPN provider matters more than using a VPN at all — a VPN run by a company with poor security practices offers little protection.

What a VPN actually hides from whom

When you use a VPN, three parties can potentially see your activity: the website you visit, the VPN company, and anyone monitoring your network connection. A VPN shifts what each party sees.

Your internet service provider (ISP) — Comcast, Verizon, AT&T, or your local provider — normally sees every site you visit and how much data you use. With a VPN, they see only that you're connected to a VPN server; they cannot see which sites you're visiting or what you're doing there. This is useful if you want to keep your browsing private from your ISP, which may sell browsing data to advertisers or throttle certain types of traffic.

The websites you visit see the VPN server's location instead of yours. If you're in New York and connect through a VPN server in London, the website thinks you're in London. This is useful for accessing content blocked in your country, but it does not hide your identity. If you log into your email, your bank, or your social media account while using a VPN, the website knows who you are.

The VPN company itself sees everything that passes through their servers — every site you visit, every search you make, potentially every password you type if the connection is not encrypted end-to-end. Whether they actually record this depends on their logging policy. A company that claims a "no-log" policy says they do not store this information, but you have to trust them. A company that keeps logs can be forced to hand them over to law enforcement, or may sell them to data brokers.

When a VPN actually protects you

Public WiFi is the clearest case. When you connect to WiFi at an airport, coffee shop, or hotel, anyone else on that network can potentially intercept unencrypted traffic. They can see your passwords, your emails, your banking information — anything you send that is not encrypted. A VPN encrypts all your traffic before it leaves your device, so even if someone on the same network is trying to intercept it, they see only encrypted gibberish.

Hiding your browsing from your ISP is another legitimate reason. Your ISP can see which sites you visit (though not the specific pages or search terms if the site uses HTTPS, which most do now). If you want to keep your ISP from knowing you're reading about a medical condition, a political topic, or anything else, a VPN prevents that. Your ISP will see only that you're using a VPN, not what you're doing inside it.

Accessing content blocked in your region works because websites block based on the location they see. If your country blocks a news site and you connect through a VPN server in another country, the site sees that location and lets you through. This is useful if you live under censorship, though it is worth knowing that using a VPN may itself be illegal or monitored in some countries.

A VPN does not protect you from malware, phishing, or viruses. It does not hide your identity from websites you log into. It does not replace the need for strong passwords, two-factor authentication, or keeping your software updated. If you think a VPN is a substitute for those things, you are taking on risk.

Free VPNs versus paid VPNs

Free VPNs are almost always worse than no VPN. A VPN company has to pay for servers, bandwidth, and staff. If you are not paying, the company has to make money some other way. Most free VPNs sell your data to advertisers, inject ads into your traffic, or log your activity and sell it to data brokers. Some have been caught running malware or selling access to your connection to other users.

Paid VPNs have a business model that does not depend on selling your data. They make money from your subscription. This does not mean they are trustworthy — you still have to evaluate the company — but it means they have less financial incentive to betray you. Look for a VPN provider that publishes a clear no-log policy, has been audited by an independent security firm, and is based in a country with strong privacy laws (not the United States or other countries with broad government surveillance).

Some well-known paid VPN providers include Mullvad, ProtonVPN, and IVPN. These are not endorsements — you should research any VPN provider before paying for it — but they are examples of companies that publish their policies clearly and have undergone independent security audits. Avoid VPNs that make vague promises about "military-grade encryption" or claim to make you "completely anonymous."

What a VPN does not do

A VPN is not a substitute for other security practices. It does not protect you from malware, which is software designed to damage or steal from your device. If you read a file infected with malware, a VPN does not stop it from running. It does not protect you from phishing, which is when someone tricks you into giving them your password or personal information. It does not protect you from viruses, ransomware, or any other threat that comes from the files you read or the links you click.

A VPN does not hide your identity from websites you log into. If you use a VPN to visit your bank's website, the bank still knows who you are because you logged in with your username and password. The VPN hides your location from the bank, but not your identity. If you want to browse anonymously, you need a different tool — the Tor browser — which is much slower and has its own trade-offs.

A VPN does not encrypt your data on your device. If your laptop or phone is stolen, a VPN does not protect your files. You need encryption on your device itself, which most modern phones and computers offer (FileVault on Mac, BitLocker on Windows, or encryption built into Android and iOS).

A VPN does not protect you from your own mistakes. If you use the same weak password everywhere, a VPN does not help. If you fall for a phishing email and give someone your password, a VPN does not help. If you install software from an untrusted source, a VPN does not help.

How to choose whether you actually need a VPN

Start by asking what you are trying to protect against. Are you worried about someone on your WiFi network intercepting your passwords? A VPN helps. Are you worried about your ISP seeing which sites you visit? A VPN helps. Are you worried about websites tracking you? A VPN does not help much — websites track you through cookies and login accounts, not your IP address. Are you worried about your device being hacked? A VPN does not help.

If you use public WiFi regularly — at coffee shops, airports, hotels — a VPN is worth considering. If you use only your home network or your phone's cellular connection, the benefit is smaller. If you live in a country with heavy internet censorship or surveillance, a VPN may be important, though you should research whether using one is legal first.

If you do decide to use a VPN, choose a paid one with a clear no-log policy and independent security audits. Set it to connect automatically when you use public WiFi. Do not assume it makes you invisible or removes the need for strong passwords, software updates, and careful browsing habits. A VPN is one tool among many, not a solution to all privacy problems.

The difference between a VPN and Tor

Tor is a different tool that works differently. Instead of routing your traffic through one VPN server, Tor routes it through multiple servers run by volunteers, and each server encrypts the traffic in layers. This makes it much harder to trace your activity back to you, but it is also much slower. Tor is useful if you need strong anonymity — if you are a journalist in a country with censorship, or if you are trying to hide your identity from powerful adversaries. For most people checking email or reading news on public WiFi, a VPN is faster and sufficient.

Tor also requires more care to use safely. Your browser behavior can still reveal your identity if you are not careful. Tor is not a magic shield; it is a tool for a specific purpose. If you think you need Tor, you probably know why. If you are not sure, a VPN is likely what you want.

Frequently Asked Questions

Will a VPN stop websites from tracking me?

Not really. Websites track you through cookies, login accounts, and fingerprinting — not your IP address. A VPN hides your IP address but does not stop cookies or login tracking. If you want to reduce tracking, use a browser that blocks third-party cookies (Firefox and Safari do this by default) and clear your cookies regularly. A VPN is a small part of the picture.

Can my VPN provider see my passwords?

Only if the website you are logging into does not use HTTPS encryption. Most websites use HTTPS now, which means your password is encrypted before it leaves your device. The VPN company sees encrypted traffic, not the password itself. However, if you use a website that does not use HTTPS (rare but it happens), the VPN company could theoretically see your password. Check for the lock icon in your browser's address bar to confirm HTTPS is active.

Is it illegal to use a VPN?

In most countries, no. In the United States, Europe, and most democracies, VPNs are legal. However, some countries including China, Russia, and Iran restrict or ban VPN use. If you live in or travel to a country with strict internet controls, research the legal status before using a VPN. Using a VPN to break laws (like accessing pirated content) is illegal regardless of where you live.

Do I need a VPN if I have nothing to hide?

That depends on your comfort level with your ISP and websites knowing your browsing habits. You may not have anything illegal to hide, but you might prefer your ISP not to know you are reading about a medical condition, a political topic, or anything else personal. Privacy is not just about hiding illegal activity; it is about controlling who knows what about you.

Will a VPN slow down my internet?

Yes, usually a little. Encrypting and routing your traffic through another server takes processing power and adds distance. The slowdown depends on the VPN provider, how far their servers are from you, and how busy they are. Most people notice a small slowdown that does not affect normal browsing, but it can be noticeable on slower connections or when streaming video.