A virtual private network, or VPN, routes traffic through an encrypted connection to a VPN server. For traffic that uses that tunnel, a destination normally sees the VPN server’s public IP address. This changes who can observe parts of the connection; it does not make you anonymous or prevent every kind of online attack.
Correction, November 5, 2026: An earlier version overstated anonymity, censorship access and travel savings, described a kill switch incorrectly and used outdated Mullvad protocol information. Those claims have been corrected.
How a VPN connection works
The basic path is device, VPN tunnel, VPN server, then destination. A commercial service commonly routes internet traffic this way, while an employer’s VPN may provide access to internal systems. The network arrangement and which traffic enters the tunnel depend on the product and configuration.
Encryption protects a particular connection
The VPN tunnel protects traffic between your device and its server. HTTPS is a separate layer between an application or browser and the website. A VPN is not a substitute for HTTPS, software updates or account security. A padlock also does not establish that the organization operating a website is trustworthy.
What a VPN can and cannot hide
The Electronic Frontier Foundation’s VPN guidance stresses the trust you place in the VPN operator. The local network and ISP can see a connection to a VPN, while the VPN provider can observe information about traffic leaving its network. HTTPS still protects the contents of an encrypted website connection from intermediaries.
A site can recognize a signed-in account, cookies or other identifiers despite a changed IP address. GPS permissions can reveal location separately. A VPN does not undo information you publish, erase an account history or make downloaded software safe.
Public Wi-Fi does not make every login readable
The FTC explains that widespread HTTPS encryption has made public Wi-Fi safer. Other people on a network cannot simply read properly encrypted login contents. A VPN may be useful on a network you do not trust, but it is not mandatory protection against every public-Wi-Fi risk. An encrypted connection to a phishing site still delivers your information to the scammer operating it.
Access restrictions are not guaranteed to disappear
A different network route may help with some blocks, but websites and streaming services can block VPN traffic too. Availability varies, and service terms or local restrictions may apply. Changing location also does not turn a news outlet into an unbiased source or protect the identity of someone posting under their real name.
Connection speed is not a security test
Latency, distance, congestion and available capacity can affect VPN performance. More servers do not automatically establish better speeds for your connection. Cloudflare’s networking explanation describes why a distant route may add delay. Neither a slowdown nor an unchanged speed proves that encryption is working correctly.
Understand the kill switch and split tunneling
A kill switch is intended to block traffic when the VPN connection fails, rather than remove protection and continue openly. Mullvad’s desktop documentation describes its built-in blocking behavior and distinguishes it from an optional mode that also blocks traffic after deliberately disconnecting. Other products and operating systems can behave differently.
Check which traffic is covered
Split tunneling deliberately sends selected apps or destinations outside the VPN. Check the setting before assuming that every app uses the tunnel. Comparing your public IP before and after connecting checks one observable part of routing; it does not establish that every DNS request, app connection or failure state is covered.
Mullvad’s protocol support changed
The earlier OpenVPN example is obsolete for Mullvad. Its published removal notice set January 15, 2026 as the end of OpenVPN support on both clients and servers, with a move to WireGuard. Use a provider’s current configuration instructions instead of reusing an old protocol walkthrough or fixed server count. This example is documentation-based, not a TechEngage performance test.
Compare the service, not just free versus paid
A subscription does not establish that a VPN keeps no records, and a free tier does not by itself establish malware. Check the operator, collection policy, supported devices, data limits, renewal terms and refund conditions. Free VPN options and paid VPN services should be compared on those specific limits.
Do not budget around promised travel discounts
Treat a different displayed fare as a quote to verify, not proof that a VPN caused a saving. Compare the same dates, route, currency, baggage and payment conditions. A VPN is not a guaranteed way to buy cheaper tickets, and a low introductory subscription price may not be the renewal price.
Decide which problem you want to solve
An employer may require its approved VPN for remote access. A personal VPN may help keep some browsing metadata away from a local network. If the concern is account theft, start with account security and recovery settings. If it is search history, compare search providers’ actual privacy policies. These are different problems with different controls.
Share Your Thoughts