This article may contain affiliate links. If you buy through them we may earn a commission at no extra cost to you.
A VPN encrypts every packet of data leaving your device, routes that encrypted traffic through a server operated by the VPN provider, and presents that server’s IP address to any website you visit—not yours. Your ISP sees only an encrypted stream headed to one IP address. The website sees a request from the VPN server’s location. Your device is invisible to both.
That three-part process—encrypt, reroute, mask—happens automatically in the background the moment you connect. Here’s what each part actually does.
What a VPN Actually Does
Without a VPN, your ISP can log every domain you visit, anyone on your local network can intercept unencrypted traffic, and websites record your real IP address to build a location profile. A VPN eliminates the first two problems and significantly complicates the third.
It does this through three simultaneous functions:
- Encryption: Data is mathematically scrambled before it leaves your device. Your ISP, network administrator, or anyone intercepting the connection sees ciphertext, not content.
- IP substitution: The VPN server’s IP address replaces yours in every outbound request. A server in Frankfurt makes you appear to be browsing from Frankfurt.
- Traffic routing: All requests pass through the VPN server before reaching their destination, removing the direct link between your device and the sites you visit.
The Encryption Layer
How the handshake works
When you connect to a VPN, your device and the VPN server negotiate encryption keys through a process called a handshake. Once those keys are established, every packet you send is encrypted before it leaves your network adapter. Intercepting the packet in transit reveals nothing without the key.
Modern VPNs use AES-256 or ChaCha20. AES-256 is the same standard used to protect classified U.S. government data; a brute-force attack against it would take longer than the current age of the universe on any foreseeable hardware. ChaCha20 is faster on devices without hardware acceleration for AES—common on older Android phones—and is equally secure for practical purposes.
VPN protocols compared
The protocol controls how encryption is applied and how efficiently the tunnel operates. The differences are real and affect speed, battery life, and auditability.
| Protocol | Speed | Security | Best use case |
|---|---|---|---|
| WireGuard | Fastest | Strong (modern cryptography) | General use, mobile |
| OpenVPN | Moderate | Strong (SSL/TLS) | Configurable setups, audited deployments |
| IKEv2 | Fast | Strong | Mobile networks (reconnects quickly) |
| L2TP/IPsec | Slow | Adequate | Legacy device compatibility only |
| PPTP | Fast | Broken | Avoid entirely |
Most consumer VPN apps default to WireGuard or OpenVPN. WireGuard’s codebase is roughly 4,000 lines versus OpenVPN’s 70,000+, which makes it faster to audit for security flaws. OpenVPN has a longer track record and is more configurable. Either is acceptable; PPTP is not.
IP Address Masking
Your IP address identifies your approximate location and, combined with other data, your ISP account. When you connect through a VPN server, the destination website logs the VPN server’s IP—not yours. If that server is in Germany and you’re in Texas, the website records a German visitor.
This has two practical applications. First, it breaks the direct link between your browsing activity and your physical location. Second, it allows you to appear to browse from a different country, which some use to access region-locked content—though doing so violates the terms of service of most streaming platforms.
IP masking is not anonymity. If you sign into Gmail, Facebook, or any personal account while using a VPN, that service identifies you by your credentials, not your IP. The VPN hides your network location; it cannot hide actions you take under your own name.
How Data Flows Through a VPN
The routing process follows eight discrete steps:
- You request a website or send a message.
- Your VPN client intercepts that data before it reaches your network adapter.
- The client encrypts the data and wraps it in a new packet addressed to the VPN server.
- The encrypted packet travels across the public internet to the VPN server.
- The VPN server decrypts the packet and forwards your original request to the destination website.
- The website responds to the VPN server’s IP address.
- The VPN server encrypts the response and sends it back to your device.
- Your VPN client decrypts the response and passes it to your browser.
The website sees the VPN server as the client. Your ISP sees encrypted traffic flowing to a single IP address. Neither sees both pieces of the picture simultaneously.
Server location and latency
Every extra hop adds latency. A VPN server 100 miles away typically adds 5–20 milliseconds; one 3,000 miles away can add 50–100 milliseconds. For web browsing and email, that difference is imperceptible. For competitive gaming or real-time video calls, 80ms of added latency is noticeable and disruptive.
Server load matters too. A VPN server shared by thousands of simultaneous users compresses available bandwidth for everyone. This is the primary reason free VPN services are slower than paid ones—fewer servers, more users per server.
DNS Leaks and Kill Switches
A DNS leak happens when your device queries a DNS server—the system that translates “google.com” into an IP address—outside the encrypted VPN tunnel. That query travels unencrypted to your ISP’s DNS server, revealing exactly which domains you’re visiting even while your other traffic is protected. A correctly configured VPN routes DNS queries through its own encrypted tunnel.
A kill switch cuts your internet connection entirely if the VPN drops unexpectedly. Without one, your device falls back to your ISP’s unencrypted connection automatically, briefly exposing your real IP and traffic. Both features are standard in reputable VPN apps. You can verify DNS leak protection at dnsleaktest.com after connecting.
What a VPN Does Not Protect
A VPN secures data in transit between your device and the VPN server. It does not:
- Protect you from malware, phishing, or weak passwords
- Prevent browser fingerprinting, which identifies you by your browser configuration rather than your IP
- Clear tracking cookies already stored on your device
- Secure data on your device if it’s already compromised
- Hide your identity when you log into personal accounts
A VPN is a tool for hiding your network activity from your ISP and websites, not a tool for hiding your identity if you voluntarily reveal it.
You also shift trust from your ISP to your VPN provider. The provider’s servers decrypt your traffic, which means they could theoretically log it. Reputable providers publish no-logging policies and submit to third-party audits—ExpressVPN, Mullvad, and NordVPN have each completed independent audits as of 2026. A provider without audited no-logging claims offers weaker privacy guarantees than your ISP in a jurisdiction with data retention laws. For a breakdown of audited options, see our guide to the best VPNs for privacy and security.
Performance Overhead
Encryption and rerouting cost something. On modern hardware, the CPU overhead is small enough to be unmeasurable during normal use. Speed loss depends on server distance and protocol: WireGuard on a nearby server typically reduces throughput by 5–10%; OpenVPN on a distant server can reduce it by 20–40%. Battery drain on mobile devices is real but modest—roughly comparable to streaming audio in the background.
Frequently Asked Questions
Does a VPN hide my activity from the VPN provider itself?
No. The VPN server decrypts your traffic to forward it, so the provider has the technical capability to log what you do. A documented, audited no-logging policy reduces this risk but doesn’t eliminate the need for trust. Some providers use RAM-only servers, which lose all data on reboot, as an additional structural safeguard.
Can my ISP tell I’m using a VPN?
Your ISP can see that you’re sending encrypted traffic to a known VPN server IP, so yes—they know you’re using a VPN. They cannot see which websites you visit or what data you’re transmitting. Some ISPs throttle traffic to known VPN server addresses, though this is uncommon in the U.S., UK, and most of Western Europe.
Does a VPN work on all devices?
Major providers offer apps for Windows, macOS, iOS, Android, and Linux. Router-level VPN installation covers every device on your network, including smart TVs and consoles that don’t support VPN apps natively. A VPN only protects traffic routed through the VPN client—apps that use their own encrypted tunnels or bypass the system network stack may not be covered.
Is using a VPN legal?
VPNs are legal in the United States, Canada, the UK, Australia, and most of Europe. China, Russia, Iran, and a handful of other countries restrict or ban unauthorized VPN use, with enforcement that varies by jurisdiction and context. The VPN itself is not the legal question—what you do with it is subject to the same laws that apply without one.
Why do some websites block VPN connections?
Streaming services block VPNs to enforce geographic content licensing agreements. E-commerce and banking sites block them to reduce fraud. Detection works by cross-referencing your IP against published lists of VPN server addresses. Premium providers rotate IPs and use residential IP pools to reduce blocking, but this is an ongoing technical conflict with no permanent winner.
Lena writes about smart home, audio and the software settings nobody reads the manual for.
