What a VPN does not hide — and what it actually does
VPN adverts promise invisibility. What you actually get is narrower, and worth understanding before you pay for one. No jargon, and nothing to sell you.
Almost everything written about VPNs is written by somebody selling one. That leaves an odd gap: plenty of people pay for a VPN every month, and very few could tell you what it actually stopped.
There is nothing being sold on this page and no affiliate link at the bottom of it. So here is the honest version, and the tools to check your own setup as you go.
Think of it like posting a letter
Normally, when you visit a website, your request goes out with your home address on it. Your broadband provider handles the envelope and can see where it is going.
A VPN is like sending everything to a friend in another city first, in a sealed box. They open the box and post your letters onward with their address on them. Replies come back to them, and they forward them to you.
Two things change:
- Your broadband provider now only sees a sealed box going to one address. Not what is inside, not where it ends up.
- The websites you visit see your friend’s address, not yours.
Everything a VPN does — and everything it does not do — comes from that.
- 01 you your device, at home or on the café Wi-Fi
- 02 the VPN server everything reaches here sealed, and is posted onward from its address
- 03 the website receives the request, replies back down the same path
Your broadband provider sees a sealed box going to one address. Not what is inside it, and not where it ends up.
The website sees the VPN's address rather than yours — and your account, in full, the moment you sign in.
The four things people get wrong
It does not make you anonymous
The moment you sign into anything, you have identified yourself. Not by address — by account.
Checking your email through a VPN tells the email company you are in a different city. It does not tell them you are a different person. And the vast majority of tracking online works through accounts and cookies, not addresses.
There is also something called browser fingerprinting, which sounds exotic and is not. Your screen size, your fonts, your time zone, your language settings and a handful of other harmless details add up to a combination that is close to unique. None of that changes when you switch on a VPN.
A VPN changes your address. It does not change your identity.
You have not removed the watcher — you have swapped them
Somebody can always see your traffic. The question is only who.
Without a VPN, it is your broadband provider: a regulated company, with an office in your country, that is almost certainly not interested in you.
With a VPN, it is the VPN company: a business you know nothing about, possibly registered somewhere convenient, whose entire marketing rests on a promise not to keep records — a promise that, by its nature, you cannot check.
That is not an argument against VPNs. It is an argument for being clear about what you are actually choosing. You are moving your trust, not removing the need for it.
It is also the reason some people end up running their own rather than renting one — not because it is easier, but because it collapses the list of parties you have to take on faith down to one.
The lookups can leak, and usually nobody notices
This is the one that catches real setups, including ones run by people who know exactly what they are doing.
Every time you visit a website, your device first has to ask “what address is that name at?” — a bit like looking up a phone number before dialling. That lookup is a separate request from the traffic itself.
If those lookups do not go through the tunnel, then whoever answers them ends up with a list of every site you visited — while everything else looked perfectly private. You have a sealed box, and a postcard listing your destinations sent alongside it.
This is not an exotic failure. A client that was set up slightly wrong, a device that prefers its own lookup service, a router quietly advertising a different one — any of these will do it, and none of them announce themselves.
It is also not rare in setups that look completely fine. Test yours rather than assuming, which you can do in about thirty seconds with the DNS leak suite.
It does not protect you from scams, viruses or bad links
Some VPNs bundle a blocklist and market it as protection. The blocklist is useful. It is also not the VPN — it is a separate thing you can run without one.
Nothing about a sealed tunnel stops you downloading something harmful or typing your password into a convincing fake page. Those are different problems, and no VPN touches them.
So what is it actually good for?
Three things, honestly.
Networks you do not control. Hotel Wi-Fi, the café, the airport, a conference. You have no idea who runs that network or what they are logging. This is the strongest case for a VPN and always has been.
Reaching your own things. This is the use that gets the least attention and is arguably the most valuable. A private tunnel is not there to hide you from the world — it is plumbing. It lets services exist for the people who should reach them and simply not exist as far as the public internet is concerned, which is a far stronger position than publishing something and defending it.
Appearing to be somewhere else. Useful for checking how a site looks from another country. Also used to get around regional blocks, where the usual caveats about terms and conditions apply.
What it is not for is becoming invisible. If that is genuinely what you need, a VPN is the wrong tool and the right one is much harder to use.
Five minutes to check your own
You do not need to be technical for the first three of these.
- Does your visible location change? Open ip.itzgee.com with the VPN off, then again with it on. It shows the address the internet sees you at, and where it thinks that is. If nothing changes, stop — nothing else matters until that does.
- Check the lookups. Run the DNS leak suite. Read the result properly: you are looking at which companies answered. If your broadband provider appears in that list, your lookups are escaping the tunnel even though everything else is inside it.
- Check the newer address system too. There are two kinds of internet address in use, an older one and a newer one, and plenty of connections have both. A tunnel set up only for the old kind lets the new kind walk straight past it. The suite above reports on both.
- Pull the plug. Turn the VPN off mid-download and watch what happens. A good one cuts your connection entirely rather than quietly carrying on unprotected. That feature is usually called a kill switch, and it is often switched off by default.
- Re-test after updates. Both your device’s and the VPN app’s. Updates reset network settings more often than they should.
The first three take about a minute between them, and they are the same checks worth running on any network you have just joined.
The honest summary
A VPN is a plumbing tool with a privacy side effect. It changes who is standing between you and the internet, and it lets you choose that party.
Bought for that, it is genuinely useful. Bought as invisibility, it is a monthly payment for a feeling.
The question worth asking is not “does this VPN hide me”. It is “who am I trying to hide from, and does this actually move them out of the picture?” If the answer is the café’s Wi-Fi, then yes. If it is the website you are logging into, then no — and no amount of money changes that.