Almost everything written about VPNs is written by someone selling one. So plenty of people pay for a VPN every month, and very few could tell you what it actually stopped.
Nothing is for sale on this page, and there’s no affiliate link at the bottom. So this is the honest version, with tools to check your own setup as you go.
Think of it like posting a letter
Normally, when you visit a website, your request goes out with your home address on it. Your broadband provider carries the envelope and can see where it’s going.
A VPN is like sending everything to a friend in another city first, in a sealed box. They open the box and post your letters onward with their address on them. Replies come back to them, and they send them on to you.
Two things change. Your broadband provider now sees only a sealed box going to one address. It can’t see what’s inside or where it ends up. And the websites you visit see your friend’s address instead of yours.
Everything a VPN does, and everything it doesn’t, comes from that one picture.
- 01youyour device, at home or on the café Wi-Fi
- 02the VPN servereverything arrives here sealed, and is sent onward from its address
- 03the websitegets the request, and replies back along the same path
Your broadband provider sees a sealed box going to one address. Not what is inside it, and not where it ends up.
The website sees the VPN's address rather than yours. And it sees your account, in full, the moment you sign in.
The four things people get wrong
It doesn’t make you anonymous
The moment you sign into anything, you’ve said who you are. Not by address, but by account.
Checking your email through a VPN tells the email company you’re in a different city. It doesn’t tell them you’re a different person. And almost all tracking online works through accounts and cookies (small files websites store in your browser), not addresses.
There’s also browser fingerprinting. It sounds exotic and isn’t. Your screen size, fonts, time zone, language settings and a few other harmless details add up to a mix that’s close to unique. None of it changes when you switch a VPN on.
You haven’t removed the watcher, you’ve swapped them
Someone can always see your traffic. The only question is who.
Without a VPN it’s your broadband provider: a regulated company, with an office in your country, that almost certainly isn’t interested in you.
With a VPN it’s the VPN company: a business you know nothing about, quite possibly registered somewhere convenient, whose whole pitch is a promise not to keep records. A promise you can’t check.
That’s not an argument against VPNs. It’s an argument for being clear about your choice. You’re moving your trust, not getting rid of the need for it.
It’s also why some people end up running their own VPN instead of renting one. Not because it’s easier, but because it cuts the list of people you have to trust down to one.
The lookups can leak, and usually nobody notices
This is the one that catches real setups, even ones run by people who know exactly what they’re doing.
Every time you visit a website, your device first has to ask “what address is that name at?” It’s like looking up a phone number before you dial. This lookup is called DNS, and it’s a separate request from the traffic itself.
If those lookups don’t go through the tunnel, whoever answers them gets a list of every site you visited, while everything else looked private. You’ve sent a sealed box, with a postcard listing your destinations alongside it.
This isn’t rare. An app set up slightly wrong, a device that prefers its own lookup service, a router quietly pointing to a different one: any of these will do it, and none of them tell you. Test yours rather than assuming. It takes about thirty seconds with the DNS leak suite.
It doesn’t protect you from scams, viruses or bad links
Some VPNs include a blocklist and sell it as protection. The blocklist is useful. But it isn’t the VPN. It’s a separate thing you can run without one.
Nothing about a sealed tunnel stops you downloading something harmful or typing your password into a convincing fake page. Those are different problems, and no VPN touches them.
So what is it good for?
Three things, honestly.
Networks you don’t control. Hotel Wi-Fi, the café, the airport, a conference. You’ve no idea who runs that network or what they’re recording. This is the strongest case for a VPN and always has been.
Reaching your own things. This use gets the least attention and may be the most valuable. A private tunnel isn’t there to hide you from the world. It’s plumbing. It lets your services exist for the people who should reach them, and not exist at all as far as the public internet is concerned. That’s much safer than putting something online and then defending it.
Appearing to be somewhere else. Handy for checking how a site looks from another country. Also used to get round regional blocks, where the usual terms-and-conditions warnings apply.
What it isn’t for is becoming invisible. If that’s really what you need, a VPN is the wrong tool, and the right one is much harder to use.
Five minutes to check your own
You don’t need to be technical for the first three.
- Does your visible location change? Open ip.itzgee.com with the VPN off, then again with it on. It shows the address the internet sees you at, and where it thinks that is. If nothing changes, stop. Nothing else matters until that does.
- Check the lookups. Run the DNS leak suite and read the result carefully: it shows which companies answered. If your broadband provider is on that list, your lookups are escaping the tunnel even though everything else is inside it.
- Check the newer address system too. Two kinds of internet address are in use, an older one and a newer one, and plenty of connections have both. A tunnel set up only for the old kind lets the new kind walk straight past it. The suite above checks both.
- Pull the plug. Turn the VPN off in the middle of a download and watch what happens. A good one cuts your connection completely rather than quietly carrying on unprotected. This is usually called a kill switch, and it’s often off by default.
- Test again after updates, both your device’s and the VPN app’s. Updates reset network settings more often than they should.
The first three take about a minute in total, and they’re worth running on any network you’ve just joined.
The short version
A VPN is a plumbing tool with a privacy side effect. It changes who stands between you and the internet, and lets you choose who that is.
Bought for that, it’s really useful. Bought to make you invisible, it’s a monthly payment for something it can’t do.
The question to ask isn’t “does this VPN hide me?” It’s “who am I trying to hide from, and does this actually take them out of the picture?” If the answer is the café’s Wi-Fi, then yes. If it’s the website you’re logging into, then no, and no amount of money changes that.