What a VPN hides, and what it definitely does not

VPN marketing has settled on a promise that the technology does not make: that routing your connection through another server makes you anonymous. It does not. A VPN solves a narrow and genuinely useful problem, and understanding the shape of that problem is the difference between buying a tool and buying reassurance.

What a VPN actually encrypts

A VPN builds an encrypted tunnel between your device and a server operated by the provider. Traffic inside that tunnel is unreadable to anything on the path in between: the coffee shop router, other people on the same network, your internet provider.

Two things happen as a result. Whoever runs the local network can see that you are connected to a VPN server and how much data is moving, but not the contents or the destinations. And the sites you visit see the VPN server’s address instead of the one your provider assigned you.

That is the whole of it. The tunnel ends at the provider’s server. From that point on, your traffic continues to its destination as ordinary internet traffic, and the protections that apply are the ones that were always applying: HTTPS between you and the site, and nothing more.

Modern implementations mostly use WireGuard, which is small enough to audit properly, or OpenVPN, which is older and more configurable. The protocol choice affects speed and battery life more than it affects what is hidden.

Who can still see your traffic

This is where the marketing and the mechanism part company.

The VPN provider replaces your internet provider as the party who can see everything. You have not eliminated the observer, you have changed who it is. Whether that is an improvement depends entirely on whether the provider is more trustworthy than the network you were on, which is a judgment about a company, not a technical guarantee.

The sites you visit still identify you. If you log in, you are identified by the account, not the address. Beyond that, browser fingerprinting, cookies and tracking scripts work exactly as before. A VPN changes the return address on the envelope; it does not change what you write inside or who you write to.

DNS can leak outside the tunnel. Depending on configuration, the queries that turn a domain name into an address may still go to your provider’s resolver, exposing the list of sites you visited even though the traffic itself was encrypted. Reputable clients route DNS through the tunnel, but this is worth testing rather than assuming.

Your employer may see more than you expect on a managed device. If the machine has a corporate certificate installed, traffic can be inspected after decryption regardless of any VPN you add.

Laid out by observer, the picture is clearer than the marketing allows:

Read the third and fifth rows together. The VPN moved one observer and eliminated none. The bottom two rows are the ones the advertising never mentions, and they are where most real identification happens.

The logging question

Every consumer VPN claims not to keep logs. The claim cannot be verified from the outside, which is why the serious providers commission independent audits and publish the results, and why the useful question is not “do you log” but “what has been examined, by whom, and how recently”.

Two things carry more weight than the marketing copy. An audit conducted by a named firm with a published scope, because scope is where these documents get soft. And a documented record of how the provider responded to an actual legal demand, because that is the only real test of an architecture.

Jurisdiction gets discussed heavily and matters less than people assume: a provider that holds no data cannot be compelled to produce it, and a provider that does hold data will eventually be asked for it wherever it is incorporated.

When a VPN is the wrong tool

A VPN is a good answer to a specific question: how do I stop the local network from observing my traffic. It is a poor answer to several questions it is frequently sold as solving.

It will not make you anonymous. Anonymity requires defeating correlation, which means the account logins, the browser fingerprint and the behavioural patterns, none of which a tunnel touches. Tools built for anonymity, such as Tor, make very different trade-offs and are slower for good reasons.

It will not stop tracking or advertising profiles, which are built inside the page rather than on the wire. Browser configuration, content blocking and separate profiles do far more here.

It will not protect you from malware or a phishing page. The tunnel carries hostile traffic as faithfully as it carries anything else.

And it will not reliably defeat geographic restrictions forever. That works until the service in question decides to care, at which point it becomes a maintenance treadmill rather than a feature.

There is also a case where a VPN actively makes things worse: routing all traffic through a free provider whose business model you cannot identify. Running the infrastructure costs money. If you are not paying, something else is producing revenue, and the most valuable asset available is the traffic you just handed over.

Choosing one without the hype

If the problem you actually have is untrusted local networks, hotels, airports, conference wifi, shared flats, then a VPN is the right tool and the selection criteria are unglamorous.

Look for a published independent audit with a stated scope, not a badge. Prefer WireGuard support for performance. Check that DNS is handled inside the tunnel and verify it yourself after installing. Confirm there is a kill switch that blocks traffic if the tunnel drops, since a silent failure is worse than no VPN at all because you will keep behaving as though you have one. And be sceptical of any provider whose pricing is far below the cost of running servers.

For the narrower case of reaching your own devices from outside, a self-hosted tunnel is often better than a commercial subscription, because the trust question disappears: you are the provider.

None of this makes a VPN useless. It makes it ordinary, which is the more accurate framing. It encrypts one segment of a path, moves one observer, and asks you to trust a company in place of a network. Bought with that understanding, it does its job well.

Sources

• WireGuard — protocol documentation for the tunnel described here
• OpenVPN — the older protocol still used by many providers
• Electronic Frontier Foundation, privacy — the analysis of what a VPN does and does not conceal, including what the provider itself can see
• CISA, Secure Our World — the US cyber agency’s baseline advice, which puts VPNs in proportion against the other measures that matter more