What Is a VPN and How Does It Work?

Before reading further, try this: check your current IP address using the tool at the top of this page. Note the IP number, the ISP name, and the city it shows.

Now imagine enabling a VPN, refreshing that page, and seeing a completely different IP — one registered to a server in Amsterdam, or Tokyo, or Toronto. The website you visit has no way to tell the difference between that server and you. As far as it's concerned, you *are* that server.

That's the core of what a VPN does. Everything else — the privacy features, the streaming access, the security — follows from that one change.

This guide explains how that change actually happens, what it protects you from, what it doesn't, and why the use cases for VPNs have expanded considerably since they were primarily a corporate IT tool.

VPN stands for Virtual Private Network. The name comes from its corporate origin: businesses used VPNs to let remote employees securely connect to the company network as if they were physically in the office. The "private network" part is still accurate; the "virtual" part means it's created through software, not physical cables.

For consumers today, the relevant part is simpler: a VPN is software that routes your internet traffic through a server controlled by the VPN provider, in a location you choose. That server's IP address becomes your apparent IP address. Your real IP stays hidden from the websites and services you connect to.

Three things happen when you enable a VPN: 1. Your traffic is encrypted before it leaves your device 2. It travels through an encrypted tunnel to the VPN server 3. The VPN server makes requests on your behalf and returns the responses

The website you're visiting communicates with the VPN server. It has no direct connection to you.

Here's what happens when you visit a website with a VPN enabled:

Step 1: Encryption at the source Your VPN app intercepts all outgoing traffic from your device before it reaches your router. It encrypts this data using a protocol — WireGuard, OpenVPN, or IKEv2 are the most common. The encrypted data is unreadable to anyone who intercepts it between your device and the VPN server.

Step 2: Routing through the VPN server Your encrypted traffic travels to the VPN server — a computer in a data center somewhere, running VPN server software. Your ISP can see that you're sending encrypted data to an IP address (the VPN server's), but cannot read what that data is or where it's ultimately going.

Step 3: Decryption and forwarding The VPN server decrypts your traffic and sends it to the intended destination — say, netflix.com or google.com. From Netflix's perspective, the request is coming from the VPN server's IP, in whatever country that server is located.

Step 4: The return trip Netflix responds to the VPN server. The server encrypts the response and sends it back through the tunnel to your device. Your VPN app decrypts it and displays it normally.

The whole round trip happens in milliseconds. On a good VPN with nearby servers, you may not notice any speed difference. The overhead comes from the encryption processing and the extra network hop to the VPN server.

The easiest way to understand what a VPN does is to observe it directly.

Without a VPN: 1. Visit myipco.com — the IP lookup tool on this site 2. Note your IP address, the ISP name (your home broadband provider), and the city shown

With a VPN enabled: 1. Enable your VPN and connect to a server in a different city or country 2. Refresh myipco.com 3. You'll see a different IP, a different ISP (the VPN provider's data center), and a different location — matching the server you connected to

If the ISP shown still says your home broadband provider after enabling the VPN, something is wrong — the VPN may not be routing traffic correctly, or there's a DNS leak. The VPN verification guide covers how to diagnose this.

The before/after in the IP tool makes abstract VPN explanations concrete: this is exactly what websites see when you connect. It's the same information ad networks, geo-blocking systems, and fraud detection systems use to make decisions about your requests.

VPN use cases have expanded well beyond the original corporate and privacy applications.

Accessing geo-restricted streaming The most common consumer use case. Streaming services license content by region — a show available on Netflix US may not exist on Netflix UK. A VPN with a US server makes Netflix think you're in the US. The same applies to BBC iPlayer (UK-only), sports broadcasts with regional blackouts, and similar services.

Privacy from ISP tracking Without a VPN, your ISP can see every domain you visit. In many countries, ISPs are legally required to log and retain this data for months or years. A VPN encrypts your traffic, so your ISP sees only the VPN server address — not what you're doing.

Accessing geo-restricted AI tools This is a distinctly 2026 use case. Several AI services are unavailable in certain countries due to regulatory restrictions, licensing agreements, or infrastructure decisions. Users in these regions use VPNs to access the tools — the AI service sees a request from an unrestricted country and responds normally. The geographic spread of AI access restrictions has made VPNs a routine tool in regions where they were previously uncommon.

Public Wi-Fi security On unencrypted public networks (airports, cafes, hotels), anyone on the same network can potentially intercept unencrypted traffic. A VPN encrypts everything at the device level, making this interception useless. This is less critical than it used to be now that HTTPS is near-universal, but VPN encryption remains a meaningful additional layer.

Remote work The original corporate VPN use case remains the most widespread by volume. Connecting to a company VPN lets remote employees access internal systems — file servers, databases, internal tools — as if they're physically in the office. This traffic never touches the public internet without encryption.

Testing and development Developers use VPNs to test how services respond to requests from different countries — verifying geo-blocking rules, checking localized content, or testing from an IP range that matches a target user's region.

The economics of free VPNs are worth understanding before choosing one.

Running a VPN service requires servers in multiple countries, bandwidth, staff, and infrastructure. These are real costs. If a VPN is free, someone is covering those costs — and the most common arrangement is that the "product" being sold is you: your browsing data, sold to advertisers or data brokers.

Several free VPNs have been caught logging user traffic despite claiming not to, injecting ads into web traffic, or selling bandwidth to third parties. A notable 2021 case: Hola VPN built a peer-to-peer network from users' connections and resold that bandwidth — meaning your device could be used as an exit node for others' traffic.

What a paid VPN provides: - A clear revenue model that doesn't require monetizing your data - Audited no-logs policies (Mullvad and ProtonVPN have published independent audits) - More servers in more countries - Better speeds and reliability - Support and accountability

Reasonable exceptions: ProtonVPN's free tier is operated by the same team as the paid product and funded by paid subscribers — it's one of the few free VPN tiers that credibly offers what it advertises (though with server location limits and slower speeds).

For most users: if you're going to use a VPN seriously, the $3–10/month for a reputable paid service is worth it. The alternative is often worse than using no VPN at all.

A VPN is a privacy tool, not an anonymity tool. The distinction matters.

What a VPN hides: - Your real IP address (from websites, services, and ad networks) - Your browsing activity from your ISP - Your traffic contents from anyone monitoring your network path

What a VPN does NOT hide: - Your browser fingerprint. Canvas hash, WebGL renderer, screen resolution, installed fonts, and dozens of other signals uniquely identify your browser — and a VPN doesn't change any of them. You can check your full fingerprint at myipco.com/browser-fingerprint. - Cookies and logged-in sessions. If you're signed into Google while using a VPN, Google still knows who you are. The VPN only changes the IP in the metadata; it doesn't remove you from your own account. - Behavioral patterns. Sites can identify return visitors by typing patterns, mouse movements, and timing data — none of which a VPN affects. - Your activity from the VPN provider. You're shifting trust from your ISP to your VPN provider. The VPN provider can, in principle, see everything your ISP previously could. This is why no-logs policies and independent audits matter. - DNS leaks. If your VPN doesn't route DNS queries through its own servers, your ISP's DNS server still receives your queries and can log which domains you visit. See how to check for VPN leaks.

For most threat models — ISP surveillance, geo-blocking, ad network tracking — a VPN is sufficient. For high-stakes anonymity (journalism in hostile states, whistleblowing), Tor provides stronger guarantees, at the cost of speed and convenience.

After enabling a VPN, a 30-second verification is worth doing:

1. Check your IP — visit myipco.com and confirm the IP and ISP shown match your VPN server, not your real connection. If your home ISP appears, the VPN isn't routing correctly.

2. Check for DNS leaks — your IP can change while DNS queries still go to your ISP's servers. The VPN verification guide explains how to test for this specifically.

3. Check for WebRTC leaks — browsers can expose your real IP through WebRTC even when a VPN is active. This is a known issue with Chrome and Firefox. The verification guide covers this test too.

If all three checks pass — VPN server IP visible, no DNS leak, no WebRTC leak — your VPN is working as intended.

For a deeper look at what websites can determine about your connection beyond just the IP, the how-to-change-your-ip-address guide covers alternative methods and what each one is suited for.