What a VPN does (and doesn't) protect
VPNs are marketed as privacy shields, but their protection is narrower than most people think. Here is an honest breakdown of what a VPN hides, what it doesn't, and when you actually need one.
What a VPN actually does
A VPN creates an encrypted tunnel between your device and a VPN server. Traffic between you and the server is encrypted, and your visible IP address becomes the server's IP.
This hides your IP from the sites you visit and protects your traffic from the local network (ISP, Wi-Fi operator, captive portal). It is genuinely useful on untrusted networks.
A VPN does not make you anonymous. It moves trust from your ISP to the VPN provider, who can see your traffic and IP just as your ISP could.
What a VPN does not protect
Browser fingerprinting still works: your user agent, fonts, canvas, and WebGL are unchanged by a VPN. Sites can still identify you.
Cookies and logged-in sessions persist. If you are logged into Google, a VPN does not log you out.
DNS leaks can expose your queries outside the tunnel if the client is misconfigured. WebRTC leaks can expose your real IP directly.
Malware, phishing, and account compromise are unaffected. A VPN is not a security product.
- Fingerprinting: unchanged by VPN
- Cookies and sessions: still present
- DNS leaks: possible if misconfigured
- WebRTC leaks: can bypass the tunnel
- Malware and phishing: not addressed
When a VPN is worth using
On public or untrusted Wi-Fi, to protect traffic from local snooping.
To access region-restricted content, accepting that the provider sees your traffic.
To hide your IP from sites, knowing fingerprinting and cookies still identify you.
For journalists and high-risk users, combined with Tor and strict browser hygiene, not alone.
When a VPN is not enough
If your goal is anonymity, a VPN alone is insufficient. Use Tor Browser and strict operational security.
If your goal is to avoid tracking, you need browser hardening and content blockers, not just a VPN.
If your goal is to bypass censorship, a VPN may work but can be blocked; have fallbacks.
How to check your VPN
Use the WebRTC leak test, DNS leak test, and network info tools on this site with the VPN on and off. Compare the reported IP and resolver.
A working VPN shows the VPN exit IP and a resolver consistent with the VPN. A leak shows your home IP or ISP resolver.
Test in every browser and after updates, since behavior changes.
Choosing a provider
Prefer providers with audited no-logs policies, open-source clients, and transparent ownership. Avoid free VPNs that monetize data.
Check whether the client blocks IPv6 and WebRTC, since these are common leak paths.
Remember that the VPN provider becomes your new trusted party. Choose accordingly.