Explainer
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
A VPN client creates a virtual network connection on your device and tells the operating system to send traffic through it. Each packet is encrypted, placed inside a new packet addressed to the VPN server, and sent over your ordinary connection.
The server opens the outer packet, decrypts what is inside and forwards it to the internet under its own address. Replies follow the same path in reverse. What a VPN is covers what that means for your privacy, and this page covers the mechanism.
Nothing physical is built. The word describes one packet carried inside another: routers along the way read the outer packet and deliver it, and the inner one means nothing to them.
The encryption is what makes it private, because wrapping alone would leave the inner packet readable. The rules for wrapping, encrypting and agreeing on keys are the protocol. Protocols differ, and some older ones have published weaknesses. The keys are normally replaced regularly during a session, so that a key stolen later cannot unlock earlier traffic.
A name lookup happens before any connection to the site, and on most systems it is a separate request handled by a separate setting. That is why it can go wrong on its own.
If the lookup goes around the tunnel, your network learns the name of every site you visit while the traffic itself stays hidden. A provider that runs its own DNS inside the tunnel keeps those lookups away from your network, though the provider itself then sees them.
Most VPN servers put many customers behind one public address, which is called IP sharing. A site sees that address and cannot tell, from the address alone, which customer sent a given request. It is also why sites sometimes block or challenge VPN traffic, since one address produces the activity of many people.
Past the exit there is no VPN encryption. Whatever protection the request has from there comes from HTTPS between your browser and the site. The server's location decides the country you appear to be in, and it also decides whose law applies to the machine.
Each step can fail in its own way, and the client may still show that it is connected.
None of this is measured by running the software here. The register reads what has been published about each provider, with a source and a date.
Your traffic takes a longer route, through a server that also handles other people's traffic, and each packet carries some extra data for the encryption. An exit far away from you adds the most.
How much it matters depends on the server and the route. This site does not measure speed, because one reading from one place says little about a provider.
It encrypts what the operating system sends into the tunnel, which is normally all of it. Exceptions are the apps you exclude with split tunnelling and any traffic that leaks around the tunnel.
Usually, yes. It sees a steady encrypted connection to one address, and that address may be known to belong to a VPN. It cannot read what is inside, but it can see that the connection exists, when it runs and how much data it carries.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.