Explainer
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
A VPN protects one stretch of the path: from your device to the provider's server. Inside that stretch, nobody carrying your traffic can read it. Outside it, nothing has changed.
So it does not stop a site recognising you, it does not help once your device is compromised, and it does not make a false page genuine. It protects you from the network, and most of what goes wrong online happens somewhere else.
This page goes through those places in order, starting with the two ends of the tunnel. What a VPN is covers the mechanism and who sees what.
Changing your address removes one identifier out of many, and sites stopped relying on that one long ago.
This is why the advertising's word anonymous does not hold, and the short version says so plainly.
Encryption starts when traffic enters the tunnel, and everything on your device happens before that. Whatever is running there sees your activity in the clear.
Some providers bundle a filter that blocks addresses known for malware or tracking. It can be useful, but it is a separate feature sitting beside the tunnel, and it only catches what is on its list.
The server decrypts your traffic and sends it on over the ordinary internet. From there, the protection is whatever the site itself provides.
Most of the web now uses HTTPS, which encrypts a page between your browser and the site with or without a VPN. That has shrunk the old story about the cafe hacker reading your bank password. On such a network, a VPN mainly hides which sites you reach. The contents were usually sealed already.
A page without HTTPS stays readable after the exit, by anyone on the route from there to the site. And a site that is itself dishonest or badly run receives what you send it, intact and on time.
All of the above assumes your traffic is inside the tunnel. Sometimes part of it is not, and the client may show "connected" throughout.
Everything your network could see, the VPN provider can now see, along with who is paying for the account. The tunnel offers no protection from the company at its other end.
What that costs you depends on what the company keeps and on whose orders it must follow. Encryption has no bearing on either, and neither does the length of the key. A VPN also changes nothing about what the law says of your own actions: your address moves, and the law that applies to you stays where it was.
Most of what is printed on a VPN's front page is a true statement about the tunnel, offered as a promise about everything else.
| The claim | What is true | What it leaves out |
|---|---|---|
| Military-grade encryption | Usually AES-256, a sound cipher that plenty of ordinary software also uses | Who holds the other end of the tunnel, and what they keep |
| Complete anonymity | Sites see the server's address instead of yours | Your accounts, your browser and the provider itself |
| No logs | The company says so, and sometimes someone has checked | Whether any record could still link a session to a person |
| Protection from hackers | Other people on your network cannot read your traffic | Your device, your passwords and false login pages |
| Safe on public Wi-Fi | The network cannot see which sites you reach | HTTPS already sealed most of the contents, and a false page is still false |
| Blocks malware and trackers | A filter stops the addresses on its list | The filter is not the tunnel, and whatever is not listed gets through |
A VPN still does two useful things: it hides your traffic from the network carrying it, and it replaces your address with the server's. If those are the problems you have, it solves them. If yours is one of the others on this page, a better provider will not fix it.
When a VPN is the right tool, the remaining question is who you hand that view to, and that is what the register scores. Of the 77 records on file, read on 21 October 2026, 0 score strong on security. The methodology shows how the number is built, and the questions say what a high score does not promise either.
Yes. A VPN changes the address a site sees and nothing else. Cookies, logins and your browser's fingerprint all work the same way, so a site or advertiser that recognised you yesterday can recognise you today from a different country.
Clearing cookies and using a separate browser profile address that part. A VPN does not.
Not by itself. Malware runs on your device, before the tunnel encrypts anything, and a phishing page gets your password because you typed it in. The tunnel carries both faithfully.
Some providers add a filter that blocks known bad addresses. That filter is a separate feature, and it only knows the addresses on its list.
On the employer's network alone, it can see that you are connected to a VPN and how much traffic you send. On a laptop the employer manages, it may see far more, because monitoring software on the device reads your activity before the tunnel encrypts it.
A VPN does nothing about software already installed on the machine.
It hides the location your internet address implies. It does not touch the location your phone reports through GPS to an app you have allowed, and your mobile carrier still knows which towers your phone is using.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
A site can also read your browser's time zone and language, which may not match the country of the exit server.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.