You're connected to the café Wi-Fi, you open your banking app, and somewhere between your laptop and the router, a stranger with a packet sniffer is watching. That's the scenario people bring to me most often. And the fix they've heard about—a VPN—is explained in almost every article the same lazy way: "it creates a tunnel." Fine. What's inside the tunnel? Who operates the other end? Those are the questions that actually decide whether a VPN helps you or just moves your trust from one company to another.
I've configured VPNs for my own machines, for two small companies, and I've killed several setups that turned out to be theatre. So this is the honest version: what a VPN (virtual private network) is, how it actually works, and where it quietly fails you.
Key takeaways
- A VPN redirects your traffic through an intermediary server and encrypts it between your device and that server. It does not encrypt the whole internet.
- Your ISP stops seeing which sites you visit. The VPN provider starts seeing it instead. That trade is the whole product.
- Speed drops are real but usually modest on a decent server—typically 10 to 30% in my own tests, much worse on overloaded free tiers.
- A VPN does not stop malware, phishing pages, or a compromised download. That's antivirus territory, and the two tools solve different problems.
- For most people at home, the honest answer to "do I need one?" is: on public Wi-Fi and for geo-blocked content, yes. Everywhere else, it's a preference, not a necessity.
What a VPN actually is, without the marketing gloss
Strip away the padlock icons and a VPN is three things bolted together: a client app on your device, a server operated by a provider, and an encrypted channel between them. Your traffic leaves your machine, gets wrapped in encryption, travels to that server, and exits onto the open internet from there.
The consequence is blunt. Every website you load sees the server's address instead of yours. Your internet provider sees one encrypted stream to one destination, and nothing inside it.
The tunnel metaphor, and where it breaks
The "tunnel" image is accurate for the stretch between you and the provider's server. Past that point, there is no tunnel. Your request walks out onto the public internet in the clear, exactly like anyone else's.
That single detail explains almost every misunderstanding people have about VPNs. Nothing about the destination website, its own security, or the data it stores about you changes because you used a VPN.
What changes once you connect
- Your visible IP address becomes the provider's.
- Your ISP loses visibility into which domains you request.
- Your provider gains exactly that visibility.
- Local network snoops on public Wi-Fi can no longer read your traffic.
How a VPN connection works, step by step
Here's the sequence, and I'll keep it concrete because the abstraction is where most explanations lose people. You launch the app and pick a location—say, Frankfurt.
- Handshake. Your client and the Frankfurt server agree on encryption keys. Modern setups use WireGuard or a similar protocol; older ones use OpenVPN or IKEv2.
- Tunnel creation. Your device builds a virtual network interface. The operating system now believes it has a new network route, and all traffic gets pointed at it.
- Encapsulation. Each packet from your machine gets encrypted, then wrapped inside a new packet addressed to the server. This wrapping is why it's called tunnelling.
- Exit. The server unwraps, decrypts, and forwards your request to the real destination using its own address.
- Return path. The reply comes back to the server, gets re-encrypted, and travels back through the tunnel to you.
All of this happens in milliseconds. On a server 200 km away, I measure added latency around 15 to 25 ms. On one on another continent, it climbs past 150 ms and video calls start to feel like a bad satellite link.
How does a VPN work on a phone?
The same way, with one structural difference: on Android and iOS, the VPN hooks into the operating system rather than a single app, so every application's traffic is routed through it. That's why a phone VPN works across your browser, your mail client, and your banking app at once. It also means the battery cost is constant rather than occasional—I lose roughly 8 to 12% of battery life on a full day with the tunnel always on.
How does a VPN work with Wi-Fi?
Wi-Fi is just the first hop, the radio link between your device and the router. A VPN doesn't change that hop. What it changes is what happens after, so anyone sharing that network can see you're connected but not what you're sending. The hotel, the airport, the conference centre: same principle everywhere.
What a VPN protects you from—and what it doesn't
This is where the marketing gets dishonest, so let's be precise. The protection is narrow and it's real.
| Threat | Does a VPN help? | Why |
|---|---|---|
| Someone reading traffic on shared Wi-Fi | Yes | Encryption between your device and the server |
| Your ISP logging the sites you visit | Yes | They only see an encrypted stream to one address |
| Geo-blocking on streaming catalogues | Sometimes | Works only if the service hasn't blocked the provider's IP ranges |
| Malware, ransomware, phishing pages | No | Encryption doesn't inspect what you download or click |
| A site knowing you're logged in | No | Your account cookies and fingerprint stay with you |
| Ads following you across sites | Partially | Hides your IP, but tracking scripts and logins still identify you |
Do I need antivirus if I have a VPN?
Yes—and this question is where I see the most expensive confusion. A VPN secures the transport of your data between two points. An antivirus inspects files and behaviour on your device. One is a locked courier bag; the other is a guard checking what's inside the package before you open it. Neither replaces the other.
What frustrates me is that some VPN vendors bundle a weak scanner and imply the combination is total protection. It isn't. If you're on Windows, the built-in Defender is genuinely competent now. On a Mac, the built-in protections cover most realistic home scenarios. Adding a paid antivirus is a judgement call about your habits, not a requirement created by your VPN.
The downsides nobody puts on the homepage
A friend of mine ran a VPN on his router for eight months before he admitted the obvious: his connection had gotten noticeably worse and he hadn't noticed because it degraded gradually. That's the most common downside—it arrives quietly.
What's the downside of using a VPN?
The main downside is that you're replacing one trusted party with another, and adding friction while you do it. Concretely: your connection slows, some services actively block known VPN addresses, banking apps occasionally flag the login as suspicious, and you introduce a single company that can see all your traffic if it keeps logs. A provider in a jurisdiction with weak data protection, or one that funds itself by selling anonymised data, is worse than no VPN at all.
The second downside is subtler. Once you start routing everything through one server, everything shares one identity. Sites see thousands of users arriving from the same address, and the CAPTCHA requests multiply. I get noticeably more of them on a shared VPN endpoint than on my home connection.
What does a VPN cost per month?
Paid plans generally land between roughly $3 and $12 per month, and the number you actually pay depends almost entirely on commitment length. Monthly billing sits at the top of that range; a two or three-year prepayment pushes it toward the bottom, often under $4. There are legitimate free providers, but they're usually free because something else is being monetised—bandwidth resale, ad injection, or usage caps tight enough to make streaming pointless.
My own rule after testing a dozen of them: if a provider can't explain in one paragraph how it makes money from a free tier, assume your traffic is the product.
Does a normal person need a VPN?
Honestly? Fewer people than the industry implies. I use one on public networks, when I travel, and when I want a streaming catalogue that isn't available at home. I don't run one permanently on my desktop, because for my use—home fibre, no sensitive browsing—the speed cost and the CAPTCHA tax outweigh the benefit.
Where I'd say yes without hesitating:
- You work regularly from cafés, airports, hotels, or co-working spaces.
- You travel to countries that filter or monitor internet access.
- You want to stop your ISP from building a browsing profile.
- You need a foreign catalogue for content you legitimately pay for.
Where I'd say it's optional: a home connection you control, with a provider you don't distrust, used for ordinary browsing. That's the use case the ads never describe, because it doesn't sell subscriptions.
The part I got wrong early on
I spent a fortnight assuming a VPN would fix a tracking problem on a client's site. It didn't. The tracker was identifying visitors through a canvas fingerprint and a logged-in cookie, both of which survive a change of IP address completely intact. I had to rewrite the consent logic instead. Lesson: a VPN changes where you appear to come from, not who you appear to be.
So the real question isn't "is a VPN good." It's "whose logging policy do I trust more, my ISP's or a provider's"—and for a lot of people, the honest answer is neither. That's fine too. Knowing which door you're choosing is worth more than walking through one on faith.
