What a VPN does, and what it does not

A plain account of what a VPN hides, who can still see what, how it leaks, and how to check that yours is working.

Updated Sep 26, 20262 min read

Before you run anything

These guides are reference material, not instructions for your particular network. Run commands only against networks you own or have explicit permission to examine — in many countries probing a network you are not authorised to touch is a criminal offence regardless of intent. Everything here is provided without warranty: you are responsible for what you run and for its effect on your systems.

A VPN builds an encrypted tunnel from your device to a server run by someone else, and sends your traffic through it. That one idea explains what it can and cannot do.

What changes

Sites see the VPN server’s address, not yours. Your approximate location, as far as an IP address reveals one, becomes the server’s.
Your internet provider sees only the tunnel: that you are connected to a VPN, and how much data flows, but not which sites you visit.
On public Wi-Fi, other people on the same network cannot see or tamper with your traffic.

What does not

You are not anonymous. The VPN provider can see what your internet provider used to see. Trust has moved, not disappeared — choose a provider whose business you understand.
Accounts and cookies still identify you. Logging in to a site tells it who you are, whatever your address.
Malware and phishing are untouched. A VPN encrypts traffic; it does not judge it.
It does not change what is allowed. Laws and service terms still apply, and VPN use itself is restricted in some countries.

Two different kinds

A consumer VPN is about privacy: it sends your traffic out to the internet from somewhere else. A work VPN is about access: it puts your device inside the company network so internal systems are reachable, and often sends only company traffic through the tunnel (“split tunnelling”) while everything else goes directly.

How VPNs leak

A VPN only protects the traffic that actually goes through it.

WebRTC can reveal your real public address to a website even with the VPN on. The WebRTC leak test checks this.
IPv6 traffic may bypass a VPN that only carries IPv4, exposing your real IPv6 address.
DNS requests may still go to your provider’s resolver, revealing which sites you look up.
Dropped connections: if the tunnel falls and the device reconnects directly, traffic goes out unprotected. A “kill switch” setting blocks traffic until the tunnel is back.

Checking yours

Note the address at the top of the home page with the VPN off, then turn it on and reload. It should change to the VPN’s, in the VPN’s location.
Run the WebRTC leak test with the VPN on. It should show only the VPN’s address.
If your line has IPv6, check the dual-stack test too: with the VPN on, the IPv6 address should disappear or belong to the VPN.

Protocols, briefly

WireGuard is modern, small and fast, and is now the default in most VPN apps. OpenVPN is older, widely supported and very configurable. IKEv2/IPsec is built into phones and handles switching between Wi-Fi and mobile data well. Any of the three is sound when set up properly; the provider matters more than the protocol.

All guides