How Does a VPN Work?

When you connect to a VPN, your device builds an encrypted tunnel to a VPN server, and from then on your internet traffic travels inside that tunnel to the server before going out to the wider internet. Websites see the server, not you. The local network sees a single encrypted connection, not a list of sites.

That sentence hides a few steps. This article follows a single web request from start to finish so you can see what is encrypted, where, who sees what, and why a VPN can change both your apparent location and your speed. If you are new to the idea, start with what a VPN is and come back.

Without a VPN: the normal path

Without a VPN, opening a website works like this:

1. Your browser asks a DNS resolver, usually run by your internet provider, to turn a name such as example.com into an IP address. See how DNS works.
2. Your device sends packets to that address through your router and your internet provider.
3. The website replies to the public IP address your internet provider assigned to you.

Along this route, your internet provider and the Wi-Fi operator can see the destination addresses and DNS lookups. If the site uses HTTPS, they cannot read the page contents, but they can still see which site you are talking to. The website sees your provider-assigned public IP address.

Step 1: the VPN app sets up the tunnel

When you press connect, your VPN app contacts the VPN server and the two run a handshake. In this handshake they:

• Authenticate each other. The server checks that you are an allowed user, using login details or keys. Your app checks that it is really talking to the server it expects.
• Agree on keys. Using public-key cryptography, they work out shared secret keys without sending those keys across the network. These keys protect everything that follows.
• Agree on settings. This includes the cipher used for encryption and the virtual IP address your device will use inside the tunnel.

The rules for this process are called a VPN protocol. Examples include WireGuard, OpenVPN, and IPsec with IKEv2 (the IPsec architecture is described in RFC 4301). You can read more in what a VPN protocol is.

Step 2: your device creates a virtual network connection

Once the handshake finishes, your operating system gets a virtual network adapter. You can think of it as a second, software-only network card that leads to the VPN server instead of your router. The system then changes its routing table so that most traffic goes through this adapter.

This is why VPN apps often ask for permission to add a VPN configuration to your phone or computer. They are adding that virtual adapter and rewriting the routes. Some VPNs also allow exceptions, so chosen apps bypass the tunnel. That feature is called split tunneling.

Step 3: packets are wrapped and encrypted

Take a single request, for example your browser fetching a page. The browser creates a packet addressed to the website. The virtual adapter then does something called encapsulation:

1. The original packet, including its destination address, is encrypted. Authentication data is added so tampering can be detected.
2. The encrypted blob is placed inside a new outer packet addressed to the VPN server.
3. The outer packet goes out through your normal connection, whether that is Wi-Fi, mobile data or Ethernet.

To the Wi-Fi operator and internet provider, the visible traffic is a stream of packets between your device and the VPN server's address. The real destinations are inside the encrypted part. The outer addressing follows the ordinary rules of the Internet Protocol (RFC 791).

Step 4: the VPN server unwraps and forwards

The VPN server receives the outer packet, decrypts it with the shared key, and recovers your original request. It then sends that request on to the website, using the server's own public IP address as the source. From the website's point of view, the visitor is the VPN server. If many users share that server, their requests all appear to come from the same address.

If the VPN also handles DNS, which a well-configured one should, the server or a resolver linked to it answers your name lookups, so they are not exposed on your local network. When this fails and lookups slip out through your normal connection, that is a DNS leak.

Step 5: the response travels back

The website replies to the VPN server's address. The server takes the reply, encrypts it with the session keys, wraps it in a new packet addressed to your device's tunnel address, and sends it through the internet to you. Your VPN app decrypts the packet and hands the original reply to your browser, which shows the page.

Everything repeats for every packet, many times per second, though in modern protocols the work is light enough that phones handle it comfortably.

Who can see what

Party	Without VPN	With VPN
Wi-Fi operator or local network	Destination addresses and DNS lookups, plus unencrypted content	One encrypted connection to the VPN server, and how much data flows
Your internet provider	Same as above	Same as the row above: the VPN server address and traffic volume
The website	Your provider-assigned public IP address	The VPN server's public IP address
The VPN provider	Nothing	Your real IP address, the destinations you connect to, and when
Content of HTTPS pages	Visible only to your browser and the site	Still visible only to your browser and the site

The last two rows matter. A VPN does not remove the observer. It moves the vantage point from your local network and internet provider to the VPN provider, and so the question of who you trust becomes the key one.

Why a VPN affects speed and location

Speed. Your data now takes a detour through the server, which adds distance and a little processing for encryption. If the server is close and not overloaded, the difference may be small. If it is far away or busy, it can be noticeable. Occasionally a VPN seems faster because it takes a better route than your provider's default.

Apparent location. Websites estimate your location partly from your IP address. When you use a VPN server, they see that server's address and often guess a location near it. Many other signals, such as your account profile, device language settings and GPS permission in apps, can still reveal where you really are.

What to watch for

• Make sure the tunnel is up. Apps usually show a connected indicator, and on phones a key or VPN icon appears. If the connection drops silently, traffic may go out unprotected unless a kill switch blocks it. Read about the VPN kill switch.
• Check for leaks after setup. A short test confirms that your visible IP address and DNS requests match the VPN rather than your provider.
• Use HTTPS as well. Inside the tunnel, traffic is protected until it leaves the server. From there to the website, protection depends on the site using HTTPS.
• Remember the endpoint. The VPN server sees your traffic in decrypted form between decryption and forwarding, subject to HTTPS on top.

Summary

A VPN works by performing a handshake with a server, creating a virtual network adapter on your device, encrypting each packet and wrapping it in an outer packet to the server, and then having the server decrypt and forward it using its own IP address. Replies take the same route in reverse. The result is that your local network sees only an encrypted link, and websites see the server's address, while the VPN provider itself becomes the party that can see your traffic destinations.

If you are ready to pick a pass, the pricing page shows how XPASS offers them.