HTTPS vs VPN: What Each One Protects

People often ask whether a VPN is still useful now that most websites use HTTPS. The honest answer is that they protect different parts of the journey. HTTPS protects the conversation between your browser and one specific website. A VPN protects the path between your device and a VPN server, for every app. Knowing the boundary of each helps you decide what to rely on and what not to expect.

This article compares them side by side, shows what an observer on the same network can still see in each case, and explains why neither replaces careful habits such as spotting phishing websites.

What HTTPS does

HTTPS is the ordinary web protocol, HTTP, running inside an encrypted connection created with TLS. When your browser opens https://example.com, it and the server agree on keys and set up a private channel. The current version, TLS 1.3, is defined in RFC 8446.

That channel gives you three things:

• Confidentiality: anyone watching the network cannot read the page, the form fields or the cookies being exchanged.
• Integrity: the data cannot be altered in transit without detection, so a network operator cannot quietly inject content into the page.
• Authentication of the site's name: the server proves, with a certificate issued by a trusted authority, that it is entitled to use the domain name in the address bar. Free authorities such as Let's Encrypt have made this standard for small sites too.

The padlock icon reflects exactly this and nothing more.

What a VPN does

A VPN creates an encrypted tunnel from your device to a VPN server. Everything your device sends, from browsers, mail apps and games, is wrapped inside that tunnel, and the VPN server forwards it to the internet. If you need the fundamentals, read what a VPN is.

Consequences:

• The local network, such as a café router or hotel Wi-Fi, sees an encrypted stream to the VPN server instead of your individual connections.
• Websites see the VPN server's IP address instead of the one your internet provider assigned.
• Protection covers apps that do not use HTTPS at all.

The encryption ends at the VPN server. From there to the destination, the traffic travels on the normal internet, which is why HTTPS is still valuable inside a VPN.

Side-by-side comparison

Question	HTTPS only	VPN only (site uses plain HTTP)	HTTPS and VPN
Can the local Wi-Fi owner read page contents?	No	No, but the VPN operator and anyone between the VPN server and the site can	No
Can the local network see which domain you visit?	Yes, usually through the DNS lookup and the connection	No, only the VPN server address	No
Can the website see your real IP address?	Yes	No, it sees the VPN server	No
Is the site's identity checked?	Yes, by its certificate	No	Yes
Does it cover apps other than the browser?	Only apps that use TLS	Yes	Yes
Does it stop malware or fake sites?	No	No	No

A worked example: a café and two logins

You are in a café and log in to your bank, which uses HTTPS.

• HTTPS alone. Another customer on the same Wi-Fi who is running a packet capture sees that your phone connected to your bank's domain, and a stream of encrypted data. They cannot read your password or balances. If a fake hotspot tries to impersonate the bank, your browser warns you because the certificate will not match.
• Adding a VPN. The café network now sees only an encrypted connection to the VPN server. The domain name of your bank is hidden from it. The bank itself sees the VPN server's address, which can sometimes trigger extra security checks on your account.

Now picture an old device, such as a smart-home gadget or a legacy app, that talks plain HTTP. HTTPS offers it nothing, since it is not used. A VPN protects that traffic from the local network, but only up to the VPN server. The public Wi-Fi guide goes through that scenario in detail.

What HTTPS leaves visible

Even with a valid HTTPS connection, observers on the network can usually learn:

• The domain you connect to. It appears in the DNS lookup, and in the setup of the TLS connection, although newer techniques can hide parts of it. See how DNS works.
• The IP address of the server, and when you connected.
• Roughly how much data moved, which can hint at what you did, for example streaming rather than reading.

The website itself, plus any advertisers and trackers embedded in the page, also still see your IP address and whatever you send them.

What a VPN leaves visible

With a VPN, the local network learns almost nothing except that you use a VPN and how much data flows. In exchange:

• The VPN operator can see the destination addresses your traffic is going to, because it forwards them. HTTPS limits what it can read inside the content.
• The website still sees your login, your cookies and everything you submit. A VPN does not remove the account-based tracking that sites do.
• Your device can still be tracked through browser features and fingerprinting, regardless of the tunnel.

For a full list of what is and is not protected, see what a VPN protects.

Common misunderstandings

• "The padlock means the site is safe." It means the connection is encrypted. A phishing page can have a valid certificate for its own address.
• "A VPN makes HTTPS unnecessary." The tunnel stops at the VPN server, so the stretch beyond it is only protected if the site uses HTTPS.
• "HTTPS hides what sites I visit." It hides what you do on them, not which domains you connect to.
• "With both, I am fully protected." Neither stops you from entering a password on a fake page, installing a malicious app, or reusing a leaked password.

Practical steps

1. Check the address bar for https:// before entering any password or payment detail, and read the domain itself carefully.
2. Do not click through browser certificate warnings. They mean the connection or the site's identity cannot be trusted.
3. On public Wi-Fi, use a VPN for apps that you cannot inspect, and still prefer HTTPS sites.
4. Turn on two-factor authentication for important accounts, so a stolen password alone is not enough. See what two-factor authentication is.
5. Keep your operating system and browser updated, as that is where most real-world fixes for TLS and certificate problems arrive.

Summary

HTTPS encrypts and authenticates the connection to a specific website, and the padlock only confirms that. A VPN encrypts everything between your device and a VPN server, hides your activity from the local network and swaps your visible IP address. They complement each other and neither replaces judgement about which site you are on. If you would like to try a VPN without a subscription that renews itself, see how a prepaid pass works.