What Does a VPN Actually Do?

Ask ten people what a VPN does and you will get ten answers: "it hides me", "it makes me secure", "it changes my country", "it is for hackers". Most of those answers are half true, which is the problem. A VPN has quite a short job description, and once you can state it clearly, every claim you read in an advertisement becomes easier to judge.

This article lists the five things a VPN really does, walks through an ordinary day to show where each one matters, compares who can see what with and without a VPN, and then spends equal time on the things a VPN never does. If you want the deeper mechanics, the separate piece on how a VPN works covers tunnels and keys. Here the focus is on results you can notice.

The job description in five tasks

Strip away the marketing and a consumer VPN performs these tasks.

1. It wraps your traffic in encryption. Between your device and the VPN server, the data is scrambled so that anyone along that stretch sees unreadable packets instead of pages, messages and file names.
2. It moves your visible address. Websites and apps normally see the public IP address of the network you are using. Through a VPN they see the address of the VPN server instead.
3. It sends everything through one exit point. Instead of each app taking whatever route your local network offers, the traffic leaves from a single place chosen by you or the app.
4. It can place you inside a private network. This is the original use of the technology: connecting a remote laptop to an office or home network as if it were plugged in locally.
5. It keeps name lookups inside the tunnel. When the setup is correct, even the DNS questions about which sites you want to visit travel through the same protected path.

Notice what is not on the list: scanning files, blocking adverts, warning about fake websites, deleting cookies or hiding your name from the sites you log in to. Those are different tools, and some apps bundle them alongside a VPN, but they are not what the VPN itself does.

Task one in practice: the wrapper

Imagine you send a postcard and a sealed letter. Anyone who handles the postcard can read it; the letter keeps its contents private, though the envelope still shows the address. Normal web traffic today is already a mixture. Pages loaded over HTTPS are like sealed letters, but the network around you can still see which site you contacted, and older or poorly built apps may still send postcards.

A VPN puts everything, postcards included, inside one larger sealed envelope addressed only to the VPN server. The cafe's router sees "this laptop is talking to one server" and nothing more. Two things follow from that.

• The wrapper is useful most where the network is least trustworthy: shared Wi-Fi in a cafe, hotel, airport or co-working space.
• The wrapper ends at the VPN server. From there to the final website the traffic travels normally, protected only by whatever the site itself uses. That is why HTTPS and a VPN complement each other rather than replace each other; the article on HTTPS versus VPN compares the two directly.

Task two in practice: the changed address

Every connection you make carries a return address, your public IP. Sites use it for rough location, for rate limits and to recognise repeated visits from the same network. When a VPN is on, the site sees the server's address, not your home or hotel network's address.

What this does in everyday terms:

• A website that guesses your city from your IP will guess the city of the server instead.
• Two people using the same server appear to come from the same address, so the address alone says less about any single person.
• If your hotel network has a poor reputation with a service because many guests abuse it, the VPN address may look different, for better or worse.

What it does not do: a VPN does not stop a website from recognising you when you sign in, nor does it remove tracking cookies and browser fingerprints. Your account is still your account. The article on whether a VPN hides your IP goes through the details and the exceptions such as leaks.

One ordinary day, with the VPN doing its job

Concrete scenes make the five tasks easier to remember. Follow Aom, a marketing freelancer, from morning to night.

7:30, home. Aom checks messages on her home Wi-Fi. She leaves the VPN off. Her router is hers, the network is trusted, and she accepts that her internet provider can see which sites she contacts. This is a conscious choice, not an oversight.

9:15, train station. She joins the free station Wi-Fi to download a client's file. She turns the VPN on first. Now the station network, and anyone else who joined it, sees only an encrypted connection to one server. Task one is doing its work.

10:40, cafe. She logs in to a project tool and a bank dashboard. The VPN is still on. If the Wi-Fi drops for a second, a well-configured app reconnects or blocks traffic until it does, a feature explained in the piece on the VPN kill switch.

13:00, a streaming service refuses to load. The VPN does not fix this, and sometimes causes it, because some services treat VPN addresses with extra suspicion. Aom switches the VPN off for that app and carries on. That is the VPN's side effect, not a failure.

16:20, a message says her parcel is stuck and asks her to pay a small fee through a link. The VPN says nothing about this. The link is a phishing attempt. What protects her is her own check of the sender and address.

21:00, home again. She turns the VPN off, or leaves it on if she likes the privacy from her internet provider. Either choice is reasonable.

The day shows the pattern. The VPN is valuable in the moments when the network is shared or unknown, mostly neutral at home, occasionally inconvenient with apps that dislike it, and irrelevant to scams.

Who can see what, with and without a VPN

A table is the clearest way to compare. "Sees" here means can read in the normal course of operation, not can break in with special effort.

Party	Without a VPN	With a VPN
Other people on the same Wi-Fi	Can see that you connect, and the sites you contact; unencrypted data can be read	See only an encrypted link to the VPN server
The Wi-Fi owner (cafe, hotel)	The sites or servers you contact	One connection to the VPN server
Your internet provider	The sites or servers you contact	One connection to the VPN server and how much data passes
The website you visit	Your network's public IP address	The VPN server's address
The VPN provider	Not involved	Your real IP address and the fact that you connected; what else it can see depends on its design and policy
The website where you log in	Your account activity	Your account activity, unchanged

The last two rows matter. A VPN moves trust, it does not remove the need for it. The party that could see your browsing before, such as your provider, is partly replaced by the VPN company. That is why the article on what a VPN provider can see is worth reading before you choose one.

Task four: joining a private network

The original reason VPNs exist is not privacy from your cafe. It is access. A company wants staff to reach file servers, internal websites and printers from home, without exposing those services to the whole internet. A VPN lets the remote laptop behave as though it sits inside the office network, with traffic encrypted on the way.

The same idea shows up at home. Some people connect to their home router while travelling to reach a photo server or a smart-home panel. Others use it to reach a development server at work. In this mode the VPN is not about changing your visible address at all; it is a door, and the key is your credentials.

A consumer VPN pass such as the ones sold on XPASS works in the other direction. It does not give you access to anything private. It gives you a protected path from your device to a general-purpose server. If you need a connection to your own office, your employer supplies that, and the comparison in business VPN vs personal VPN explains why the two are built differently.

What a VPN does not do

An honest description of a tool includes the edges. The following are common misunderstandings.

• It does not make you anonymous. Your accounts, cookies, payment details and device identifiers still point at you. Anonymity is a bigger goal than a VPN can deliver alone, as discussed in can a VPN make you anonymous.
• It does not protect the device itself. If malware is already on the phone, the tunnel carries its traffic just as faithfully.
• It does not judge websites. A fake banking page loads fine through a VPN.
• It does not guarantee unlocking content or services. Whether an app or site works through a VPN is up to that app or site, and behaviour varies and changes.
• It does not place you above the law or a website's terms. Anything that is illegal or against a service's rules stays that way.
• It does not make the internet faster. Expect a small slowdown, and see why speed changes with a VPN.
• It does not secure weak passwords. Two-factor authentication and unique passwords still matter most for account safety.

These limits are not criticisms. A screwdriver does not hammer nails and nobody calls it defective. They are simply a reminder to match the tool to the problem.

Checking that it is actually doing its job

You do not have to take any VPN's word for it. A few quick checks show whether tasks one to three are working, and a fuller method is in how to test a VPN.

1. Before connecting, search for "what is my IP" in a browser and note the address.
2. Connect the VPN and refresh the page. The address should change to a different one.
3. Disconnect the VPN and confirm the original address returns. This proves the address change came from the VPN and not from something else.
4. Open a DNS leak test page while connected and make sure the resolvers shown are not your normal provider's. If they are, the lookups are escaping the tunnel.
5. Turn the Wi-Fi off and on to see what the app does when the link drops. Note whether it reconnects automatically.

If you use the free VPNclient app that goes with an XPASS pass, you sign in with the username and password from your My Pass page, then repeat the checks above. The download page lists the official links for each device.

A quick decision guide

Because a VPN does a handful of specific things, deciding whether you need one is mostly matching your situation against that list.

If your main situation is...	The VPN task that matters	Likely worth it?
Frequent public or hotel Wi-Fi	Encrypted wrapper	Yes, this is the strongest case
Reaching an office or home network remotely	Private network access	Yes, usually supplied by the employer or set up by you
Not wanting the network owner to see your destinations	Wrapper and single exit	Yes, with trust in the VPN provider
Protection from scam messages	None	No, use other habits
Protection from malware	None	No, use updates and security software
Total anonymity	None alone	No, a VPN is one part of a bigger plan

If your situation sits in the last three rows, a VPN will not solve it however much you pay. The article on whether you need a VPN takes this further with more situations.

Summary

A VPN does a small number of things well: it encrypts the path between your device and a VPN server, shows websites the server's address instead of your network's, sends traffic out through one exit, can join you to a private network, and keeps name lookups inside the protected path. It does not stop scams, clean infected devices, guarantee anonymity or promise access to any specific service. Judge every claim against the five tasks and the picture becomes clear quickly.

If a short, no-renewal option suits the way you work or travel, you can look at the pricing page at your own pace.