What Does a VPN Actually Protect?

A VPN protects a narrow but valuable thing: the journey your data makes between your device and the VPN server. It encrypts that stretch, hides the sites you visit from the local network and internet provider, and swaps your IP address for the server's. It does not protect your device, your accounts or your identity in general. Knowing exactly where the line sits lets you use a VPN well and avoid false confidence.

This article lists what a VPN does protect, with concrete examples, and then flags the common places where people assume protection that is not there. For a deeper look at the second half, see what a VPN cannot protect you from.

The protection boundary

Think of your connection as a chain with three parts:

1. Device to VPN server. This is the encrypted tunnel. The VPN protects this part.
2. VPN server to the website. Traffic leaves the tunnel here. Whether it stays encrypted depends on whether the site uses HTTPS.
3. The website and your account. Anything that happens on the site, including how it stores your data, is outside the VPN's control.

Everything a VPN protects is in the first part of that chain, plus the side effect that the second part uses the server's IP address, not yours.

What a VPN protects well

Traffic on untrusted networks

On a network you do not control, such as hotel, airport or cafe Wi-Fi, other users and the operator can potentially watch or tamper with unprotected traffic. The FTC's public Wi-Fi guidance recommends being careful on such networks and notes that encryption matters.

A VPN wraps your traffic in encryption between your device and the server, so anyone on that Wi-Fi sees only scrambled data going to one address. A practical example: you check your email on a train station network. Without a VPN, the operator sees the domains your device contacts. With a VPN, they see a single encrypted link.

This does not mean public Wi-Fi is suddenly safe. It means that one major class of risk, interception on the local network, is reduced. See how to stay safer on public Wi-Fi for the wider habits, and VPN for public Wi-Fi.

What the local network and your provider can see

Your internet provider, school, office or building network can normally log which domains you contact. With a VPN, they see that you connect to the VPN server and the volume of data, but not the sites inside the tunnel. If you would prefer that your provider does not hold a record of your browsing destinations, a VPN removes them from that role.

The trade-off is that the VPN provider then sees that information instead. You are choosing who has the view, not eliminating it.

The IP address websites see

Websites and advertising systems log your public IP address, which normally ties to your internet provider and rough location. With a VPN, they log the server's address. This means:

• A site cannot link your visit to your home connection through the IP address alone.
• Several VPN users may share one address, which makes IP-based tracking less precise.
• Your home IP address is less exposed in places such as online game lobbies or peer connections, where other participants might otherwise see it.

This protects your IP address in particular. It does not protect against tracking by other means, which is covered below and in does a VPN hide your IP address.

DNS lookups, when handled correctly

Every time you visit a site your device does a DNS lookup. A properly set up VPN sends those lookups through the tunnel too, so the local network does not see them. If they escape, that is a DNS leak, which defeats part of the point.

Sites that do not use HTTPS

Most sites use HTTPS, which encrypts traffic between browser and site. Some older or poorly configured services still use plain HTTP or unencrypted protocols. A VPN encrypts that traffic on the way to the server, so the local network cannot read it. After the server, it travels unencrypted again, so the VPN reduces exposure without fixing the underlying weakness. The article on HTTPS vs VPN compares the two.

What a VPN does not protect

These are the most frequent misunderstandings.

Assumption	Reality
"A VPN makes me anonymous."	No. The VPN provider sees your real IP address, and sites can identify you through logins, cookies and fingerprinting.
"A VPN stops viruses."	No. A malicious download is still malicious inside a tunnel.
"A VPN stops phishing."	No. A fake login page works the same through a VPN. See how to recognize phishing websites.
"A VPN protects my accounts."	No. Strong unique passwords and two-factor authentication do that.
"A VPN keeps ad tracking away."	Only partly. Cookies, account logins and browser fingerprints still follow you.
"A VPN protects me if a site is hacked."	No. Data stored by a breached site is unaffected by your tunnel.
"A VPN protects an infected device."	No. Malware on your device can read data before it is encrypted.

A worked example

Imagine you are on a business trip using hotel Wi-Fi. You connect to the VPN, open your email in a browser, read a message from your bank with a link, and tap the link.

• Protected by the VPN: Other guests and the hotel network cannot see which domains your laptop contacts, because the traffic is inside the tunnel. The sites you visit see the VPN server's address, not the hotel's.
• Protected by HTTPS, not the VPN: The contents of the pages you read are encrypted between your browser and the site.
• Not protected by either: If the link in the email leads to a convincing fake bank page and you type your password, the attacker gets it. Only careful checking and two-factor authentication help there.

Layers matter. The VPN protects the network path, HTTPS protects each site connection, and your own habits protect your accounts.

Practical steps to get the protection you expect

1. Connect before you use untrusted networks, not after. Turn the VPN on as soon as you join the Wi-Fi.
2. Confirm the connection. Check that your app shows as connected and that your visible IP address has changed. The Help Center has a guide on checking whether your VPN is working.
3. Keep a kill switch or equivalent enabled if available, so a dropped tunnel does not silently send traffic outside it. More in what is a VPN kill switch.
4. Keep HTTPS and updates on. Do not ignore browser warnings about certificates, and install system updates.
5. Protect accounts separately. Use a password manager and two-factor authentication.

Limits worth remembering

• Trust moves to the provider. The VPN server operator can technically see where your traffic goes. Choose a provider you can read clear information about, and do not assume a particular logging policy unless the provider states one.
• Not every country treats VPNs the same. Laws differ, and a VPN does not override them or a site's terms of service.
• Performance changes. Encryption and the extra hop can affect speed.

Summary

A VPN protects the stretch between your device and the VPN server, reduces what your local network and internet provider can see about your browsing, and replaces your IP address in the eyes of websites. It does not protect your device, your passwords, your accounts or your identity from the sites you log in to. Use it where it helps most, such as public Wi-Fi and travel, and pair it with HTTPS, updates and two-factor authentication.

If that fits what you need, the pricing page shows the available passes, and the Help Center covers setup.