What Is a VPN?

A VPN, short for virtual private network, is a service that sends your internet traffic through an encrypted connection to a server run by the VPN provider, and from there on to the websites and apps you use. Instead of your phone or laptop talking directly to the internet through your home router, hotel Wi-Fi or mobile carrier, it first talks to the VPN server. Everyone between you and that server sees only scrambled data.

That one change has useful consequences, and some limits people often misunderstand. This guide explains in plain language what a VPN is, what it is used for, what it does not do, and what to think about before using one. If you want the mechanics, the companion article on how a VPN works goes step by step.

A VPN in one picture

Picture mailing a letter. Normally you hand an open postcard to whoever runs the local post office, and every handler along the way could read it. With a VPN, you put the letter inside a locked box, send the box to a trusted forwarding address, and that address unlocks it and delivers the letter on to the real recipient. The people who carried the box saw only a locked box going to the forwarding address. The recipient sees the forwarding address as the sender, not your home.

In network terms:

• The locked box is the encrypted tunnel between your device and the VPN server.
• The forwarding address is the VPN server.
• The return address the recipient sees is the VPN server's IP address, not the one your internet provider gave you.

The analogy has one important flaw: the forwarding service itself can see who sends what. That is why the choice of provider matters, which we return to below.

What a VPN actually does

A VPN does two main things.

It encrypts traffic between your device and the VPN server. Anyone watching the network in between, such as the operator of a cafe Wi-Fi hotspot, someone else on that network, or your internet provider, cannot read the contents of what passes through the tunnel. They can see that you are connected to a VPN server and roughly how much data flows, but not which sites you open inside the tunnel.

It changes the IP address that websites see. Every connection to a website comes from a public IP address. Without a VPN, that address belongs to your internet provider and usually points to your general area. With a VPN, the website sees the address of the VPN server instead. This is why a VPN can make your connection look like it comes from a different place, and why it stops a site from linking your visit to your home connection through the IP address alone.

Common reasons people use a VPN

• Public Wi-Fi. Airport, hotel and cafe networks are shared with strangers and run by people you cannot vet. A VPN adds a layer of encryption on top of whatever the network does. Consumer protection guidance such as the FTC's page on public Wi-Fi discusses the risks of open networks. See also VPN for public Wi-Fi.
• Travel. When you are abroad, a VPN lets you connect through a server in another place, which can help you reach your usual services from where you are, subject to the rules of those services and local law.
• Remote work. Companies often run their own VPNs so staff can reach internal systems securely. A personal VPN is different from that, but the underlying idea is the same.
• Keeping browsing away from the local network. If you do not want your internet provider, school or workplace network to see the domain names you visit, a VPN moves that visibility from them to the VPN provider.

A simple example

Suppose you are at a station waiting for a train, using the free Wi-Fi to check your bank balance and email. Without a VPN, the Wi-Fi operator can see which domains your device contacts, and anyone who has set up a fake hotspot with a similar name could try to capture traffic that is not otherwise protected. With a VPN switched on, your device first builds the tunnel to the VPN server. Your bank page and email now travel inside that tunnel. The station network sees one encrypted connection to one address.

Note that your bank's website still uses HTTPS, which is its own encryption between your browser and the bank. A VPN does not replace that. The two work at different layers, and the article on HTTPS vs VPN covers how they fit together.

What a VPN does not do

Understanding the limits is as important as knowing the benefits.

• It does not make you anonymous. The VPN provider can see your real IP address and, in principle, your traffic metadata. Websites can still identify you through logins, cookies and browser fingerprinting. If you sign into your usual account, the site knows who you are regardless of your IP address.
• It does not stop malware or phishing. A VPN will not stop you from downloading a malicious file or typing your password into a fake page.
• It does not make every site or service available. Services may block VPN addresses, and terms of service and local law still apply.
• It does not guarantee speed. Routing through another server adds distance and processing, so connections can be slower or, occasionally, faster depending on circumstances.
• It does not remove the need for good habits. Updates, strong unique passwords and two-factor authentication still matter much more for account safety.

A fuller list is in the article on what a VPN cannot protect you from.

Things to check about any VPN

Because the VPN provider sits where your internet provider used to sit, you are moving trust rather than removing it. A few practical questions are worth asking about any service before you pay:

1. Who runs it and how is it described? Look for a clear company identity, a readable privacy policy and plain statements about what is and is not collected.
2. How do you pay and how long are you committed? Some services bill automatically on a schedule; others sell fixed periods you choose to extend or not. Know which one you are buying.
3. What setup does it need? Check that it supports the devices you actually own and that setup instructions are clear.
4. Does it do what you need? If your goal is safer public Wi-Fi, that is a different requirement from trying to keep one account private.

For a prepaid pass such as those XPASS sells, you pay once by card for a fixed number of days, and nothing renews automatically. Login details and setup instructions appear on your My Pass page after payment, and the pass period starts when the account is created.

How VPNs are built

Under the hood, a VPN uses a protocol, which is an agreed set of rules for setting up the tunnel and encrypting data. Well-known examples include WireGuard, OpenVPN and IPsec with IKEv2. Different protocols trade off speed, compatibility and simplicity, but you rarely need to pick one yourself, because the app or profile for your service usually selects it. If you are curious, read what a VPN protocol is.

Summary

A VPN is an encrypted tunnel from your device to a server run by the VPN provider. It hides the contents of your traffic from the local network and replaces your IP address with the server's when websites see you. It is useful on public Wi-Fi, when travelling and when you do not want the local network to see which sites you visit. It is not a tool for anonymity, it does not protect you from phishing or malware, and it shifts trust from your network to the provider rather than removing it.

If you decide a VPN fits your needs, you can look at the options on the pricing page.