VPN Basics

What a VPN does, in everyday language. No jargon, no pressure.

What a VPN actually does

It creates an encrypted connection from your device to a server run by the VPN company. Websites see that server, not you.

What it helps with

Keeping your activity private on public Wi-Fi
Hiding which sites you visit from your internet provider
Reaching services tied to another location

What it doesn't do

Make you anonymous when you're signed in
Stop malware, phishing or weak passwords
Remove the need to trust someone: you're trusting the VPN company instead

Read the full guide: what a VPN protects and what it doesn't

Common questions

Is using a VPN legal?

In most countries, yes. Some restrict VPNs to approved providers or penalize using one to break other laws. Check our World Guide and official sources for your destination.

Will a VPN slow down my internet?

A little, usually. Connecting to a nearby server keeps the slowdown small; distant servers add more.

Are free VPNs safe?

Some are fine for light use. Many pay for themselves through ads or data, so read what the app collects. Proton VPN's free plan is the exception on our shortlist: no ads, no data cap, and the same audited no-logs policy as its paid plan, limited to one device.

Does a VPN make me anonymous?

No. It hides your traffic from the local network and your internet provider, but sites still recognize you through accounts, cookies and your browser.

What is a kill switch?

A setting that blocks your internet if the VPN connection drops, so nothing is sent unprotected without you noticing.

What does "no-logs" mean?

A promise not to keep records of what you do online. An independent audit is the best evidence that the promise is kept, which is why we weight audits heavily.

Can I use one subscription on all my devices?

Usually several at once. Check the simultaneous-connection limit and that there's an app for each device.

VPN terms, explained

The words you'll see on provider pages, in plain language.

Kill switch: Blocks your internet if the VPN connection drops, so nothing is sent unprotected without you noticing.
No-logs policy: A promise not to keep records of what you do online. Independent audits are the best evidence that the promise is kept.
Audit: An outside firm checks the company's systems and confirms they work the way it claims. Repeated audits are stronger evidence than one.
WireGuard: A modern, fast and widely reviewed way of encrypting VPN connections. Several providers build their own versions of it.
NordLynx: NordVPN's version of WireGuard.
Lightway: ExpressVPN's own fast, lightweight method for encrypting connections.
GotaTun: Mullvad's own implementation of WireGuard, independently audited.
Protocol: The method a VPN uses to set up and encrypt your connection.
Multi-hop: Routes your traffic through two VPN servers instead of one, for extra privacy at some cost in speed.
Obfuscation: Disguises VPN traffic as ordinary web traffic, which helps on networks or in countries that block VPNs.
VPN firewall: Blocks every connection that doesn't go through the VPN, all the time. Unlike a kill switch, it doesn't wait for the VPN to drop before acting.
Always-On VPN: A phone setting that keeps traffic inside the VPN and blocks it if the VPN isn't connected, acting as the kill switch.
Split tunneling: Lets you choose which apps use the VPN and which connect normally.
Memory-only servers: Servers that keep nothing on hard drives, so everything is wiped whenever they restart.
Open source: The app's code is public, so independent experts can check what it actually does.
Jurisdiction: The country whose laws a VPN company must follow, including rules on handing over data.
Ad and tracker blocking: Built-in blocking of ads, trackers and known malicious sites.
DAITA: A Mullvad feature that adds decoy traffic so the pattern of your activity is harder to analyze.
Dedicated IP: An internet address only you use. Some banks, websites and work systems trust it more than shared VPN addresses.

Still not sure you need one? That's a reasonable place to be.