What Is a VPN and How Does It Work?

By
Harris
-
17

Key Points

  • A VPN (virtual private network) sends your internet traffic through a server run by the VPN provider, usually inside an encrypted tunnel, so websites see the VPN server’s address instead of yours.
  • An encrypting VPN hides the content of your traffic from your internet provider and from anyone snooping on the same Wi-Fi network, but the VPN provider itself can see that traffic.
  • The FTC says a VPN generally will not make you anonymous. Sites can still track you through logins, forms and other information you share, and a VPN does not stop malware or phishing.
  • Common VPN protocols include IPsec, OpenVPN and WireGuard. Not every VPN app actually encrypts all of your traffic, so research a provider before trusting it.
  • Free VPN apps often make money from ads or by sharing data with third parties, so read the privacy policy and terms before you install one.

A VPN, short for virtual private network, is a service that creates a private, usually encrypted connection between your device and a server run by the VPN provider. Your internet traffic travels through that connection before it reaches the wider internet, so people on your local network and your internet provider cannot easily read it, and the websites you visit see the VPN server’s address instead of your own.

That makes a VPN a useful privacy and security tool in some situations, but it is not a cure-all. This guide explains how a VPN works, what it does and does not protect, how free and paid services differ, and when it makes sense to use one, based on guidance from the Federal Trade Commission (FTC), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST).

What is a VPN?

A VPN is software, and usually a service, that routes your device’s traffic through another network. In the FTC’s description, when you use a VPN app, the data sent from your phone, such as your browsing or the apps you use, “is first routed through servers controlled by the VPN provider.” The app can make your traffic to a website appear to come from the VPN’s servers rather than from you.

VPNs did not start as a consumer product. Businesses have long used them so employees on the road can work as if they were sitting on the company network. CISA and the National Security Agency describe remote access VPNs as a way for off-site users to “tunnel into protected networks.”

How does a VPN work?

What is a VPN tunnel?

“Tunneling” means placing your normal internet traffic inside another connection. Your device takes each piece of data, wraps it, and sends it to the VPN server. The server unwraps it and forwards it to the website or app you are trying to reach.

What role does encryption play?

Encryption scrambles the data inside the tunnel so it cannot be read without the right keys. The FTC explains that on an open public Wi-Fi network, other people on the same network can see your traffic, but when you use a VPN app that encrypts the data, anyone monitoring that Wi-Fi connection “only sees gibberish,” even if the site you are visiting does not use encryption itself.

There is an important catch. The FTC warns that not all VPN apps actually encrypt your information. Some use protocols that do not encrypt traffic at all, or encrypt only part of it.

What are WireGuard, OpenVPN and IPsec?

A VPN protocol is the set of rules the device and server use to build the tunnel and handle encryption. Three names come up most often:

  • IPsec. NIST describes Internet Protocol Security as “a framework of open standards for ensuring private communications over Internet Protocol (IP) networks,” usually set up with the Internet Key Exchange (IKE) protocol. NSA and CISA guidance for organizations recommends standards-based IKE/IPsec VPNs.
  • OpenVPN. An open-source VPN that, according to its project documentation, uses the industry standard SSL/TLS protocol, the same family of security technology behind https websites.
  • WireGuard. A newer, open-source protocol that, according to its developers, encapsulates traffic over UDP and uses public keys exchanged much like SSH keys. It was first released for the Linux kernel and now runs on Windows, macOS, iOS, Android and other systems.

For most home users, the protocol matters less than whether the provider is trustworthy.

What does a VPN protect?

Public Wi-Fi

CISA warns that many public access points are not secured and the traffic they carry is not encrypted, which lets attackers use “sniffing” tools to capture sensitive data. It also describes “evil twin” attacks, in which a criminal sets up a fake hotspot that imitates a real one so victims connect through the attacker’s system. An encrypted VPN tunnel makes intercepted traffic much harder to read in both cases.

The risk is lower than it used to be. The FTC now says that because most websites use encryption, shown by a lock symbol or https in the address bar, connecting through public Wi-Fi “is usually safe.” A VPN adds a layer on top of that, and CISA’s wireless security guidance also advises confirming a hotspot’s name and password before connecting and turning off file sharing.

Your internet provider’s view

According to the FTC, a VPN app will typically obscure the content of your traffic from your internet service provider or public Wi-Fi provider.

Your IP address

Your IP address is the number that identifies your connection on the internet. With a VPN on, websites see the VPN server’s address instead. Because the server can be in another city or country, a VPN can make it appear that your traffic is coming from somewhere else.

What does a VPN not protect?

It does not make you anonymous

The FTC is direct on this point: a VPN app “generally isn’t going to make you entirely anonymous.” It “just shifts trust” from your internet provider or Wi-Fi network to the VPN provider, which can see the same traffic your provider used to see. Sites may also be able to tell that you are using a VPN.

Tracking, cookies and logins still work

A VPN changes where your traffic appears to come from, not who you are once you sign in. The FTC notes that websites can still use identifying information you share with them, such as an email address you type into a form, to track you. If you log in to a social media, shopping or email account, that service knows it is you.

It is not antivirus

A VPN protects data in transit. It does not scan files, block malicious attachments or stop you from entering your password on a fake site. The FTC points out that scammers can build fake websites that use encryption, so your data may be protected on the way to the site “but it won’t be safe from scammers operating the site.” CISA lists antivirus software, firewalls and software updates as separate protections. A VPN will not stop ransomware that arrives through an infected download, and it will not catch a convincing phishing email.

Free vs paid VPNs: what is the trade-off?

Running VPN servers costs money, so a free VPN has to pay for itself some other way. The FTC says many VPN apps are free “because they sell advertising within the app, or because they share your information with (or redirect your traffic through) third parties.” The agency also cites researchers who studied almost 300 VPN apps and found that some did not use encryption and some shared data with third parties.

Paid services are not automatically trustworthy either. Whichever you consider, the FTC recommends the same checks:

  • Research the app and its developer, and read outside reviews from sources you respect. “The fact that an app promises security or privacy doesn’t necessarily make it trustworthy.”
  • Review the permissions the app requests, and question any that do not fit its purpose, such as access to your text messages.
  • Confirm that the app actually encrypts your traffic.
  • Read the privacy policy and terms to see what it collects and whether it shares information with advertisers or other third parties.

What does a logging policy mean?

A logging policy describes what records a VPN keeps, such as when you connected, from which address and which sites you visited. Because the VPN provider can see the traffic your internet provider once saw, its logging and data-sharing rules matter as much as its encryption. Treat any “no logs” promise as a claim to check in the privacy policy and outside reviews, not a guarantee.

When should you use a VPN?

A VPN makes the most sense when you do not trust the network you are on or want to keep your browsing away from your internet provider. Common examples include:

  • Using open or unfamiliar Wi-Fi at airports, hotels, cafes or conferences
  • Connecting to your employer’s network when working remotely, using the VPN your workplace provides
  • Keeping the content of your traffic away from your home internet provider

For everyday browsing on a secured home network with https sites, a VPN adds less.

Is using a VPN legal in the U.S.?

VPNs are sold and used openly in the United States, and federal agencies such as the FTC and CISA publish advice on choosing and securing them. A VPN does not change what is legal, though. Activity that is against the law, or that breaks a service’s terms of use, stays that way when it runs through a VPN. Rules differ abroad, so travelers should check local laws.

How does a VPN fit with other protections?

Think of a VPN as one layer, not the whole plan. The FTC recommends strong passwords, two-factor authentication where available, and automatic updates for your operating system, browser and security software. A password manager makes unique passwords practical, and learning how to spot a phishing scam protects you from the tricks a VPN cannot see.

The bottom line

A VPN builds a private, usually encrypted tunnel between your device and a provider’s server. That helps on risky public Wi-Fi, hides your browsing content from your internet provider and masks your IP address. Because the provider sees your traffic instead, choosing a trustworthy one matters most. It does not make you anonymous, does not stop tracking once you log in, and does not protect you from malware or scams. For the latest U.S. technology and security headlines, visit the LiveNewsWorld U.S. News Live center.

Sources