Friday, 23 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Illustration of a laptop at night with its connection shown as a glowing tunnel running through servers to a globe, with a faint dotted path showing the unprotected route

VPNs Explained: How They Work, What They Protect, and How to Choose One

by

A VPN is one of the most oversold products on the internet. It does one thing well — it moves who can see your traffic — and a long list of things it does not do at all. This guide explains both, by threat model, so you buy for the right reason or not at all.

In brief

  • What a VPN actually protects, what it does not, and how to choose one by threat model — with the audit and court evidence that separates claims from proof.
  • What a VPN actually does: When you connect to a VPN, three things happen.
  • What a VPN does NOT protect: This is the section most VPN marketing skips, and it is the one that matters most.
  • The threat-model picker: which problem are you solving?: A VPN is worth paying for when it matches the threat you actually face.
  • How to choose: the 7 checks before you pay

A VPN — virtual private network — is a service that routes your internet traffic through a server run by the VPN provider, encrypting it between your device and that server. This guide is global: VPN behaviour is the same everywhere, and the legal examples come from several countries. The single most important thing to understand is that a VPN does not remove the need to trust someone with your traffic. It changes who that someone is — from your internet provider to the VPN provider. Everything else in this guide follows from that one fact.

What a VPN actually does

When you connect to a VPN, three things happen. First, your traffic is encrypted between your device and the VPN server, so anyone on your local network — a coffee-shop Wi-Fi snoop, a hotel network, your internet provider — cannot read its contents. Second, the websites and services you visit see the VPN server’s IP address instead of yours, so they see the server’s location rather than your own. Third, your internet provider sees only that you are connected to a VPN server; it no longer sees which sites you visit.

That is the whole mechanism. It is genuinely useful, and it is much narrower than the marketing suggests — for two reasons. The first is HTTPS. The overwhelming majority of web traffic is already encrypted end to end between your browser and the website, so a local snoop could not read the contents of your banking or email traffic even without a VPN. What a VPN adds on top of HTTPS is mainly hiding the metadata — which sites you connect to — from your provider and your local network. The second reason is that the VPN provider itself can now see what your provider used to see: your traffic is decrypted at the VPN server before it goes out to the internet. You have not eliminated the watcher. You have chosen a different one.

What a VPN does NOT protect

This is the section most VPN marketing skips, and it is the one that matters most. A VPN does not block malware or viruses. If you download an infected file, the tunnel faithfully carries it to your device, encrypted and intact. It does not stop phishing. A fake bank login page is still a fake bank login page over a VPN, and if you type your password into it, the VPN cannot stop the site receiving it. It does not protect against a broken certificate authority either: if a CA’s keys are compromised, fraudulent certificates look valid to your browser whether your VPN is on or off, as the eMudhra compromise showed in October 2026. It does not secure your accounts: weak or reused passwords, and accounts without two-factor authentication, are just as vulnerable with a VPN as without one.

It does not make you anonymous to the services you log into. Changing your IP address does not log you out of Google, Facebook or Amazon, and cookies, account IDs and browser fingerprinting can still recognise you. It does not stop tracking while you are logged in, and it does not protect a device that is already compromised. Some premium VPNs bundle threat-protection features that block known malicious domains; these are useful additions, not substitutes for antivirus software or careful browsing habits. They catch some threats, not all.

The Electronic Frontier Foundation’s Surveillance Self-Defense guide puts it bluntly: advertising that presents a VPN as the only tool you need to stop criminals, malware and tracking vastly oversells what a VPN can do. A VPN is best understood as doing one thing well — routing your connection through another network. Everything else needs its own tool.

The threat-model picker: which problem are you solving?

A VPN is worth paying for when it matches the threat you actually face. Work through the five situations below and buy — or skip — accordingly.

Your internet provider, or someone on your local network, seeing your traffic. This is the VPN’s home ground. If you are on public Wi-Fi, a hotel network, a university network, or you simply do not want your provider logging which sites you visit, a reputable paid VPN solves the problem directly. This is the strongest case for buying one.

Public Wi-Fi attacks. A VPN encrypts your traffic on an untrusted network, which defeats local snooping and the simplest man-in-the-middle attacks on that network. It does not protect you from the network’s own captive portal or from a fake hotspot that harvests credentials before you ever reach the VPN.

Tracking by advertisers and data brokers. A VPN helps only at the margins here. It hides your IP address, which is one identifier among many. Cookies, logged-in accounts and browser fingerprinting keep tracking you regardless. If tracking is your main concern, a VPN alone will disappoint you; browser settings, tracker blocking and account hygiene matter far more.

Geo-blocks and streaming catalogues. A VPN can make a service think you are in another country, which sometimes unlocks another catalogue. Services fight back by detecting and blocking VPN IP addresses, so this is an ongoing cat-and-mouse game, not a guaranteed feature. No VPN can promise every service, every week.

Censorship and surveillance by a determined adversary. A VPN can help bypass network-level blocks, and obfuscated servers are designed for networks that block VPNs outright. But a VPN is not anonymity software: a government adversary has tools — endpoint seizure, payment records, traffic correlation — that a commercial VPN cannot defeat. If your threat model includes a state adversary, you need Tor and operational discipline, not just a VPN.

If none of these five matches your situation, you probably do not need a VPN at all. That is a legitimate conclusion, and it is one no VPN vendor will volunteer.

How to choose: the 7 checks before you pay

1. Read the logging policy like an auditor. The policy should say precisely what is kept and for how long — and “we keep no logs” is not precise enough. The policies worth trusting name the data: email and payment details for the account, and then either nothing else, or a specific short-lived record such as a 15-minute session timestamp for enforcing a device limit. Vague policies are a red flag.

2. Ask for the audit: auditor, date, scope, public report. A credible no-logs claim has an independent audit behind it, and the audit’s value depends on four details: who audited (a real firm, not an unnamed “independent auditor”), when (audits age fast — an audit from years ago says little about how the service runs today), what scope (which servers, which claims), and whether the report is public or available to subscribers. NordVPN, for example, says its no-logs policy has now been independently verified six times — most recently by Deloitte Lithuania under the ISAE 3000 (Revised) standard, with fieldwork 10 November–12 December 2025 and the report issued 12 December 2025. The full report is available to subscribers, not the public. Surfshark’s no-logs policy was audited by Deloitte in 2023 and again in 2025, with the second assurance report released in June 2025 under the ISAE 3000 standard. ExpressVPN says it has completed and published multiple waves of independent third-party audits and security assessments — from firms including Cure53, KPMG and PwC — covering its apps, TrustedServer infrastructure, Lightway protocol and no-logs controls. The pattern to look for is repetition: one audit is a snapshot; repeated audits are a track record.

3. Ask for the court record. An audit is invited; a subpoena is not. That is why the court and seizure record is the strongest evidence a provider can offer. Private Internet Access had nothing to produce when the FBI came calling in a 2016 case and again in a 2018 case, as TorrentFreak reported. Turkish investigators seized an ExpressVPN server in 2017 during the investigation into the assassination of Ambassador Andrey Karlov and found no logs, ExpressVPN said in its statement on the investigation. In April 2023, Swedish police arrived at Mullvad’s Gothenburg office with a search warrant to seize computers containing customer data, and left with nothing because no such data existed, Mullvad wrote in its account of the search. The counterexamples matter just as much: in 2016 IPVanish turned over user data to US authorities after initially saying it had none, and in 2017 PureVPN’s logs helped the FBI identify a user despite its no-logs marketing, as PCWorld reported. A provider with a court-tested record has earned more trust than one with a policy page alone.

4. Check the server architecture. The best providers run RAM-only (diskless) servers: a reboot wipes them, so there is nothing on the machine for a seizure to recover. Full-disk encryption is the weaker alternative. If a provider does not say which it uses, assume the weaker one.

5. Separate intro price from renewal price. VPN pricing is built on a two-price trick: a low introductory rate for the first term, then a much higher renewal. Always find the renewal price before you commit — it is often double or more — and compare providers on the renewal price, not the headline.

6. Check the jurisdiction, but do not overrate it. A provider based outside the 5/9/14 Eyes intelligence-sharing alliances (NordVPN in Panama, ExpressVPN in the British Virgin Islands) starts with fewer legal obligations than one inside them (PIA in the United States, Surfshark in the Netherlands). But jurisdiction is one input, not the test — a no-logs provider in a Five Eyes country with nothing recorded has nothing to hand over, while a logging provider outside any alliance offers no protection at all.

7. Test it before the refund window closes. Run the 15-minute leak test — IP, DNS, WebRTC, IPv6, torrent IP, kill switch — within the first days of subscribing, while the money-back guarantee still applies. A VPN that leaks on your setup is a refund, not a settings project.

The free-VPN question, in one paragraph

If a VPN charges nothing, it still has to pay for servers and bandwidth — and the money comes from somewhere. The two kinds of free VPN are very different: freemium tiers from reputable providers (a limited but genuinely private demo) versus totally-free apps, which have a documented history of malware, leaks and data sales. The short version: never install a totally-free VPN app you found in an app store; a freemium tier from a provider with a public audit is the only safe free option.

What this means for you

  • A VPN moves trust from your internet provider to the VPN provider. Choose the provider, not the marketing.
  • It does not stop malware, phishing, weak passwords or tracking while logged in. Those need their own tools.
  • The strongest case for a VPN is an untrusted network or an untrusted provider. The weakest is “general privacy” with no specific threat.
  • Judge a provider by its audit record (auditor + date + scope + public report) and its court record — not by its policy page.
  • Check the renewal price, not the headline price, and test for leaks inside the refund window.
  • Related live reading: 5G Home Internet and CGNAT: Port Forwarding, Gaming Servers and Workarounds — where a VPN with port forwarding is one of the workarounds for CGNAT-blocked port forwarding.
  • Related live reading: Is VPN Safe for Online Banking? — what a VPN does and does not protect during a banking session, and when your bank will flag the login.
  • Related live reading: How to Tell If Your VPN Is Working — the 2-minute before-and-after check: IP, location, DNS and WebRTC.
  • Related live reading: VPN Not Connecting on Public Wi-Fi: How to Fix It — the captive-portal-first fix ladder for hotel, cafe and airport Wi-Fi.
  • Related live reading: VPN Statistics 2026 — 50+ sourced statistics on VPN usage, market size and free-VPN risks, including Australia’s 330% demand surge.

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment