VPN Basics and Limits

Build the mental model

A VPN, or virtual private network, creates an encrypted tunnel between your device and a server run by the VPN provider. Everything you send passes through that tunnel first, then continues on to its real destination from the provider's server. This gives a genuine privacy benefit on networks you don't trust: whoever operates the local Wi-Fi, or other devices sharing it, can see that an encrypted tunnel exists, but not what's inside it.

Companies also use this pattern to let remote employees reach internal systems as if they were on the office network, and some people use it to route traffic through a server in a different region.

The limitation that matters most is who the tunnel actually protects you from. A VPN moves the "who can see my traffic" question from the local network to the VPN provider itself. The provider's server is where your tunnel ends and your real destination traffic resumes, so the provider becomes a new trusted party, capable of seeing anything about your connection that the destination itself doesn't already protect through HTTPS. Choosing a VPN provider is choosing who to trust with that visibility.

A VPN also does not do things it's sometimes assumed to do. It does not stop phishing: a deceptive site is still deceptive, and still reachable, through an encrypted tunnel. It does not stop malware from running once downloaded. And it does not make you anonymous online; it changes which network operator can observe your traffic, not whether you can be identified through other means like accounts, cookies, or the destination site itself.

VPN: A service that routes your device's traffic through an encrypted tunnel to a provider's server before it continues to its destination.

text

VPN TUNNEL AND THE NEW TRUSTED PARTY
------------------------------------
DEVICE
  |
  v  (encrypted tunnel)
VPN PROVIDER / SERVER  <- new trusted party
  |
  v  (normal traffic resumes here)
INTERNET
  |
  v
DESTINATION

The provider can see what the tunnel carries past this
point. HTTPS still protects payload content end-to-end.

Connect it to a real scenario

Think of a VPN as a tool for a specific job, not a general safety switch you leave on and stop thinking about. It's genuinely useful when you're on a network you don't trust and want to keep the local operator from observing your traffic, or when you need remote access to systems your employer restricts to internal connections. It's not the right tool for stopping phishing, blocking malware, or hiding your identity from the sites you actually log into.

Before trusting a VPN provider, check what they say about logging: some keep no records of your activity, others keep more than users expect, and the provider's own trustworthiness now matters as much as the network you were originally worried about. Reading their privacy policy summary is worth the few minutes it takes.

Keep your normal defenses running regardless. HTTPS checks, browser and OS updates, and phishing awareness from earlier lessons don't become optional because a VPN is active; the tunnel and those defenses protect against different things and neither substitutes for the other.

A VPN encrypts the path between your device and the VPN provider, hiding traffic from the local network.
The VPN provider becomes a new trusted party — it can see what HTTPS doesn't already protect.
A VPN does not stop phishing or malware and does not make you anonymous.

A VPN is not a magic switch

A VPN does not stop phishing or malware, and it does not make you anonymous — it only changes who can observe your network traffic.

Try the working example

javascript

function doesVPNHelp({ usingVPN, activityType }) {
  const scenarios = {
    "phishing-link-click": {
      helps: false,
      reason: "A VPN encrypts the network path, but a phishing site is still reached and still deceives at the destination.",
    },
    "public-wifi-browsing": {
      helps: true,
      reason: "A VPN shields your traffic from observation by the local network operator or other devices on it.",
    },
    "location-masking": {
      helps: true,
      reason: "Routing through a VPN server changes the IP address and rough location a destination sees.",
    },
  };

  const scenario = scenarios[activityType];
  if (!scenario) return { helps: false, reason: "Unknown activity type." };
  if (!usingVPN) return { helps: false, reason: "No VPN is active, so it provides no protection here." };
  return { helps: scenario.helps, reason: scenario.reason };
}

const examples = [
  { usingVPN: true, activityType: "phishing-link-click" },
  { usingVPN: true, activityType: "public-wifi-browsing" },
  { usingVPN: false, activityType: "public-wifi-browsing" },
  { usingVPN: true, activityType: "location-masking" },
];

for (const input of examples) {
  console.log(JSON.stringify(input), "->", doesVPNHelp(input));
}

You should see

Clicking a phishing link while the VPN is on still returns helps:false, because the tunnel doesn't change what the destination site does. Browsing public Wi-Fi with the VPN on returns helps:true, and the same activity with the VPN off returns helps:false, showing the VPN itself is what mattered there. Location masking with the VPN on returns helps:true.

5-minute try-it

List three things you sometimes do online: log into your bank, click a link from an email, and browse from a cafe. For each, call doesVPNHelp with usingVPN true and the closest matching activityType. Notice that turning the VPN on doesn't change the result for the phishing scenario at all — that's the point of this lesson made concrete.

One important caution

Treating an active VPN as a reason to skip HTTPS checks or click links more freely — the tunnel doesn't examine or filter what you're connecting to.

Picking a VPN provider without checking their logging practices, since a provider that logs everything just relocates the privacy problem instead of solving it.

NCSC – Virtual Private Networks (VPN) Guidance — Digital Privacy & Modern Security