What a VPN Does (and Doesn't)
A VPN moves your trust from your internet provider to someone else. Pick that someone carefully, and know exactly what you're buying.
Your internet provider sits between you and everything you do online. HTTPS hides the contents of most pages, but your ISP can still see which sites you connect to, and when. Many log it. Some sell it.
A VPN (virtual private network) wraps your traffic in an encrypted tunnel to a server run by the VPN company, which then forwards it to the open internet. Your ISP sees only that you're connected to a VPN. Websites see the VPN server's IP address instead of yours.
In this guide, "VPN" means a paid commercial service. Work and self-hosted VPNs exist too, but they're built for reaching private networks, not for privacy.
What it actually buys you
- Your ISP goes blind to which sites you visit.
- Your IP address stays hidden from websites and trackers, cutting off IP-based tracking and location guessing.
- Public Wi-Fi gets safer: the café network sees only encrypted tunnel traffic.
- Geo-blocks fall away: your traffic appears to come from the server's country.
- A good provider outside your own jurisdiction won't simply hand over data to an overreaching government.
What it doesn't
- You've moved your trust, not removed it. The VPN provider can now see everything your ISP used to. "No logs" is a promise; you can't verify it yourself.
- It isn't anonymity. The provider knows your real IP, where you go, and usually who paid. For real anonymity, use Tor Browser.
- It only encrypts the first leg. From the VPN server to the website, your traffic is as exposed as it ever was. Use HTTPS, and turn on HTTPS-only mode in your browser (see Harden Firefox).
- It doesn't help when you're logged in as yourself. Your bank still knows it's you, and logging in from a VPN IP can trip fraud alarms.
- It doesn't block cookies, fingerprinting or account-based tracking. That's the job of a content blocker and good habits.
Choosing a provider
Most VPN brands are owned by a handful of companies running look-alike services with weak privacy policies, and most "best VPN" review sites are paid ads. Be strict. These three meet Privacy Guides' criteria: open-source apps, independent audits, WireGuard, a kill switch and an anonymous way to pay.
| Provider | Based in | Notes |
|---|---|---|
| Mullvad | Sweden | No email needed: just an account number. Accepts cash and Monero. WireGuard only. Full IPv6. |
| IVPN | Gibraltar | Accepts Monero and cash (annual plans). Built-in tracker blocking (AntiTracker). Supports 2FA. |
| Proton VPN | Switzerland | Has a limited free tier. Stealth protocol for censored networks. On Android, check the telemetry setting labelled Help us fight censorship. |
All three have apps for Windows, macOS, Linux, iOS and Android. Android users can also install straight from the official GitHub releases (Mullvad, Proton, IVPN), and IVPN publishes on Accrescent. Port forwarding is gone from Mullvad and IVPN, which matters if you torrent.
Setting it up right
- Pay anonymously if you can. Cash or Monero removes the money trail linking the account to you.
- Use WireGuard. It's fast, modern and the default in all three apps.
- Turn on the kill switch (or "always-on VPN" / "block connections without VPN" on Android) so nothing leaks if the tunnel drops.
- Leave DNS to the VPN. Adding a third-party encrypted DNS service just adds another party to trust; the VPN can still see where you connect.
- Check for leaks after connecting: your IP should show the VPN's location, not yours.
VPN plus Tor?
Most people don't need Tor. If you do use it, connecting to Tor while on a VPN is fine. But skip "Tor over VPN" buttons inside VPN apps: they put the VPN back in the position of seeing everything, which defeats the point of Tor. Use the real Tor Browser.
Alternatives on the horizon
Multi-party relays split the job between two companies so neither sees both who you are and where you go. Apple's iCloud Private Relay is the best-known: Apple sees your IP, a partner such as Cloudflare sees the destination. It only works if they don't collude. Decentralised VPNs (blockchain-based) promise no central trust, but often route you through a single anonymous stranger's node, and many exist mainly to sell a token. Watch, don't rely.
A VPN is a tool, not a cloak. Use it to take your ISP out of the picture, then keep doing everything else.