Do I need a VPN? What it protects, what it doesn't, and who should bother

A VPN (virtual private network) builds an encrypted tunnel from your phone or computer to a server run by the VPN company. Everything you send goes through that tunnel first, then out to the open internet from the VPN server. Two things change as a result.

• The local network and your ISP lose sight of where you go. The coffee shop Wi-Fi, the hotel network, your mobile carrier and your home internet provider see encrypted traffic going to one VPN server. They can't see the sites you visit or the DNS lookups your device makes, as long as the VPN handles DNS (good ones do by default).
• Websites see the VPN's IP address instead of yours. Your IP address reveals your rough location and your internet provider. With a VPN on, a site sees an address belonging to the VPN, in whatever city or country you picked.

Nothing more. Everything a VPN company advertises is some consequence of those two effects, plus extras like ad blocking that you can often get for free elsewhere.

One trade-off sits underneath all of it: the VPN company can now see what your ISP used to see. You are moving trust, not removing the need for it. So the company's logging policy, audits and jurisdiction matter more than its server count.

Most VPN advertising quietly implies more than the technology delivers. A VPN will not:

• Make you anonymous. If you log into Google, Facebook, Amazon or your bank, they know it's you no matter which IP address you arrive from. The VPN company itself knows who paid for the account.
• Stop most online tracking. Cookies, logged-in accounts, ad identifiers on your phone and browser fingerprinting all work the same with a VPN on. A tracker that recognizes your browser doesn't need your IP address.
• Protect you from phishing. A fake bank login page works just as well over a VPN. See how to spot phishing emails for what does help.
• Replace antivirus or updates. Malware you download through a VPN is still malware. Some VPNs bundle a malicious-site blocker, and those can catch a few known bad domains, but they are a thin layer at best. Keeping your system patched does far more; see keep your devices updated.
• Secure a website that is already secure. Almost every site you use runs on HTTPS, so your passwords and card numbers are already encrypted in transit. The VPN hides which sites you visit, not the contents of an HTTPS session that nobody could read anyway.

People who use public or shared Wi-Fi often

Airports, hotels, cafes, conference centers, dorms. On those networks you don't know who runs the router or who else is watching. A VPN stops the network operator from seeing your DNS lookups and the sites you reach, and it makes a lookalike hotspot much less useful to whoever set it up. Our public Wi-Fi safety guide covers the other habits that matter on those networks.

Travelers

Abroad, you are on hotel and mobile networks you know nothing about, and some countries filter or monitor traffic heavily. A VPN also lets you reach US services that block foreign IP addresses, like some banking portals. Check local law before you go: a few countries restrict or ban VPN use.

People who don't want their ISP watching

US internet providers can see the domains you visit and have used browsing data for advertising. If that bothers you, a VPN moves that view to a company whose business depends on not logging it. Setting your browser to encrypted DNS closes part of the gap for free, but the ISP can still see the site names your browser sends when connecting, and the IP addresses you connect to.

Streaming from another region

Many people buy a VPN to watch the Netflix or BBC catalog from another country. It often works, but streaming services treat it as a breach of their terms and block VPN addresses when they find them. Treat it as a bonus that may stop working, not the main reason to subscribe.

Who can mostly skip it

If you browse at home on your own Wi-Fi, use HTTPS sites (nearly all of them), and don't mind your ISP knowing which domains you visit, a VPN adds little. Your money and attention go further on two-factor authentication, a password manager and a credit freeze. Those stop the attacks that hit ordinary people most often. A VPN does not.

Running a VPN costs real money: servers, bandwidth, staff. A free app that doesn't charge you has to make money another way, and the usual ways are showing you ads, collecting and selling usage data, or both. Security researchers have repeatedly found free VPN apps in the app stores that leak traffic, request far more permissions than they need, or log activity they claim not to log. The worst ones are run by companies that hide who owns them.

For a privacy tool, that model is backwards. You would be routing all your traffic through a company with every incentive to look at it.

The notable exception is Proton VPN. Its free tier has no data cap and no ads, according to the company, and the paid plans fund it. The apps are open source and the no-logs policy has been independently audited. The free tier limits you to one device and a smaller set of server locations, and it is slower at busy times, but it does the core job. If you want to try a VPN without paying, start there.

• An independently audited no-logs policy. Anyone can write "we keep no logs." Look for a published audit by a named firm, ideally repeated.
• A kill switch. If the VPN connection drops, a kill switch blocks traffic until it reconnects, so you don't leak onto the open network without noticing. Make sure it's turned on.
• Modern protocols. WireGuard (or a vendor's WireGuard-based protocol) and OpenVPN are the standard. Avoid anything still offering PPTP as a default.
• A company you can identify. Know who owns it and where it's based. If you can't find that in two minutes, move on.
• Apps for every device you use, and enough simultaneous connections to cover them.

We compare the main options, including ones we don't earn from, in the best VPN services compared. If you are weighing a VPN against a cheaper proxy or a browser extension, see VPN vs proxy.

Answer these honestly. Two or more yes answers and a VPN is probably worth having.

1. Do you use public, hotel or shared Wi-Fi at least a few times a month?
2. Do you travel abroad, or to places where the network may be monitored?
3. Does it bother you that your internet provider can see which sites you visit?
4. Do you need to appear to be in another location for a service you are entitled to use?
5. Do you live in a shared building or dorm where you don't control the network?

All no? Skip the subscription. If you want a safety net for the occasional airport visit, install Proton VPN's free tier and switch it on when you need it.

Either way, a VPN goes on top of the basics. Check whether your accounts have shown up in breaches with the leaked password check, and run through the quick protection checklist first. If you want to stop companies tracking you by name, a VPN won't help, but removing your info from data broker sites and using email aliases will.