VPN vs proxy: what each one hides, and when a proxy is enough

A proxy is a server that makes requests on your behalf. Your browser asks the proxy for a web page, the proxy fetches it, and the website sees the proxy's IP address instead of yours. Companies, schools and libraries use them all the time to filter or log traffic. Individuals use them mostly to change their apparent location.

There are three kinds you'll run into:

• HTTP or HTTPS proxies. You set them in your browser or system network settings. They handle web traffic only. The proxy can read any unencrypted request, and it can always see which sites you connect to.
• SOCKS proxies (usually SOCKS5). Lower level, so they can carry traffic from apps other than the browser, like a torrent client or a game, if the app supports a proxy setting. SOCKS itself adds no encryption.
• Web proxies. A website where you type in another site's address and it loads that site inside its own page. No setup, but they often inject ads, break logins and pages, and see everything you do through them.

The key point: a proxy changes where your traffic appears to come from. On its own it does nothing to hide that traffic from the network you're on. If the site you visit uses HTTPS (almost all do), the page contents are still encrypted end to end between you and the site. But the Wi-Fi operator and your ISP can still see that you are talking to a proxy, and with many setups they can also see your DNS lookups.

A VPN also sends your traffic through someone else's server, but it does two things a basic proxy doesn't. It encrypts everything between your device and the VPN server, and it works at the system level, so every app on the device goes through the tunnel: the browser, the email app, background updates, everything. DNS lookups go through the tunnel too, with a well-built VPN.

That makes a VPN the right tool when the problem is the network itself: hotel Wi-Fi, a cafe hotspot, an ISP you'd rather not hand your browsing history to. A proxy set in Chrome does nothing for the other apps on your laptop, and those keep talking over the open network. For more on whether you need one at all, see do I need a VPN?

What a VPN shares with a proxy: neither makes you anonymous. Log into Google through either one and Google knows it's you. Cookies and browser fingerprinting work as usual. And the operator of the server, proxy or VPN, can see what your ISP used to see, so the trustworthiness of that operator is the whole game.

Search any browser's extension store for "VPN" and you'll get pages of free results. Many of them only reroute traffic from that browser, often over an encrypted connection to the provider, but nothing else on your device is touched. Your email app, your other browsers and every background service still go out over the open network. They work like an encrypted proxy, whatever the name says.

The same goes for some VPN features built into browsers. Opera's free built-in VPN, for example, covers traffic inside Opera, not the rest of your computer. That can be useful for a quick location change, as long as you know its limits.

Free extensions bring the same money problem as free VPN apps, plus a bigger one: an extension can often read and change every page you load. Some have been caught selling browsing data or being sold to new owners who pushed malicious updates.

Tor

Tor Browser sends your traffic through three volunteer-run relays, each wrapped in its own layer of encryption. No single relay knows both who you are and where you are going. That design gives far stronger anonymity than a VPN or proxy, and it's free. The costs: it is slow, many sites challenge or block Tor traffic, and it protects only what you do inside Tor Browser. It is the right tool for journalists, activists and anyone who needs to hide who they are. For everyday browsing, most people find it too slow.

iCloud Private Relay

Apple's Private Relay comes with an iCloud+ subscription on iPhone, iPad and Mac. It splits your connection across two relays: Apple's relay sees your IP address but not the site, and a second relay run by a partner company sees the site but not your IP address. Your traffic is encrypted out of your device. It works mainly in Safari (Apple says it also covers DNS lookups and some unencrypted app traffic), not in Chrome or other apps. It keeps your general region so local results still work, and you can't choose a country. Some countries and some networks block it.

Turn it on at Settings > your name > iCloud > Private Relay. If you already pay for iCloud+ and mostly use Safari, it covers a good part of what a VPN would do for everyday browsing.

A proxy or browser-only tool is reasonable when:

• You want to check how a website looks from another country.
• You need a different IP address for one task in one browser, on a network you trust.
• Your employer or school requires one and manages it for you.

Use a full VPN instead when:

• You are on public or hotel Wi-Fi. Every app needs covering, including the ones outside the browser. Our public Wi-Fi guide has the rest of the routine.
• You want your ISP or mobile carrier to stop seeing which sites you visit.
• You want a kill switch so nothing leaks when the connection drops.
• You'd rather trust one identifiable company than a free proxy list run by people you'll never know.

If you settle on a VPN, Proton VPN has a free tier with no data cap, and NordVPN is a paid option with an independently audited no-logs policy. Mullvad, a non-partner, is the strongest pick for anonymous signup. Our VPN comparison covers all of them.

None of these tools stop sites that already know your name and address from publishing it. That problem lives with data brokers; see how to remove your info from data broker sites.