What does a VPN actually hide?

A VPN hides your IP address and encrypts your internet traffic, so your internet provider and anyone watching the network can't see what you're doing online. That's the full extent of what it does. It doesn't hide your identity if you log into an account, it doesn't hide your browser's fingerprint, and it doesn't stop a payment from being traced back to your name.

What a VPN does

A VPN sends your internet traffic through an encrypted tunnel to a server run by the VPN company, and that server talks to the internet on your behalf. Two things change because of this. First, anyone watching your connection — your internet provider, the Wi-Fi network at a coffee shop — sees encrypted traffic going to the VPN server and nothing more specific than that. Second, every website you visit sees the VPN server's IP address instead of yours.

What a VPN hides

A VPN hides three things well: your real IP address, the contents of your traffic, and your real location.

• Your IP address — replaced with the VPN server's address, so sites and trackers see a different location than your real one
• Your traffic's content — encrypted end to end, so your ISP or anyone on the same Wi-Fi network can't read what you're sending or receiving
• Your real location — you can pick a server in another country and access content or services restricted to that region

Not sure your own VPN is actually doing this? Run our IP leak test to confirm — it also checks the two most common ways an IP quietly slips through anyway, a WebRTC leak and a DNS leak.

Hiding your IP address does more than block ads. It also makes it much harder for someone to find your home address from your internet connection alone, which matters for two specific attacks: a distributed denial-of-service (DDoS) attack that floods your connection to knock you offline, and swatting, where an attacker traces a target's address and sends an armed police response to it as a prank or act of harassment. Masking your IP address doesn't make either attack impossible, but it removes the easiest way to find the address in the first place — and that protection only holds while the tunnel stays up, which is what a VPN's kill switch is supposed to guarantee.

The no-logs problem

Most VPNs promise not to keep logs of what you do. That promise is only worth something once it's actually been tested — and the record of what happens when it is tested is mixed.

In 2017, PureVPN advertised that it kept "NO logs that can identify or help in monitoring a user's activity." When the FBI investigated a cyberstalking case involving one of its users, PureVPN handed over connection timestamps that tied the user's home IP address to the VPN sessions used in the harassment. That was enough for the FBI to make an arrest. The company hadn't logged browsing activity, but it had logged enough to unmask the user completely — a distinction that made no practical difference to him. IPVanish, under a similar "zero-logs" claim, did the same thing the same year when the Department of Homeland Security subpoenaed one of its users.

The same year, the Center for Democracy and Technology filed an FTC complaint against Hotspot Shield, a free VPN with roughly 500 million downloads at the time. The complaint alleged that Hotspot Shield redirected user traffic to its own advertising partners and shared data like device identifiers and Wi-Fi network names with third parties — while its marketing promised "anonymous browsing" and "no logs of your online activity or personal information."

Mullvad is the counter-example. In April 2023, six Swedish police officers showed up at Mullvad's Gothenburg office with a search warrant to seize customer data. Mullvad's staff told them there was nothing to seize, because the company genuinely doesn't collect it — no account registration, no stored connection logs, no way to link a subscription to a person even if Mullvad wanted to. The police left with nothing. Independent security audits of Mullvad's apps have since found no critical vulnerabilities either, which is a second, separate form of verification beyond the raid itself.

Free VPNs and hidden costs

A broken no-logs promise isn't the only way a free VPN can work against you. Some turn your device into infrastructure for other people's traffic.

Hola VPN, a free browser extension with tens of millions of users, worked by routing other users' traffic through your internet connection, and yours through theirs — that's how it stayed free. In 2015, the operator of the imageboard 8chan traced a large-scale attack on his site back to Hola's network: someone had purchased access to Hola's user base through a commercial spin-off called Luminati and used it to flood 8chan with traffic. Hola's founder confirmed it. Every free Hola user's device was, without clearly disclosed consent, part of a nine-million-address network that anyone could rent for $20 per gigabyte — with no way to opt out short of uninstalling the extension.

What a VPN doesn't hide

A VPN protects your network connection. It has no effect on the layer above that — the accounts you log into, the browser you use, or the payment method you pay with.

Account logins

Logging into Google, a bank, or a social media account identifies you directly to that company, VPN or not. A VPN can't unlink an account from the person who owns it. If staying anonymous matters for a specific browsing session, the practical rule is simple: don't sign into anything you don't want tied to that session.

Your browser's fingerprint

A browser fingerprint is built from your screen resolution, installed fonts, GPU, and dozens of other small technical details — not your IP address. A VPN changes your IP address and leaves every one of those details untouched, which means a site can still recognize your device across visits even after your IP address changes. Independent testing has found some browsers resist this far better than others: Tor Browser is built specifically to make its users look nearly identical to one another, while a default install of a mainstream browser stands out as close to unique. Check your own exposure with our fingerprint test.

Payments

A card or PayPal payment reaches the payment processor with your name and account details attached, regardless of whether a VPN was active during the transaction. A VPN stops that payment data from being intercepted in transit — useful on public Wi-Fi — but it doesn't stop the payment processor itself from knowing who you are. Cryptocurrency is harder to trace back to an identity, though not impossible, and several VPN providers, including Mullvad and Proton VPN, also accept cash by mail for people who want to avoid a card transaction altogether.

Malware and phishing

A VPN encrypts your connection; it doesn't inspect what you download or click. Visiting a phishing site or downloading an infected file through a VPN puts you in exactly the same danger as doing it without one. Some VPNs bundle a separate warning feature for known malicious sites, but that feature works independently of the VPN's core encryption — it's a second tool riding alongside the first, not something the tunnel itself provides.

How to choose a VPN

Every VPN's marketing page claims to be the fastest, most secure, most private option out there. The claims that actually matter are the ones you can verify — a specific policy, a named auditor, a feature that either exists in the app or doesn't. Before picking a provider, confirm it actually has all of the following:

No-logs policy

A provider can't hand over what it never collected. A no-logs claim only means something once it's survived the kind of scrutiny described above — a raid, a subpoena, a named audit — not just a line on the pricing page.

Independent audits

A provider that won't publish a named third-party audit of its infrastructure and no-logs claim is asking you to trust its marketing instead of its evidence. Look for the auditor's actual name, not "an independent research firm."

Kill switch

If the VPN connection drops, a working kill switch cuts your internet entirely rather than quietly falling back to your real IP address. Test it yourself instead of trusting the feature list.

Multiple protocols

WireGuard is the fastest modern default; OpenVPN is slower but has a much longer security track record. A provider offering only one locks you out of that trade-off.

Server locations

More locations mean a better chance of a server close enough to keep latency low, and enough spread to actually get around regional restrictions rather than funneling everyone through the same few countries.

Dedicated servers

Some providers tune specific servers for streaming, gaming, or P2P traffic instead of running one general-purpose pool. It's a real performance difference, not just a label.

Multihop (Double VPN)

Routing traffic through two VPN servers instead of one adds a second layer an attacker or a subpoena would have to compromise, at a real cost to speed — worth having as an option, not necessarily worth using by default.

Cash and cryptocurrency payment

Paying by card ties your legal identity to the subscription regardless of what the VPN itself hides. A provider that takes cash by mail or crypto lets you skip that link entirely.

The best VPNs

These are the three we'd actually point a friend to, each for a different reason.

• NordVPN — the safest general default: a no-logs policy that's been through repeated independent audits by Big Four firms, a large server network, and a kill switch that held up in our own testing.
• ProtonVPN — built by the team behind Proton Mail, with an open-source, independently audited app and a genuinely usable free tier, plus cash and cryptocurrency payment for anyone who wants to skip a card entirely.
• Surfshark — the most permissive on device limits, with one subscription covering every device in a household instead of a capped number, plus a built-in ad and tracker blocker.