A VPN, or virtual private network, is one of those tools that many people install without being quite sure what it does. Some think it makes them invisible online. Others think it is only for office workers. The truth sits in between, and once you understand how a VPN works, it becomes much easier to decide when it is worth switching on.
This guide explains what a VPN is in plain language, what it protects, what it does not protect, and a few honest situations where you can leave it off.
What a VPN actually does
Every time your phone, laptop or TV goes online, its traffic passes through several parties before it reaches a website: the Wi-Fi network you are on, the company that runs that network, your internet provider, and finally the website or app server itself. Each of them can see some information about your connection.
A VPN creates an encrypted tunnel between your device and a VPN server. Your device wraps each piece of traffic in encryption, sends it to the VPN server, and the server unwraps it and passes it on to the wider internet. Replies come back the same way.
That design has two practical effects:
- The local network and your internet provider see less. They can see that you are connected to a VPN server and how much data is moving, but not your traffic or which websites you are visiting inside the tunnel.
- Websites see the VPN server's IP address instead of yours. Your public IP address can reveal your approximate location and your internet provider. With a VPN on, sites see the address of the server you connected to.
The UK's National Cyber Security Centre describes VPNs in similar terms in its guidance for organisations: encrypted network connections that protect "data in transit" across an untrusted network.
How a VPN fits on your device
On modern phones and computers a VPN is not a browser trick; it works at the level of the operating system. On Android, for example, apps use a system service that creates a virtual network interface. Android's developer documentation explains that the system asks the user for permission before an app can set up a VPN, and shows a key icon in the status bar while it is active. That is why you see a "Connection request" prompt the first time you connect with a VPN app.
Browser extensions are different. A VPN-style extension usually works as a proxy for the browser only, so apps outside the browser are not covered. If you want protection for everything on the device, use the app for that platform.
When a VPN is genuinely useful
On Wi-Fi you don't control
Cafés, airports, hotels and trains offer convenient Wi-Fi, but you have no idea how well it is run or who else is connected. Most websites already use HTTPS, which protects the content of each page. A VPN adds a second layer: it hides which sites you visit from the network operator and protects apps or older services that may not encrypt everything properly. We cover this in more detail in our guide to public Wi-Fi safety.
When you want to keep your browsing away from your provider
Your internet provider can usually see the domain names you look up and the servers you connect to. The EFF's Surveillance Self-Defense guide points out that this kind of information, often called metadata, can say a lot about a person even when the content itself is encrypted. A VPN moves that visibility from your provider to the VPN provider, which is why choosing a provider you trust matters.
When you don't want every site to see your IP address
Your public IP address is shared with every server you contact. It is not a home address, but it can point to your city and your provider. A VPN replaces it with the VPN server's address. You can see what your own connection reveals right now with our What is my IP tool.
When you travel
When you are away from home, a VPN lets you keep using a familiar, encrypted connection on whatever network the hotel or venue provides, instead of trusting each new network separately.
What a VPN does not do
Being clear about limits is just as important. A VPN:
- Does not make you anonymous. If you sign in to an account, that service knows it is you. Cookies, browser fingerprints and logged-in sessions still identify you.
- Does not stop phishing or malware. A fake login page is still fake through a tunnel. Keep your system and apps updated and be careful with links and attachments.
- Does not replace HTTPS or strong passwords. It complements them. Use unique passwords and two-step verification wherever you can.
- Moves trust rather than removing it. The VPN provider's servers handle your traffic. The EFF suggests asking how a VPN keeps itself afloat, what its business model is and which countries' laws it operates under before you rely on it. The EFF also states plainly that a VPN is not a tool for anonymity.
When you can leave it off
You don't need a VPN switched on every second of the day. It is reasonable to turn it off when:
- You are on your own home network that you trust, and you are only doing things that are already encrypted end to end.
- A service you rely on, such as your bank, temporarily refuses connections from VPN addresses. Switch it off, finish the task, then switch it back on.
- You need to reach a device on your local network, like a printer or a home media server, and your setup doesn't allow local access through the tunnel.
If you notice a site behaving strangely, try another server before turning the VPN off completely.
What to look for in a VPN
Here is a short, practical checklist:
- Modern protocols. WireGuard is a widely used modern option. Our explainer on WireGuard and modern VPN protocols covers how it works.
- A clear logging policy. Read what the provider says it records and what it doesn't.
- A kill switch. If the tunnel drops, a kill switch stops traffic from quietly leaving your device without protection.
- Leak protection. Your browser can reveal your IP address through WebRTC. Test it with our WebRTC leak test and read how to check your IP and WebRTC leaks.
- Apps for the devices you actually use. Phone, TV and computer, ideally under one account.
How VPNRice approaches this
VPNRice has apps for Android, Android TV, iPhone and iPad, and Windows, plus Chrome and Firefox extensions that route your browser's traffic through VPNRice servers (the extensions don't add encryption themselves; sites you open over HTTPS stay encrypted end to end). The apps offer three protocols: WireGuard, RiceGuard (WireGuard with extra packet obfuscation) and RiceGuardX (a TLS-based protocol), with an Auto mode that chooses for you. The Windows app offers WireGuard, RiceGuardX and Auto.
One tap connects you and the app picks a server automatically from servers in 39 countries. Other features include ad and tracker blocking in the apps (on some plans), a kill switch (on Android it uses Android's Always-on VPN setting) and per-app selection on Android and Windows. VPNRice servers don't record the websites you visit, your DNS queries or your traffic.
A VPN is a simple, useful layer of protection when you know what it covers. If you'd like to try one, you can download VPNRice for your devices and start with the free tier.