How VPNs Work: A Beginner-Friendly Guide

What Happens When You Turn On a VPN?

Your device connects to a VPN gateway and sends traffic through an encrypted tunnel. Standards bodies and government guidance describe VPNs as remote-access systems that rely on protocols such as IPsec, SSL/TLS, OpenVPN, or newer provider-supported protocols.

Websites and apps usually see the VPN server's IP address instead of your home IP address. Your internet provider can generally see that you connected to a VPN and how much data moved, but not the specific websites inside the encrypted tunnel.

• Encrypted tunnel to a VPN gateway
• VPN server IP visible to websites
• ISP visibility reduced, not eliminated
• VPN provider becomes a key trust point

What a VPN Does Not Do

A VPN does not stop websites from recognizing accounts you log into. It does not remove cookies, block all browser fingerprinting, prevent phishing, or protect an infected device from malware.

EFF and other privacy guidance frame VPNs as a trust decision. You are reducing visibility for one party, such as your ISP or local Wi-Fi operator, while trusting the VPN provider not to log or misuse traffic.

Evidence is mixed on whether every home user needs a VPN all the time. HTTPS, browser hygiene, strong passwords, and multi-factor authentication still matter.

Why VPN Quality Matters

The research package cites a CSIRO study of 283 Android VPN apps where many apps failed basic privacy expectations. The study found malware or malvertising components, missing encryption in some apps, and DNS or IPv6 leaks in many cases.

That does not mean every VPN is unsafe. It means beginners should avoid random app-store VPNs and look for clear policies, reputable ownership, standards-based protocols, leak protection, and independent review or audit evidence.