What a VPN actually does (and what it doesn’t)
What a VPN really does, how protocols and encryption work, and what "no logs" actually means — the ground floor before you spend a euro.
What a VPN actually does (and what it doesn't)
VPNs are sold as digital Swiss Army knives: total privacy, bulletproof security, unrestricted internet access, and sometimes even protection from malware. The reality is narrower and less magical. A VPN does one fundamental thing well—encrypts and reroutes your internet traffic through a server you choose—and everything else flows from that. Understanding this core function helps you spot both legitimate uses and overblown marketing claims.
The actual mechanics: encrypted tunnel between you and a server
When you connect to a VPN, your device establishes an encrypted connection to a VPN server somewhere else in the world. All your internet traffic routes through this tunnel before heading to its final destination. The encryption means anyone monitoring your local network—your ISP, a café owner, someone on the same public WiFi—sees gibberish instead of readable data.
Here's what physically happens: Your device encrypts a data packet, wraps it in another layer of addressing (called encapsulation), sends it to the VPN server, which unwraps and decrypts it, then forwards it to the actual website or service you're accessing. Responses travel the reverse path. To the website, your request appears to come from the VPN server's IP address, not your real one.
This is the entire technical foundation. Everything a VPN "does" derives from this encrypted tunnel and IP address substitution. No magic, no mysterious background processes scanning for threats—just encrypted routing.
What this actually protects you from
ISP surveillance and logging: Your internet service provider can normally see every domain you visit, even with HTTPS. They might log this for months or years depending on local data retention laws. A VPN encrypts this metadata—your ISP sees only that you're connected to a VPN server sending encrypted data. They don't know if you're reading news, streaming video, or browsing forums.
Local network snooping: On public WiFi or any shared network, other users can potentially intercept unencrypted traffic. The VPN tunnel prevents this entirely. Even on compromised networks, your actual traffic remains sealed inside encryption.
Geo-restriction circumvention: Since your traffic exits from the VPN server's location, you can access content restricted to that region. A server in Portugal lets you appear Portuguese to streaming services or websites with regional blocks. This works because the target site sees the VPN server's IP address, not yours.
IP address masking from websites: Every site you visit logs your IP address. With a VPN, they log the VPN provider's IP instead. If dozens or hundreds of users share that same exit IP, your individual activity blends into the crowd. This breaks the most basic form of cross-site tracking.
What a VPN definitely does not do
Provide complete anonymity: You're shifting trust from your ISP to your VPN provider. The VPN company can see everything your ISP used to see—every domain, every timestamp, your real IP address. If they log this data or respond to legal requests, you're exposed. Commercial VPNs are not anonymity tools in the Tor sense.
Encrypt data end-to-end: The encryption ends at the VPN server. From there to the destination website, traffic travels normally. If you visit an HTTP site (not HTTPS), anyone monitoring the VPN server's connection can read your data. Most internet traffic uses HTTPS today, which adds another encryption layer, but the VPN itself doesn't secure the final connection.
Hide your activity from services where you log in: If you access Gmail, Facebook, or your bank account through a VPN, those companies still know exactly who you are. You've authenticated with your credentials. The VPN hides your location and IP address, but not your identity to the service itself.
Protect you from malware or phishing: VPNs route traffic, they don't inspect it for threats. Some providers bundle DNS filtering or basic blocklists, but these are separate features, not inherent VPN functions. A VPN won't stop you from downloading malware or entering credentials on a fake website.
Make illegal activity untraceable: Law enforcement can subpoena VPN providers. If the provider logs connection data (and many do despite marketing claims), or if you slip up even once—accessing a service without the VPN, using a real identity to pay—you've created a trail. VPNs add a layer of complexity, not immunity.
Prevent browser fingerprinting or cookie tracking: Websites track you through dozens of signals beyond IP address: browser version, installed fonts, screen resolution, timezone, stored cookies. A VPN changes none of this. If you log into a service or allow tracking cookies, you're identified regardless of your IP address.
The "no logs" claim: what it actually means
"No logs" is the most abused phrase in VPN marketing. It sounds absolute, but providers define it differently. Some mean they don't log browsing history or DNS queries but do log connection timestamps and bandwidth. Others log the originating IP address temporarily for abuse prevention. Very few log literally nothing at all.
Check the actual logging policy—it's usually in a separate document from the privacy policy. Look for these specifics:
- Connection logs: Timestamps of when you connect and disconnect, your real IP address, which VPN server you used. This metadata can identify you even without browsing history.
- Bandwidth usage: Total data transferred per session. Harmless for privacy but shows they're tracking something.
- DNS queries: Domain names you request. This is browsing history by another name.
- IP address retention period: Some providers log your originating IP "temporarily"—meaning minutes, hours, or days depending on the provider.
Independent audits help verify claims. Look for audits from recognized security firms (like Cure53 or KPMG) that specifically reviewed logging infrastructure, not just the software. Even then, audits represent a moment in time. A clean audit from two years ago doesn't guarantee current practices. For current audit status, check the provider's website or search for recent third-party reports—practices change, servers get reconfigured, business incentives shift.
Jurisdiction and legal pressure
Where a VPN company is legally incorporated matters more than server locations. A company based in a country with mandatory data retention laws must comply with those laws, regardless of where their servers sit. If law enforcement presents a valid warrant, the company must respond according to local law.
Privacy-friendly jurisdictions (Switzerland, Panama, British Virgin Islands) have weaker data retention mandates and higher bars for legal requests. But "friendly jurisdiction" doesn't mean "above the law." Any company can be compelled to start logging a specific user if authorities make a valid request. The question is how much existing data they have to hand over immediately versus what they must prospectively collect.
Some providers claim they physically can't log because of their server architecture (diskless servers that wipe on reboot, for example). This is stronger than policy promises, but verify the implementation through audits. And even diskless servers can be configured to forward logs elsewhere before wiping.
DNS leaks and the illusion of protection
Your VPN encrypts traffic to the VPN server, but DNS requests—translating domain names to IP addresses—can leak outside the tunnel. If your device uses your ISP's DNS servers while the VPN is active, your ISP sees every domain you visit despite the encrypted tunnel. This is a DNS leak, and it's surprisingly common with misconfigured VPNs.
Good VPN clients route DNS queries through the tunnel and use the provider's DNS servers or privacy-respecting third-party options. Test this yourself: search "DNS leak test" and check if the reported DNS servers belong to your VPN provider, not your ISP. If you see your ISP's DNS servers while connected, your traffic is partially exposed.
Some VPN protocols handle this better than others. WireGuard, for instance, requires explicit configuration of DNS servers, making leaks less likely if set up correctly. OpenVPN implementations vary widely in leak protection quality.
VPN protocols: what actually changes
VPN protocols determine how the encrypted tunnel is built and maintained. The protocol affects speed, security, stability, and how easily networks can block the connection. Your choice matters more than most providers admit.
WireGuard is the current standard for performance and auditable security. It's fast, uses modern cryptography, and has a small codebase that's easier to verify for bugs. Most technical users prefer it unless they need specific features it lacks. NordVPN implemented NordLynx (their WireGuard adaptation) across their network, for example.
OpenVPN is the older workhorse. Slower than WireGuard but extremely flexible and battle-tested. It works reliably on nearly every platform and network environment. Configuration complexity means more room for implementation mistakes, but reputable providers handle this.
IKEv2/IPsec offers good speeds and excels at handling network changes—switching from WiFi to mobile data without dropping the connection. Common on mobile VPN clients for this reason. Security is solid if properly implemented.
Proprietary protocols (like NordVPN's NordLynx or ExpressVPN's Lightway) are typically based on standard protocols with modifications. Independent audits matter here—without public scrutiny, you're trusting the provider's security claims.
The protocol doesn't change the fundamental privacy trade-offs. A privacy-invasive VPN using WireGuard is still privacy-invasive; a trustworthy provider using OpenVPN is still trustworthy. Protocol choice affects performance and network compatibility more than core privacy.
The split tunneling reality
Split tunneling lets you route some apps through the VPN while others access the internet directly. Useful for accessing local network devices while connected, or keeping high-bandwidth streaming on your regular connection while protecting other traffic.
The privacy cost: any apps outside the tunnel expose your real IP address and aren't protected from local network monitoring. If you enable split tunneling and accidentally exclude your browser, you've defeated the entire purpose. Some VPN providers disable split tunneling by default for this reason, or warn extensively when enabling it.
Use split tunneling deliberately, not casually. If privacy is your goal, the default should be "everything through the tunnel" with rare, conscious exceptions.
VPN performance: what determines actual speed
Marketing promises like "blazing fast" or "no speed loss" are meaningless. Your VPN speed depends on multiple factors:
- Physical distance to the server: Longer distances mean higher latency and generally lower speeds. Connecting to a server on another continent will always be slower than one in your country.
- Server load: An overcrowded server splits bandwidth among hundreds of simultaneous users. Providers rarely publish real-time load data.
- Your base internet speed: A VPN can't make your connection faster than your ISP provides. Overhead from encryption typically reduces speed by 10-30% under ideal conditions.
- Protocol efficiency: WireGuard usually outperforms OpenVPN on the same network path.
- ISP throttling: Some ISPs deliberately slow VPN traffic. Switching protocols or ports can sometimes bypass this.
When a VPN actually solves your problem
Use a VPN when your threat model involves:
- Local network surveillance: Public WiFi, hostile network administrators, untrusted infrastructure.
- ISP logging and profiling: Your internet provider tracking and potentially selling your browsing history.
- Geographic restrictions: Accessing content blocked in your region (while acknowledging this may violate terms of service).
- IP-based tracking: Making it harder for websites to build profiles based on your IP address alone.
- Anonymity from nation-state adversaries: Use Tor for serious anonymity needs, accept the speed trade-off.
- Protection from the services you log into: They know who you are regardless of IP address.
- Security on fundamentally compromised devices: A VPN on malware-infected hardware protects nothing.
- Legal immunity: VPNs add investigative friction, not legal shields.
Key takeaways
- A VPN encrypts traffic between your device and a chosen server, hiding your activity from local networks and ISPs—but the VPN provider itself can see everything your ISP used to see
- "No logs" is marketing shorthand, not a technical absolute—read the actual logging policy to see what connection metadata and activity data the provider stores and for how long
- VPNs hide your IP address from websites but don't prevent tracking through cookies, login credentials, or browser fingerprinting—you're not anonymous to services where you authenticate
- Jurisdiction matters more than server locations—where the company is incorporated determines what legal requests they must honor and what data retention is mandatory
- Test for DNS leaks yourself; a misconfigured VPN can expose your browsing history to your ISP despite the encrypted tunnel appearing active
- Choose based on your specific threat model—VPNs solve ISP surveillance and local network monitoring, not anonymity from law enforcement or protection from targeted malware