How a VPN protects your connection

A VPN (virtual private network) builds an encrypted tunnel from your device to a VPN server. Here is what happens to your data, step by step.

The tunnelWho sees whatProtocolsWhat a VPN does not do
The encrypted tunnel(01)
Diagram of a VPN connection Your device sends encrypted data through a tunnel across the local network and internet provider to the VPN server. The VPN server decrypts it and connects to the website, which sees only the server's IP address. Your device Encrypts data Encrypted tunnel (WireGuard / OpenVPN / IKEv2) Wi-Fi / local network sees: encrypted data Internet provider sees: link to VPN server VPN server Decrypts & forwards Website sees server IP
  1. 1

    Encrypt

    The app encrypts each packet on your device before it leaves.

  2. 2

    Tunnel

    Data crosses the Wi-Fi and your provider inside the tunnel.

  3. 3

    Decrypt

    The VPN server decrypts it and sends it on to the website.

  4. 4

    Return

    Replies come back the same way, encrypted to your device.

Who sees what(02)

Visibility with and without a VPN

PartyWithout VPNWith VPN
Public Wi-Fi operatorSites you visit (domain names), unencrypted trafficOnly that you are connected to a VPN server
Internet providerSites you visit, connection times, data volumeConnection to the VPN server, data volume
WebsitesYour real IP address and approximate locationThe VPN server's IP address and location
VPN serviceNothingThat you connected and how much data passed. A trustworthy service does not store your browsing.
Accounts you sign in toYour identity and activityStill your identity and activity

Most websites already use HTTPS, which encrypts page content. A VPN adds protection for the parts HTTPS leaves visible, such as which sites you visit and your IP address.

Protocols(03)

Choosing a protocol

The app chooses automatically. Change it only if a network blocks the connection or you need a specific trade-off.

Recommended

WireGuard

Modern and lean, with a small codebase that is easier to audit. Usually the fastest option, with quick connection setup.

  • ✓Best speed and battery life
  • ✓ChaCha20 encryption
Most compatible

OpenVPN

Long-established and open source. Can run over TCP port 443, which helps on networks that block other VPN traffic.

  • ✓Works on restrictive networks
  • ✓AES-256 encryption
Great on mobile

IKEv2/IPsec

Reconnects quickly when your phone switches between Wi-Fi and mobile data, so you stay protected while moving.

  • ✓Stable when changing networks
  • ✓AES-256 encryption

Good to know.

What a VPN does and does not do

A VPN does

  • ✓Encrypt traffic between your device and the VPN server
  • ✓Hide your IP address from the websites you visit
  • ✓Keep your browsing private from the local network and your provider
  • ✓Protect you on public and shared Wi-Fi

A VPN does not

  • ✕Make you completely anonymous online
  • ✕Stop tracking by cookies or accounts you sign in to
  • ✕Replace antivirus protection or protect against phishing on its own
  • ✕Make illegal activity legal. Local laws and service terms still apply
Ready when you are

Turn on private browsing in under a minute

Follow the illustrated step-by-step guide and see the green checkmark on your own screen.

GET VPN NOW