What is a VPN?
A VPN sends your internet traffic through an encrypted tunnel to a server somewhere else, so the networks between you and the web see far less. This guide explains how that works, when it genuinely helps, and where its limits are.
On this leg, your provider and the local network see one encrypted stream to one address — not the sites behind it.
The short version
A VPN — virtual private network — is a service that encrypts everything your device sends and routes it through a server you choose. Two things change as a result. Your internet provider, your employer's network or the café's router can no longer read what you are doing; they see an encrypted stream to a single address. And the websites you visit see the VPN server's IP address instead of yours, which is why they place you in the server's country.
That is the whole mechanism. Everything else people say about VPNs — unblocking catalogues, dodging price discrimination, staying safe on public Wi-Fi — is a consequence of those two facts, not a separate feature.
What your internet provider can actually read
- netflix.com
- bank-of-example.com
- clinic-appointments.fr
- reddit.com/r/…
Every domain you open, in order, with timestamps. Many providers are legally required to keep this record.
One address and a stream it cannot read. The list of sites stays on your side of the tunnel.
How the tunnel actually works
- 01
Your device encrypts
Before anything leaves your machine, the VPN client wraps it in encryption. The network you are sitting on can still see that data is moving, but not what it contains or where it is ultimately headed.
- 02
It travels to the server
The encrypted stream goes to the VPN server you selected. To your provider, this looks like one long conversation with one address, whatever number of sites you actually visit.
- 03
The server forwards it
The server decrypts your request, sends it on to the real destination, and returns the answer through the same tunnel. The destination sees the server's address, not yours.
When a VPN genuinely helps
Untrusted networks
Hotel, airport and café Wi-Fi are shared networks you do not control. Encryption removes the possibility of anyone on the same access point reading along.
Your provider's view
Without a VPN, your ISP has a complete list of every domain you visit. Many are legally required to keep it, and some sell derived data.
Content tied to a country
Streaming catalogues, news archives and shop pages differ by region. Connecting through another country shows you what a visitor there sees.
Prices that follow location
Fares and quotes routinely adapt to where you appear to be. Comparing from a neutral country is the only way to spot the difference.
VPN protocols, explained plainly
A protocol is the set of rules for building the tunnel. You rarely need to choose one manually, but knowing what they trade off makes the setting less mysterious.
WireGuard
DefaultModern, remarkably small, and fast to connect. Its compact codebase is easier to audit than older protocols, which is why most services now default to it.
OpenVPN
VeteranSlower to negotiate and heavier, but battle-tested over two decades and able to blend into ordinary HTTPS traffic on restrictive networks.
IKEv2/IPsec
MobileReconnects gracefully when a phone switches between Wi-Fi and mobile data, which makes it a common choice on mobile operating systems.
Xray
Restrictive networksA transport designed to keep working where classic VPN protocols are detected and blocked. SandVPN offers it on desktop for exactly those situations.
VPN vs proxy vs Tor
These three get compared constantly, usually badly. They solve different problems, and picking the wrong one costs you either privacy or speed.
| VPN | Proxy | Tor | |
|---|---|---|---|
| Encrypts your traffic | Yes, everything the device sends | Usually not | Yes, in several layers |
| Scope | The whole device, or the browser with an extension | One app or one browser | The Tor Browser only |
| Speed | Close to your normal connection | Fast, because nothing is encrypted | Noticeably slow by design |
| Who can see your activity | The VPN provider, by construction | The proxy operator, in the clear | No single party sees both ends |
| Best suited to | Everyday privacy, public Wi-Fi, geo-restrictions | Quick one-off unblocking | High-risk anonymity needs |
What a VPN does not do
This is where most VPN marketing overpromises. Being clear about the limits is what makes the real benefits credible.
It covers the connection, not the account
A VPN hides your address from the sites you open. What you hand over at signup — an email, a name — is a separate layer, and that is what disposable inboxes and throwaway identities are for.
It does not stop tracking
Cookies, browser fingerprinting and ad identifiers work independently of your IP. Reducing those takes different tools, not a longer tunnel.
It does not replace good habits
A VPN cannot protect you from a phishing page you type your password into, or malware you install yourself. It secures the transport, not the decision.
Frequently asked questions
Is using a VPN legal?
In most countries yes, and it is standard practice in business — remote work has relied on VPNs for decades. A handful of states restrict or license them, and using one does not make an otherwise illegal act legal. Check your local rules if you are unsure.
Will a VPN slow down my internet?
A little, always: encryption costs a small amount of processing and your traffic takes a longer physical path. With a modern protocol and a nearby server the difference is usually invisible in practice — HD streaming and calls stay normal.
Do free VPNs have a catch?
Running servers costs money, so ask how it is paid for. Some free services sell browsing data or inject advertising. A free tier that exists to introduce a paid plan — with the same no-log policy as the paid one — is a different proposition.
Extension or full app: which do I need?
An extension encrypts browser traffic only, installs in seconds and leaves your other applications untouched. The desktop or mobile app covers everything on the device, including background services. Many people use the extension daily and the app when it matters.
What is a no-log policy worth?
It matters because data that is never recorded cannot be handed over, seized or leaked. What it is worth depends on how specific the claim is: which data, kept for how long, and under which jurisdiction.
Can a website tell I am using a VPN?
Often, yes. Datacentre IP ranges are published, and sites also compare your announced country against signals like your timezone and browser language. Aligning those signals is what our Geo-Spoof feature is for.
Try it rather than read about it
The free tier needs no card and no account. Install it, pick a country, and see what changes.