Using a VPN: What It Actually Does for You, and What It Doesn't
A friend messaged me last month, halfway through a trip to a conference in a country where the hotel Wi-Fi kept flagging his bank's login page as suspicious. "Should I just get a VPN?" he asked. "Will it make me invisible?" That second question is the one that made me want to write this. Because no, it won't. And the gap between what people think a VPN does and what it actually does is where most of the confusion lives.
I've been running a VPN on my own devices for years, on and off, across laptops, phones, and a router I configured myself. I've also broken things in the process, wasted money on subscriptions I didn't need, and once spent an entire evening convinced a provider was secretly logging me when the problem was a misconfigured kill switch on my end. So this isn't a sales pitch. It's what I've learned, mistakes included.
Key Takeaways
- A VPN encrypts your traffic between your device and the provider's server. It does not encrypt everything you do online.
- Your IP address changes. Your browser fingerprint, your cookies, and your logged-in accounts do not.
- Free VPNs have to make money somehow, and the currency is usually your data.
- VPNs protect you from some threats on public Wi-Fi, but not from phishing or malware you install yourself.
- Law enforcement can compel a VPN provider to hand over whatever it retains. Whether it retains anything is the real question.
- For most home users, the honest benefit is smaller than the marketing suggests. For some specific situations, it's genuinely worth it.
What a VPN actually does (and why the word "tunnel" matters)
Strip away the marketing and a VPN is a fairly simple thing: it takes the traffic leaving your device, wraps it in encryption, sends it to a server operated by the provider, and that server forwards it to the wider internet on your behalf. The connection between you and that server is the tunnel. Outside the tunnel, everything looks like it's coming from the server, not from you.
That's it. That's the whole mechanism. Everything else people say about VPNs is either a consequence of this or a misunderstanding of it.
What actually changes when you hit connect
Two concrete things shift, and they're worth naming precisely:
- Your public IP address becomes the provider's IP address, which is how sites stop seeing your approximate location.
- Your local network operator — the café, the airport, your ISP — can no longer read the contents of your traffic in plain text.
That second point is the one people underestimate. When I first started using a VPN, I did it almost entirely for coffee-shop Wi-Fi, and honestly, that's still the use case where I feel the difference most. On a network I don't control, the tunnel means the person running it can't casually inspect what I'm sending.
What doesn't change, no matter how good the VPN is
Here's where the misconceptions start. A VPN does not hide you from the websites you visit. If you log into your email, that site knows exactly who you are. If you're signed into a Google or Meta account, those platforms still track you across the web regardless of your IP. Your browser's fingerprint — the combination of screen resolution, fonts, extensions, and dozens of other signals — stays largely the same. And the site you're visiting still sees your traffic once it leaves the provider's server.
You are not anonymous. You are less exposed to the network you're sitting on. Those are very different promises.
What are some common myths about VPNs?
The myths are stubborn because they're half-true, which is the worst kind of true. Let me take the ones I hear most often and put them side by side with what's actually happening.
Myth: a VPN makes you completely anonymous
It doesn't. It hides your IP from the sites you visit, but your behavior, your accounts, and your device characteristics are still visible in other ways. If you log into a service with your real account, no VPN on earth changes that. Anonymity online is a much bigger project than installing an app.
Myth: VPNs are only for people doing something illegal
This one shows up constantly, and it's just wrong. The most common legitimate reasons I've seen in practice: journalists working in places where sources need protection, remote workers connecting to a company network, people on hotel Wi-Fi, travelers who want their streaming library to behave normally, and anyone who simply doesn't want their ISP building a profile of their browsing. None of that is illegal. Changing your IP address is not a crime in any jurisdiction I know of.
Myth: a VPN always slows your connection to a crawl
Some slowdown is real and unavoidable — your traffic takes an extra hop, and encryption costs a little processing. But I've tested providers that cost me 5% of my throughput and providers that cost me 60%. The difference is the server network, the protocol, and how far the server is from you. "A VPN slows you down" is like saying "a car uses fuel." True, and useless as a decision criterion.
Myth: a free VPN is just as good as a paid one
No. And this is the one I'd push back hardest on. Servers and bandwidth cost money. If you're not paying, something else is being monetized, and it's usually your traffic or your data. I tried a couple of free options early on and uninstalled them within a week after reading their privacy policies more carefully than I'd read anything in a while. It was not comforting.
What are the benefits and drawbacks of using a VPN?
Let's be honest about both sides, because the "benefits only" framing does a disservice to anyone trying to decide.
The real benefits, ranked by how much they matter
For me, in order of practical impact:
- Untrusted networks stop being a liability. Hotel, airport, café, conference center — the operator can't casually inspect my traffic.
- My ISP stops seeing my destinations. They still see that I'm using a VPN, and roughly how much data I move, but not the sites. For a lot of people that alone is worth the subscription.
- Geo-restricted content behaves the way I expect when I travel. This is genuinely useful and also the reason a lot of providers exist at all.
- Remote access to a home or office network, if you set it up that way, which is a different product from a consumer VPN but frequently lumped in.
The drawbacks nobody puts in the brochure
Here's what actually costs you:
- It moves trust. You're no longer trusting the network — you're trusting the provider. That's a lateral move, not an upgrade, unless you picked well.
- Every site you visit now sees a datacenter IP, which some services treat as suspicious. I've had banking sites throw extra verification challenges at me purely because of the VPN.
- You still need to actually behave carefully. Phishing, malware, and account compromise don't care about your tunnel.
- Battery and performance cost on phones is small but not zero. On weaker Android devices I've noticed it.
| Threat | VPN protects you? | Why |
|---|---|---|
| Someone sniffing a café Wi-Fi | Yes | Traffic is encrypted inside the tunnel |
| Your ISP logging which sites you visit | Partly | They see the VPN, not the destinations |
| Phishing emails | No | The attack targets you, not the connection |
| Malware you downloaded | No | It's already on your device |
| Browser fingerprinting | No | Your device still identifies itself the same way |
| Tracking by logged-in platforms | No | Cookies and accounts survive the IP change |
Can the FBI see through VPNs?
Short answer: not by breaking the encryption, but by going around it. And that distinction matters more than the yes/no.
The legal path, not the technical one
Modern VPN encryption is not something an agency brute-forces. What happens instead is that law enforcement compels the provider to cooperate — through a warrant, a subpoena, or a court order depending on jurisdiction — and asks for whatever the provider has. If the provider keeps connection logs, those logs can identify which subscriber was using which IP at which time. If the provider keeps no logs, there's little to hand over.
This is why "no-logs" claims get audited by third parties, and why providers that refuse to hand over data in court make headlines. It's also why jurisdiction is a real consideration. A provider headquartered in a country with aggressive surveillance cooperation obligations may be legally forced to hand over data it wouldn't otherwise share. I'd rather trust a provider in a jurisdiction with stronger privacy protections, all else equal.
What this actually means for you
If you're a normal user trying to keep your ISP from profiling you, this is all theoretical. If you're doing something that attracts serious legal attention, understand that a VPN raises the effort required to identify you but does not make identification impossible. It never did. Anyone telling you otherwise is selling something.
Does a VPN on your phone actually do anything useful?
Yes, but the reason most people install one isn't the reason they think. On a phone you're constantly joining networks you don't control — hotel, airport, café, train, someone else's hotspot. That's the real benefit. The mobile use case isn't anonymity. It's not broadcasting your traffic to whoever runs the network you just joined.
On Android and iOS alike, the app experience is smooth enough now that this is a five-second decision before connecting. What you gain: encrypted traffic on untrusted networks, a different IP for location-based content, and a bit more resistance to ISP-level profiling. What you don't gain: protection from anything that isn't about the transport layer. If you're on a compromised device, a VPN doesn't save you.
One thing I'd flag for iPhones specifically: the built-in VPN support and how it interacts with apps is cleaner than it used to be, but some providers' apps still drain battery faster than they should. Worth testing on a long day before you commit.
Is a VPN at home worth it?
This is where I'd slow down before recommending anything. If you're sitting on your own home network, with your own router, arguably the least suspicious environment you'll ever be in, the threat model changes completely. Your ISP is still your ISP, so if hiding browsing habits from them is your goal, a home VPN still does that. But you're not gaining much protection from "network attackers" because there's no untrusted network in the picture.
Where a home setup makes real sense: routing your own traffic through a server you control, so that when you're out, you're connecting back to your own network. That's a different thing from a consumer VPN subscription and takes a weekend to configure properly. I've done it. It works well. It's also more maintenance than most people want.
Real talk: if you're paying for a commercial VPN solely for home use, you're likely paying for a benefit you already had.
The question I'd ask before you subscribe
Before you hand over a credit card, answer one thing honestly: what are you actually trying to protect against? If the answer is "someone reading my traffic on a network I don't trust," a VPN is a clean, cheap solution and you should get one. If the answer is "I don't want anyone to know who I am online," a VPN is the wrong tool entirely, and no subscription will fix that.
Most VPN marketing is built on blurring those two questions into one. The gap between them is where I've seen the most disappointment, including my own. Which is why the friend on the conference Wi-Fi got a different answer than he expected: get the VPN for the hotel network, sure. But don't expect it to make you invisible. It won't, and honestly, nothing on a laptop ever has.
