A VPN routes your internet traffic through an encrypted tunnel to a server somewhere else, then out to the site you asked for. Two things change: the site sees the VPN server's IP instead of yours, and anyone between you and the VPN server sees only encrypted traffic.
That is the whole mechanism. Everything else people claim about VPNs follows from it - or is marketing.
What a VPN actually protects
Public Wi-Fi
On an open network at an airport or café, anyone on the same access point can watch unencrypted traffic. HTTPS covers most of it now, but DNS lookups and the hostnames you connect to still leak. A VPN closes that gap.
Your ISP's view of you
Your internet provider can log every domain you visit and, in many countries, is required to keep those logs. Through a VPN they see one encrypted connection to one server and nothing else.
Region-locked content
Streaming catalogues, app stores and some news sites vary by country. Connecting through a server in another country changes which catalogue you get.
What a VPN does not protect
This is where most VPN marketing gets dishonest.
- It does not make you anonymous. If you log into an account, that account knows who you are regardless of your IP.
- It does not stop tracking. Cookies, browser fingerprinting and ad SDKs work exactly the same through a tunnel.
- It does not stop malware. A VPN moves your traffic; it does not inspect it.
If you need real anonymity rather than privacy from your ISP, a VPN is the wrong tool - look at Tor.
The one thing that matters when choosing
A VPN moves the trust, it does not remove it. Your ISP can no longer see your traffic, but the VPN operator now can. So the only question worth asking is whether you trust that operator more than your ISP.
Which is why a no-logs policy is not a feature bullet - it is the product.
