What is a VPN? A VPN is a virtual private network: a way to create a protected connection or virtual network across another network, often the public Internet. Many consumer VPN services route your device’s traffic through a VPN server using an encrypted tunnel. This can help protect data on the path between your device and that server and can change the public IP address seen by websites. Corporate VPNs often serve a different purpose: enabling authorised remote access to an organisation’s private systems.
The important qualification is that a VPN is not an invisibility cloak. It does not make a fake website genuine, erase everything that identifies you, guarantee anonymity or replace good passwords and careful choices. The VPN provider may become a party you must trust. Websites can still recognise your logged-in account, and a scammer can still persuade you to type information into a fraudulent page.
Quick notes: VPN = virtual private network. A tunnel carries selected network traffic to another endpoint. Encryption can protect that link; the VPN server then forwards traffic according to the service design. A website often sees the VPN server’s address rather than your home connection’s address. HTTPS still matters. A work VPN and a commercial privacy VPN solve different problems. Use a VPN for a clear purpose, check your provider, and do not treat it as protection from phishing.
What a VPN actually does—and the problem it solves
Every Internet connection involves a path. Your device communicates through a home router, mobile network or public Wi-Fi, then through network operators to the service you want to reach. Different participants can observe or control different parts of that path. Transport and application encryption, such as HTTPS, already protect many web interactions; however, users or organisations may need an additional way to route traffic through a trusted endpoint.
A VPN makes a logical connection through an existing physical network. ‘Virtual’ does not mean imaginary; it means a network relationship built using software and protocols rather than a private cable between every participant. ‘Private’ refers to protected or restricted use of that relationship, not a guarantee that the user’s identity cannot be discovered.
A company may use a VPN so an employee working from home can reach approved internal systems. A consumer may use one to protect or route traffic through an intermediary they choose. Both use the general idea of a tunnel, but the endpoints, goals and trust relationships differ.
How a consumer VPN works step by step
- You connect: the VPN application establishes a session with a VPN server, usually after authentication or another configured trust step.
- A tunnel is established: selected traffic is encapsulated and typically encrypted while travelling between your device and that server.
- The VPN server forwards traffic: it sends requests towards the Internet or another destination, depending on its configuration.
- Replies return: responses reach the VPN server and are carried back through the tunnel to your device.
- Applications continue: your browser or app displays the result, while the traffic path and visible public address may differ from a direct connection.
This is a simplified model. Different VPN protocols, operating systems and organisational policies handle routing, DNS, IPv6, device controls and authentication differently. Some connections use split tunnelling, which means certain traffic does not pass through the VPN. Never assume every application is covered merely because a VPN icon is visible.
A practical example: the school research session
Imagine a student at home researching a history project. Without a VPN, the student’s device connects through the home network to websites, usually with HTTPS protecting modern web sessions. With a consumer VPN enabled for that browser’s traffic, the device first builds a protected connection to a VPN server, and the server forwards the web requests. The website may see the VPN server’s public IP address instead of the home’s public IP address.
The research website can still know the student if they sign into an account. The student’s browser may still send cookies or other identifiers, subject to browser settings and website behaviour. If the student clicks a fraudulent scholarship link, the VPN does not stop the deception. The lesson is that changing the route of packets and changing who is able to identify a person are different questions.
Which parts of the connection can others see?
The local network and Internet provider
Without a VPN, an Internet provider can observe some network connection metadata, although HTTPS limits access to protected web content. With a typical encrypted VPN tunnel, the local network and Internet provider can usually see that the device connects to a VPN server and may see timing and amounts of traffic. They generally cannot simply read the encrypted tunnel’s inner content. Exact visibility depends on protocols, app behaviour and network configuration.
The VPN provider
Traffic reaches the VPN endpoint before it travels onward. This can place important information about routing and requests in the VPN provider’s hands. What the provider can technically observe, log or retain depends on service architecture and on whether the destination connection itself uses end-to-end encryption. Promises such as ‘no logs’ should be evaluated with evidence, not accepted as a magic security property.
The website or online service
A destination site often sees the VPN server’s public address rather than the user’s ordinary home address, but it can still receive account credentials that the user intentionally sends, browser cookies, device information and other signals. Logging into a personal account is enough for the website to associate that visit with the account. A VPN does not make a logged-in session anonymous.
An attacker operating a fake website
The VPN does not know whether the website’s story is honest. If a deceptive page asks for a password, card number or identity document and the user supplies it, the attacker may receive that information over an encrypted connection. This is why protection of transport is not proof of trustworthiness.
VPN versus HTTPS: why both terms matter
HTTPS is commonly used to protect communication between a browser and a website, using TLS. It is not a VPN. A VPN typically protects a separate network path between configured endpoints. A browser can use HTTPS through a VPN, so the protections can coexist at different layers.
An HTTPS padlock means the browser has established a protected connection according to the certificate and protocol checks. It does not certify that the person operating a website is honest. Likewise, a VPN icon indicates the app or device believes a tunnel is operating; it does not verify the truth of the information you are reading.
An easy memory aid is to ask two questions: Which path is protected? and Who is trusted at the ends? Encryption answers important transport questions. Identity, service design and user decisions answer different questions.
Consumer VPNs and workplace VPNs are not the same job
- Consumer privacy VPN: commonly routes selected Internet traffic through the provider’s server, affecting the public address and intermediary network path.
- Remote-access work VPN: can allow an authorised employee or student to reach internal resources securely under organisational rules.
- Site-to-site VPN: links networks, such as separate offices, through configured secure tunnels.
- Split-tunnel VPN: routes only selected applications or destinations through the tunnel; other traffic follows its ordinary route.
- Always-on configuration: attempts to keep specified traffic protected by policy, but details and failure behaviour are implementation-dependent.
A VPN can also be part of a broader security architecture rather than the sole security control. Many organisations additionally use device management, modern identity checks, access policies and application-specific protections.
Can a VPN hide your IP address?
It often hides your normal public IP address from the destination by presenting the VPN server’s address instead. ‘Often’ is the key word: leaks, split tunnelling, device configuration, app bypasses or protocol differences may reveal information. Changing an IP address also does not erase cookies, accounts, billing information or fingerprints.
If a learning guide tells you that ‘VPN means anonymous’, it has skipped the hardest part of the subject. Privacy is about what information a party can learn and link to a person. One network address is only one piece of that picture.
Can a VPN make public Wi-Fi safe?
A VPN may add protection to selected traffic on a network you do not control. Yet even without a VPN, modern HTTPS already protects much website traffic. A VPN does not fix a malicious download, an unsafe app, a weak device password, a fraudulent captive portal or careless sharing of verification codes. It should be considered one control among several, not a substitute for updating devices and checking sites.
At a library, airport or café, start with the correct Wi-Fi network name, device updates, HTTPS, secure account settings and awareness of suspicious prompts. Use your organisation’s recommended VPN when access policy requires it. Do not install a random VPN application simply because an advertisement promises total safety.
How to choose a VPN without trusting advertising
- Define your reason: remote work access, a specific privacy need, or secure routing. Different goals produce different choices.
- Identify the provider: find out who operates it, what product and business model it uses, and where its policies are published.
- Read privacy and retention terms: look for meaningful descriptions of what is collected, how long it is kept and under what conditions it may be disclosed.
- Check device compatibility and routing: understand which applications are covered, whether split tunnelling is used and what happens if the connection drops.
- Consider evidence: independent security assessments and clear incident disclosures can be more informative than vague marketing claims.
- Review limitations: latency, blocked services, regional rules, reliability and support all matter.
- Keep ordinary security controls: strong unique passwords, multi-factor authentication, updates and safe browsing remain necessary.
No single checklist can declare a provider risk-free. If an employer or school requires access to an internal network, use its officially supported method rather than substituting an unrelated consumer product.
VPN speed, latency and reliability
Routing through another server may add distance and processing work. In some networks it can improve a problematic route; in others it reduces throughput or increases latency. Bandwidth is how much data can move per unit time, while latency is delay before a response. A large download and an interactive video call can be affected differently.
A sensible test uses comparable conditions: run the same task with and without the VPN, record the chosen server and approximate time, then repeat. One speed-test number is not an explanation. Congestion, local Wi-Fi, server capacity, geographic distance and the remote service can all influence what you observe.
Four misleading VPN claims to question
- ‘A VPN stops every hacker.’ It does not prevent social engineering, malware installation, account misuse or all technical attacks.
- ‘A VPN means nobody can track me.’ Accounts, cookies and other signals can still identify activity.
- ‘A VPN is the same as encryption.’ A VPN uses network structures and often encryption; many other systems use encryption without being VPNs.
- ‘A VPN always makes the Internet faster.’ Added routing can increase delay, although performance varies.
- ‘HTTPS is unnecessary if I use a VPN.’ End-to-end application protection remains important beyond the VPN endpoint.
A safe worked comparison: three network journeys
Journey A: HTTPS, no VPN
A browser connects to an HTTPS website through the ordinary Internet path. TLS protects the web session; the service sees the connection’s public IP and any information the user sends. Network operators may still observe limited connection metadata.
Journey B: HTTPS through a consumer VPN
The browser’s traffic passes through a protected tunnel to a VPN server and then towards the HTTPS website. The site may see the VPN server’s address, while the account and browser can still identify the user. The VPN provider becomes an additional trust point.
Journey C: a worker uses a company VPN
An authorised worker connects through a company-supported VPN to an approved internal application. The purpose is controlled network access, not making the employee anonymous to the employer. Logging, authentication and auditing may be deliberate components of the security programme.
All three scenarios can be legitimate. The right answer depends on who needs access, which information must be protected and whom the person is willing or required to trust.
The student exercise: draw the connection
Draw three boxes: Device, VPN Server, Website. Add the home network beneath the first arrow. Label the protected tunnel from the device to the VPN server. Draw a separate connection from the VPN server to the website. Now add the words ‘login cookie’ beside the website. Ask a student: does changing the network path remove the login cookie? No. This simple diagram reveals why network privacy and account identity are different.
For an additional challenge, draw a second route directly from the device to a different app. Label it ‘split tunnel’. Ask whether the VPN can be assumed to cover that app. The correct response is to check the configuration, not to guess from an icon.
How to teach VPNs in seven short sessions
- Session 1: Define a network and an IP address in everyday language.
- Session 2: Explain a virtual network and a protected tunnel.
- Session 3: Distinguish a VPN from HTTPS.
- Session 4: Compare a consumer VPN with a workplace VPN.
- Session 5: Explain why the VPN provider is a trust decision.
- Session 6: Trace a fictional phishing message and explain why a VPN cannot judge the message’s honesty.
- Session 7: Draw a new network scenario and identify the parts you can and cannot verify.
Common VPN questions
What does VPN stand for?
Virtual private network.
What is a VPN in one sentence?
A VPN is a logical network connection that uses existing network infrastructure, often with a protected tunnel, to connect devices or networks through another endpoint.
Is a VPN the same as incognito mode?
No. A browser’s private or incognito mode changes some local browsing-data behaviour. A VPN changes how selected network traffic is routed and protected. Neither is a promise of anonymity.
Does a VPN protect against phishing?
No. You still need to verify unexpected links, payments and sign-in requests. Read What is Phishing? for a practical checking method.
Can a website tell I use a VPN?
Sometimes. Services may identify addresses associated with known VPN servers or infer network behaviour. This does not by itself establish who a particular user is.
Does a VPN always change my location?
It may change the approximate location inferred from the exit server’s IP address, but device GPS, account settings and other signals may still reveal or suggest location.
Do I need a VPN to learn programming?
No. Python and many other programming languages can be learned locally without a VPN. Your tools should match a specific need, not a generic promise of safety.
Can I use a VPN legally?
Rules vary by jurisdiction, service and institution. Follow applicable law and the policies of the services or networks you use; a VPN does not grant permission to bypass restrictions.
Where to go next
A VPN is about the network path. Phishing is about deceptive requests. APIs explain how applications request services. Learning each concept separately makes the Internet easier to reason about. See also the G3 Computing guide to firewalls, anti-malware and encryption.
Sources and scope
The US NIST VPN glossary describes virtual networks, tunnelling and security. For Singapore cyber-hygiene resources visit the Cyber Security Agency of Singapore. This is a general educational explanation, not a recommendation to buy any particular VPN service or a guarantee about an individual product.