VPNs Explained for Beginners: What They Do, What They Don't, and How to Choose One

By the Privacy Plain English Team · September 8, 2026 · 9 min read

Quick note on how we stay honest: this site may earn commissions from some VPN providers linked in our guides. It never affects what we recommend — read our full disclosure.

You've seen the ads. A stern voiceover warns that hackers are stealing your passwords right now, and only a VPN can save you. Then a different site tells you VPNs are a scam and you don't need one at all.

Both of those are trying to sell you something — one a subscription, the other a hot take. This guide is neither. It's the plain-English explanation of what a VPN actually does, where its limits are, and how to pick one without getting played. By the end, you'll know whether you need one, and if so, exactly what to look for. No jargon without a definition. No fear. Let's go.

What a VPN Actually Does (the 2-Minute Version)

Normally, when you visit a website, your internet provider (ISP) carries your traffic from your device to that site. That means two things are visible along the way:

Your ISP can see which sites you visit (the addresses, though usually not the page contents, which are scrambled by HTTPS).
Every site you visit can see your IP address — a number that roughly reveals your location and identifies your connection.

A VPN changes the route. Instead of going straight from your device to the website, your traffic first travels through an encrypted tunnel to a server run by the VPN company, and then out to the website. Think of it like mailing a letter inside a second, sealed envelope addressed to a forwarding service: anyone watching your mailbox sees a letter going to the forwarder, and the recipient sees a letter coming from the forwarder. Nobody in the middle sees both halves.

Without a VPN, your ISP sees your destinations and websites see your IP. A VPN puts an encrypted tunnel — and the VPN company's server — between you and everyone else.

Concretely, a VPN does three things:

Encrypts your traffic between your device and the VPN server. On public Wi-Fi — a hotel, an airport, a café — this stops anyone else on that network from snooping on what you're doing.
Hides your real IP address from the websites you visit. They see the VPN server's IP instead, which also makes it look like you're browsing from wherever that server is located.
Hides your browsing destinations from your ISP. Your provider sees only that you're connected to a VPN server, not which sites you visit afterward.

That's the whole trick. It's genuinely useful — and it's also much narrower than the ads suggest. Which brings us to the part VPN companies hope you skip.

What a VPN Does NOT Do (Read This Before You Buy)

It does not make you anonymous. This is the biggest myth in the niche. If you log into Gmail, Facebook, or Amazon while connected to a VPN, those companies know exactly who you are — your account identifies you, VPN or not. Anonymity online requires a whole system of habits (separate accounts, hardened browsers, discipline); a VPN is one tool, not a cloak of invisibility.

It does not stop tracking cookies or fingerprinting. Advertisers track you mostly through cookies stored in your browser and "fingerprinting" (your device's unique combination of settings, fonts, and screen size). A VPN changes your IP address but touches none of that. If you want fewer creepy ads, you need browser-level defenses — tracker blockers, clearing cookies, privacy-focused browser settings — not just a VPN.

It does not protect you from malware, phishing, or scams. A VPN encrypts your connection; it does nothing about the malicious attachment you just opened or the fake "your package is delayed" text asking for your credit card. Roughly speaking: a VPN protects data in transit, while antivirus and your own skepticism protect you from bad content. You need both kinds of protection, and they don't substitute for each other.

It does not hide you from the VPN provider itself. This is the fine print nobody reads aloud. When you use a VPN, you're shifting your trust from your ISP to the VPN company — they can now see what your ISP used to see. That's why who you choose matters enormously, which we'll get to below.

It doesn't make illegal activity legal, and it doesn't guarantee access to everything. Streaming services actively block known VPN servers, and no VPN changes the law where you live.

The honest summary: a VPN is a connection privacy tool. It controls who can see your traffic and where you appear to be. It is not an invisibility shield, an antivirus, or an ad blocker.

When You Actually Need One (and When You Don't)

Let's make this practical with real scenarios.

You probably want a VPN if:

You regularly use public or semi-public Wi-Fi — hotels, airports, cafés, coworking spaces. This is the clearest-cut case. On an open network, unencrypted traffic can be intercepted by others on the same network. A VPN's encrypted tunnel closes that hole. If you travel even a few times a year, this alone justifies it.
You don't want your ISP building a profile of your browsing. In many countries, ISPs can legally log and sell browsing data. A VPN moves that visibility to the VPN provider — which only helps if you picked a trustworthy one (more below).
You want to access content from another region. A VPN server in another country makes streaming services and websites treat you as a local visitor. This is the most popular real-world use, though services fight back by blocking VPN IPs, so it doesn't always work.
You work remotely on networks you don't control — or your employer requires one (many companies issue their own VPN; that's a separate thing from the commercial VPNs in this guide).

You probably don't need a VPN if:

Your main worry is online banking or shopping. Those sites already use HTTPS encryption end-to-end. A VPN adds almost nothing on top for this specific threat.
You only browse at home on your own secured Wi-Fi and don't care about ISP logging. Your home network, with a decent router password and WPA2/WPA3 encryption, is already reasonably private from neighbors and passersby.
You think it will stop scams or viruses. It won't (see above). Spend that money and attention on a password manager and two-factor authentication instead — those protect beginners far more.

The one-question test: do you regularly use internet connections you don't control, or do you want to limit what your ISP can see? Yes to either → a VPN is a reasonable purchase. No to both → you can safely skip it for now.

How to Evaluate a VPN Provider: The 6 Things That Actually Matter

VPN marketing is a swamp of meaningless superlatives ("military-grade encryption!" — nearly all of them use the same standard AES-256 encryption, so this tells you nothing). Ignore the adjectives. Check these six things instead:

1. Logging policy — and whether it's been tested. Every provider claims "no logs." What matters is evidence: has the provider undergone an independent audit of its no-logs claim, and has it ever been compelled to hand over data it claimed not to have? Look for published audit reports from named, reputable firms — not a badge on the homepage, but an actual report you can read. A provider whose servers were once seized by authorities and yielded nothing has the strongest possible proof; a provider with only marketing copy has the weakest.

2. Jurisdiction. Where the company is legally based determines which governments can compel it to log or hand over data. Privacy-friendly jurisdictions with no mandatory data-retention laws for VPNs (examples often cited include Panama, the British Virgin Islands, and Switzerland) are preferable to countries with aggressive surveillance alliances or data-retention mandates. This isn't about evading law enforcement — it's about minimizing the number of parties that can legally force logging.

3. Independent security audits. Beyond logging audits, reputable providers commission third-party audits of their apps and infrastructure. Check the provider's site for audit reports dated within the last couple of years. No audits at all is a yellow flag; recent, published audits from known firms is a green flag.

4. Modern protocols: WireGuard and OpenVPN. The "protocol" is the method your device uses to build the encrypted tunnel. WireGuard is the modern default — fast, with a small, auditable codebase. OpenVPN is the battle-tested veteran — slightly slower, extremely well scrutinized. Any provider worth considering offers both and lets you switch in the app's settings. Avoid providers pushing only a proprietary protocol with no independent review.

5. A kill switch. This is a simple, critical feature: if the VPN connection drops, the kill switch blocks all internet traffic until the tunnel is re-established. Without it, a dropped connection silently exposes your real IP — the exact thing you bought the VPN to hide. It should be easy to find and turned on by default or one toggle away. Treat a missing kill switch as a dealbreaker.

6. Leak protection and a trustworthy app. Your VPN should protect against DNS leaks (where address lookups bypass the tunnel) and IPv6 leaks. Reputable providers publish leak-test guidance and their apps handle this automatically. Also check: does the company publish transparency reports, run a bug-bounty program, and use RAM-only servers (servers that physically can't retain data after a reboot)? Each is a small positive signal; together they paint the picture.

What doesn't matter much: the raw number of servers or countries (beyond "enough for good speeds near you"), flashy speed-test claims on the provider's own site, and any "award" badge you can't trace to a real review.

Setting One Up: The 10-Minute Version

This is genuinely easy — easier than assembling flat-pack furniture, and you only do it once.

Choose a provider using the criteria above, and sign up on its official website (never through a random "discount" link from an ad — phishing sites imitate VPN brands).
Download the app from the provider's site or your device's official app store. Install it on your phone and computer; most subscriptions cover 5–10 simultaneous devices.
Log in, and connect to the nearest server location. Closest = fastest. You don't need to overthink the server choice for everyday privacy.
Turn on the kill switch in the app's settings. This is the single most important toggle.
Set the protocol to WireGuard (or leave the default if the app picks it automatically — most good ones do).
Verify it's working: with the VPN connected, visit a leak-test site (search "DNS leak test") and confirm the IP address and location shown match the VPN server, not your real location. Then disconnect and confirm it changes back.

That's it. Day-to-day, you just open the app and hit connect — many apps offer auto-connect on untrusted Wi-Fi, which is worth enabling if you travel.

Free vs. Paid: The Honest Math

Running a VPN costs real money — servers in dozens of countries, bandwidth, engineers, audits. So when a VPN is free, ask where the money comes from. The answers, historically: selling user data, injecting ads, limiting you heavily to upsell a paid tier, or some combination. Several once-popular free VPNs have been caught doing exactly this.

There is one legitimate exception: freemium tiers from reputable paid providers — a limited free plan (capped data, fewer servers) offered as a trial funnel for the paid product. The business model is transparent: they hope you upgrade.

For most beginners, the math favors paying: a 1–2 year plan from a reputable provider typically works out to a few dollars a month — less than one streaming subscription. Given that the entire value of a VPN rests on trusting the provider, paying a company whose business model is your subscription rather than your data is the whole point.

FAQ

Will a VPN slow down my internet?: Somewhat, yes — encryption and rerouting add overhead. With a modern protocol like WireGuard and a nearby server, the difference is usually 10–20%, which most people won't notice for browsing, streaming, or video calls. If speeds tank, switch servers or protocols before blaming the VPN concept.
Can I use a VPN on my phone and laptop at the same time?: Yes. Nearly all paid providers allow multiple simultaneous connections (typically 5–10 devices), and setup on phones is just installing the app and logging in.
Is using a VPN legal?: In most countries, yes — it's a legitimate privacy tool. A few countries restrict or ban VPN use; check local law if you travel to one. And a VPN doesn't make anything illegal legal.
Do I need a VPN if I only use it at home?: Only if you want to limit ISP visibility into your browsing or access region-locked content. For protection against hackers on your own secured home Wi-Fi, a VPN adds little — your router password and HTTPS are doing the real work there.
What's the difference between a VPN and antivirus?: They protect against completely different things. A VPN protects your connection (who can see your traffic). Antivirus protects your device (malicious files and programs). One doesn't replace the other.

The Bottom Line

A VPN is a narrow, useful tool: it encrypts your traffic to a server you choose, hides your IP from websites, and hides your destinations from your ISP. It doesn't make you anonymous, doesn't stop tracking or malware, and shifts your trust to the provider — so choose one with audited no-logs practices, a sane jurisdiction, modern protocols, and a kill switch. If you travel, use public Wi-Fi, or just don't love your ISP watching, it's one of the simplest privacy upgrades you can make in ten minutes. If none of those apply, your money is better spent on a password manager.

Start with the decision guide if you're still unsure — and if you're ready to pick, read the beginner travel buying guide next, where every recommendation is scored against the criteria above.