What a VPN Really Does — and What It Does Not

Few tools are advertised as heavily and understood as poorly as the VPN. In the marketing it is a cloak that makes you invisible, a shield against hackers, a free pass across the internet. The truth is soberer and, for that very reason, more useful: a VPN is an encrypted tunnel for your traffic, nothing more and nothing less. It can do a great deal, but only the thing it was built for. Anyone who confuses that lulls themselves into a safety they do not have.

This piece clears up the biggest misconceptions. It explains what a VPN technically does, why its most underrated strength lies in the crowd, how the legal side looks, whether the police can still find you, and why a free VPN is usually the worst of all options.

What a VPN technically does

Normally your traffic runs straight through your internet provider and out onto the web. It sees which sites you head for, and the sites see your IP address, the identifier your connection got from the provider. A VPN wedges itself in between. It opens an encrypted tunnel to a server run by the provider, and only from there does the journey continue into the open net. To the outside, the IP of the VPN server now appears, and your own stays hidden.

Two things change as a result. First, your internet provider can no longer see where the journey leads, because the tunnel is encrypted. It only sees that you are talking to a VPN server. Second, the websites at the far end see a foreign IP, not yours. This is the heart of what a VPN can do, and at the same time the edge of what it cannot.

How much that address gives away in the first place is routinely overstated. If you want the sober version of how far anyone can trace an IP address location, and where the lookup runs out, we covered it separately.

The underrated strength: vanishing into the crowd

The real trick of a good VPN is not that it hides your IP. It lies in which IP you get instead. Over a popular VPN server, hundreds or thousands of other users often run at the same time, and they all share the same exit IP address. To an observer at the far end, your traffic merges with that of all these strangers into a single, untangleable stream.

This mass, shared IP is the anonymity gain that hardly any advert explains. Your anonymity does not come from an IP disappearing, but from it blending in with many others. Where a thousand people walk through the same door, it is hard to say who the individual was. A VPN with few users per server offers little of this protection, a large provider with densely packed servers offers considerably more. It is worth asking about before choosing a service.

Is using a VPN illegal?

This question keeps coming up, often with an uneasy undertone. The answer is plain: in most countries, using a VPN is legal. There is no law forbidding it, and there is no good reason to feel guilty. Companies use VPN technology every day so that staff can reach corporate networks safely from home. Data protection speaks for its use, not against it.

The crucial distinction lies between the tool and the act. What is punishable is never the VPN, but what someone does with it. Whoever distributes copyrighted films, commits fraud or breaks other laws acts unlawfully, tunnel or no tunnel. The VPN does not make a forbidden act permitted, it only makes it harder to attribute. For anyone who keeps to the law, a VPN changes nothing about their legal standing. A small number of authoritarian states are the exception, where VPNs are restricted or banned outright, worth remembering before you travel.

Can the police track me despite a VPN?

Here it gets nuanced, and that is exactly why so much half-knowledge persists. Investigators cannot simply read the traffic running through the tunnel, the encryption sees to that. But that does not mean the trail always ends in nothing.

With a court order, investigating authorities can require the VPN provider to hand over whatever it has stored about a connection. And everything hinges on that. If the provider keeps logs of who used which server, when, and with which real IP, the chain can be traced back to you. If it truly keeps none, there is nothing to hand over at that point, and the trail breaks off. This is the whole meaning behind the marketing word no-logs, and it is why a provider’s location and honesty matter far more than the number of its server locations.

The most honest point comes last: usually there is no need to crack the VPN at all to unmask someone. Anyone who logs into their email during the VPN session, pays at a shop with their own card, or drags along a browser full of recognisable traits leaves a trail that simply bypasses the tunnel. The IP is only one identifier among many, and rarely the most telling.

The false sense of safety

This brings us to the most dangerous misconception. Many believe that a VPN switched on makes them safe online, and shape their behaviour accordingly. That is a fallacy that can cost dearly, because a VPN protects one particular layer and no other.

The tunnel secures the transport of your data. It says nothing about what flows through it. A VPN stops not a single tracker, because cookies and fingerprinting recognise you by your browser, not your IP. It does not protect against data leaks at services you are logged into, because there you enter your name yourself. It does not save you from malware, because the tunnel does not check whether a file is infected. And it does not rescue you from a well-made phishing page where you hand over your password freely. Against all of that, no server location helps. Only your own behaviour protects you there.

A VPN, then, is a specialist tool. It closes exactly one door, and reliably so. Whoever mistakes it for a whole alarm system leaves the other doors wide open and feels protected while doing it. This deceptive calm is often more harmful than no VPN at all, because it tempts you into carelessness.

Why free is almost always expensive here

The most searched question around the topic is which VPN is free forever. The honest answer disappoints: a good, free VPN does not, as a rule, exist, and the reason lies in plain economics, not malice.

Running a VPN devours money. Servers around the world, bandwidth, maintenance, staff, all of it costs every month, and nobody gives that away for good. If you pay nothing for a service, then someone else pays for it, or you pay with something other than money. With free VPNs that something is usually the very thing you wanted to protect: some log and sell your browsing, others inject ads or smuggle in trackers, and the boldest variant even resells your bandwidth, so that a stranger’s traffic runs over your connection. You wanted to become anonymous, and you became the product.

Behind this pattern lies no ill will, only sober economics. It is the same mechanism behind almost every apparently free service on the net, from the social network to the weather app. Where no price tag hangs, a business model in the background earns its income elsewhere. With a VPN this weighs especially heavy, because you entrust this one service with your entire traffic. The very point at which everything converges should not be the one where someone quietly records.

This is no reason to distrust every free offer, but a good reason to look closely. The reliable question is not what a service costs. What matters is how it finances itself. Where that answer stays in the dark, caution is the wiser stance. The most trustworthy are providers who use a small free tier honestly as a shop window for their paid plan and visibly earn their money from paying customers.

When a VPN makes sense, and when it does not

Whether a VPN is worth it for you comes down to your threat model, the question of what exactly you want to protect yourself from. For some purposes it is the right choice, for others pure symbolism. The overview below sorts the most common cases.

The table shows the pattern: a VPN is strong where the transport path and the IP are at stake, and useless where your own behaviour or your browser gives you away. It replaces no password manager, no two-factor login and no wary handling of suspicious messages. It complements them. Just how many traces converge in the first place, the ones no tunnel touches, is the subject of our piece on digital identity and who controls it.

In the end a VPN stays a solid tool for a clearly defined job. It lets you work safely on open Wi-Fi, keeps your internet provider out of your destinations, and lets you vanish into the crowd of a shared server. It does nothing beyond that, and whoever knows this uses it more wisely than the person who thinks the tunnel makes them invisible. Anyone seeking a stronger separation, where no single server knows both sender and destination at once, will find it in the Tor Browser and what it really protects. The best protection is still the one that understands what its tool can do.

Frequently asked questions

Is using a VPN illegal?

In most Western countries, no. Using a VPN is legal, and there is no law that forbids it. What becomes punishable is not the tool but the act: anyone who shares copyrighted works, commits fraud or breaks other laws over a VPN is just as liable as without one. The VPN changes nothing about the legality of the act itself, it only makes attribution harder. A handful of authoritarian states restrict or ban VPNs, so it is worth checking local law when you travel.

Can the police track me despite a VPN?

Under certain conditions, yes. Investigators cannot read the encrypted traffic inside the tunnel. But with a court order they can ask the VPN provider for connection data. If the provider keeps logs, the trail can lead back to you. If it truly keeps none, the trail ends there. On top of that, quite different things often give you away: a login, a cookie, the payment method or the browser fingerprint.

Is a VPN really worth it?

That depends on what you want to protect yourself from. Against eavesdropping on open Wi-Fi, against the curiosity of your internet provider and against geoblocking, a VPN helps reliably. Against tracking by cookies, against fingerprinting, against data leaks at services you are logged into and against malware, it does nothing. A VPN is a useful tool for a specific job, not an all-round shield.

Is there a VPN that is free forever and safe?

That combination is rare to non-existent. Running a VPN costs servers, bandwidth and staff, and that money has to come from somewhere. Free providers often finance themselves through exactly what you wanted protection from: through your data, through advertising, or by selling your bandwidth on. The exception is reputable providers with a limited free tier honestly meant as a taster for the paid plan.

Does a VPN hide my IP address completely?

From the websites you visit, yes. They see the IP of the VPN server instead of your own. Your VPN provider, though, knows both, your real one and the one it assigned, because it sits in the middle. So a VPN only shifts the trust: away from your internet provider, towards the VPN provider. Whom you trust more is the real question.

Does a VPN protect against viruses and hackers?

No, this is a common misconception. A VPN encrypts the connection, but it does not check what flows through it. If you download an infected file or enter your password on a fake page, the tunnel changes nothing about that. Against malware, what helps is updates, a wary approach to attachments and healthy scepticism, not the tunnel.