Guide

What is a VPN and how does it work?

A VPN (virtual private network) builds an encrypted tunnel from your device to a server somewhere else and sends all your internet traffic through it. This guide explains, with diagrams and without jargon, how that works, what a VPN really protects you from, what it does not, and how to choose and set up a good one.

What is a VPN?

VPN stands for virtual private network. Companies first built VPNs so that employees could reach the company's internal network from home or on the road, as if they were sitting in the office. The private network is virtual because it needs no cables of its own: it runs over the ordinary, public internet, protected by encryption.

Today most people know VPNs as apps: you install one, press Connect, and from then on everything your device sends to the internet first goes through an encrypted connection to a server of the VPN provider. That server passes your traffic on to the websites and apps you use, and sends their answers back to you through the same tunnel.

A simple picture: without a VPN, your internet traffic travels like a postcard. Everyone who handles it on the way, such as the Wi-Fi network and your internet provider, can read the address and often the text. With a VPN, the postcard goes into a sealed envelope addressed to the VPN server. Only there is it taken out and sent on.

How a VPN works, step by step

Behind the Connect button, the same things happen with every VPN, whoever the provider is:

1. The app contacts the VPN server Your device opens a connection to the server you chose, for example one in Germany.
2. Both sides prove who they are The server proves with a certificate or a key that it really is your provider's server and not an impostor; you sign in with your account or your own key.
3. They agree on secret keys With a key exchange (explained below), both sides work out the same secret keys without ever sending them over the internet.
4. A virtual network adapter appears The app adds a virtual network adapter to your system and sends all internet traffic to it instead of directly to your router.
5. Every packet is wrapped and encrypted Each piece of data your apps send is encrypted and packed into a new packet addressed to the VPN server. This is called encapsulation.
6. The server unwraps it and passes it on The VPN server decrypts the packet, puts its own address in place of yours and sends it to the website. The answer takes the same way back.

Your real IP address is only ever seen by the VPN server. To the website, the request comes from the VPN server, so it places you in the server's country. That is why a VPN changes the location websites think you are in.

Encryption, explained simply

Encryption turns readable data into something that looks like random noise; only someone with the right key can turn it back. A VPN uses four building blocks for this.

Locking the data: symmetric encryption

Once the tunnel is up, all data is encrypted with a key that both sides share. Modern VPNs use AES-256-GCM or ChaCha20-Poly1305. A 256-bit key can have 2²⁵⁶ different values, a number with 78 digits: trying them all is not possible with any computer that exists. Both methods also detect tampering, so a packet that was changed on the way is thrown away.

Agreeing on a key without sending it: key exchange

The key itself must never travel over the internet, so the two sides agree on it with a Diffie-Hellman key exchange, today usually its elliptic-curve version such as X25519. The idea is easiest to see with paint:

Making sure you talk to the right server: authentication

A key exchange alone does not tell you who is at the other end. So the server also proves its identity, with a certificate (OpenVPN, IKEv2) or with a public key the app already knows (WireGuard). Without this step, an attacker on the network could pretend to be the VPN server.

New keys all the time: forward secrecy

Good VPNs replace their keys regularly; WireGuard, for example, makes new ones every two minutes. Even if a key were ever stolen, it would only unlock a few minutes of traffic, not everything you sent before. This is called perfect forward secrecy. Some providers have also started to add post-quantum key exchange (such as ML-KEM), so that traffic recorded today cannot be decrypted by quantum computers in the future.

VPN protocols compared

A VPN protocol is the set of rules for building the tunnel: how the keys are agreed on, how packets are wrapped and how they travel. Most apps let you choose one; "Automatic" usually picks one of the first three.

• WireGuard is the newest of them and has been part of Linux since 2020. Its code is only about 4,000 lines long, small enough for experts to check thoroughly, and it uses a fixed set of modern cryptography instead of a long list of options. Many providers' own protocols are built on it.
• OpenVPN has been around since 2001, is open source and runs almost anywhere. It is slower than WireGuard, but over TCP it can get through firewalls that only allow web traffic.
• IKEv2/IPsec is built into Windows, macOS, iOS and Android. Its MOBIKE feature keeps the tunnel up when your phone changes networks. Its fixed ports (UDP 500 and 4500) make it easy to block.
• PPTP dates from the 1990s, and its encryption was broken years ago. Some routers still offer it: avoid it.

What a VPN hides, and from whom

Whether a VPN protects you depends on who you want to be protected from. This table shows what each party along the way can see.

What about HTTPS?

Almost all websites use HTTPS (the padlock in the address bar), which encrypts pages between your browser and the website. Without a VPN, your network then cannot read what you type or which page of a website you open. But it still sees the names of the websites you connect to, through DNS lookups and the name your browser sends when it connects, and it sees your IP address. A VPN hides those too, and also protects apps that do not encrypt their traffic properly.

What a VPN does not do

• It does not make you anonymous. If you sign in to an account, the website knows it is you, VPN or not. Cookies and browser fingerprinting (recognising your browser by its settings, screen size, fonts and more) work through a VPN too.
• It does not protect you from malware or phishing. A fake bank website or an infected download reaches you through the tunnel just as well. Some VPN apps block known dangerous websites, but that is an extra, not what a VPN does.
• It moves trust, it does not remove it. The VPN provider is now where your internet provider used to be. A provider that records or sells your data is worse than no VPN at all.
• It does not hide that you use a VPN. Your network can see that you connect to a VPN server, and many websites recognise the addresses of VPN servers and block them or ask for extra checks.
• It does not protect the rest of the way. After the VPN server, your traffic travels the normal internet to the website; without HTTPS, it can be read there.
• It cannot prevent every leak by itself. If the app is badly set up, DNS lookups, IPv6 traffic or WebRTC in your browser can reveal your real address (see how to test for leaks).

Types of VPN

"VPN" stands for several different things. They use the same technology for different jobs.

• Personal VPNs are the apps you subscribe to. They protect your traffic on networks you do not trust and change your apparent location.
• Remote-access VPNs connect employees to their employer's network, so that they can reach internal files and tools. They often send only company traffic through the tunnel.
• Site-to-site VPNs connect whole networks, for example two offices, through routers that keep a tunnel open all the time.
• Mesh VPNs connect your own devices directly to each other wherever they are, so that you can reach your home computer from your phone.
• Self-hosted VPNs run on a server or router you control. You do not have to trust a provider, but the server's IP address leads back to you.
• Browser "VPN" extensions usually cover only the browser and are technically proxies. They do not protect your other apps.

Features worth knowing

Kill switch

If the VPN connection drops for a moment, your device would normally carry on over the normal connection, with your real IP address. A kill switch blocks all internet traffic until the tunnel is back.

Split tunnelling

Split tunnelling lets you choose which apps or addresses use the VPN. Your browser can go through the tunnel while your banking app, a game or the printer on your home network use the normal connection.

More features

• DNS leak protection: the app sends every DNS lookup (the questions that turn names like wikipedia.org into IP addresses) through the tunnel to the provider's own DNS servers.
• No-logs policy: a promise not to record what you do. It is only worth as much as its proof: independent audits, court cases in which the provider had nothing to hand over, and servers that run from memory only, so nothing is left after a restart.
• Multi-hop (double VPN): traffic goes through two VPN servers, so that neither of them alone knows both who you are and where you go. It is slower, and both servers usually belong to the same company.
• Obfuscation (stealth mode): makes VPN traffic look like ordinary web traffic, for networks that block VPNs.
• Dedicated IP address: an address only you use, so websites stop asking for the checks they show to shared VPN addresses. In return, it is easier to link to you.
• Port forwarding: lets others connect to your device through the VPN, for example to a game server you host.

VPN, proxy or Tor?

All three send your traffic through someone else's server, so that websites see a different IP address. They differ in what they cover and how much they protect.

OnlineProxy.eu is a web proxy, not a VPN: it opens websites for you right in your browser tab, through our server in the EU, without installing anything. That is often enough to open a website that is blocked at school, at work or in your country. It does not protect your other apps, and for legal reasons we keep logs (see Privacy). If you need anonymity, use the Tor Browser.

Does a VPN slow down your internet?

Usually a little. Four things decide how much:

• Distance. Your data takes a detour through the VPN server. A server in a neighbouring country adds a few milliseconds; one on another continent can add a tenth of a second or more to every request.
• The server's load. Crowded servers, often the free ones, share their bandwidth between many users.
• The protocol. WireGuard and IKEv2 are faster than OpenVPN, especially on phones.
• Encryption. Every packet gets a few dozen extra bytes and has to be encrypted; on current devices this costs very little.

Sometimes a VPN even makes things faster: if your internet provider deliberately slows down certain services, it cannot recognise them inside the tunnel. For the best speed, choose a server close to you and use WireGuard.

Free or paid VPN?

Running VPN servers costs money, so free VPNs have to earn it somehow. Some do it honestly, as the limited free plan of a paid service, with a data limit, fewer servers or lower speed. Others show ads, collect and sell what their users do, or have been found to contain tracking code. A study of 283 VPN apps for Android (CSIRO, 2016) found that 18 percent did not encrypt traffic at all, and 38 percent showed signs of malware.

If you want a free VPN, choose the free plan of a well-known paid provider over an unknown free app.

How to choose a VPN

• A proven no-logs policy, checked by independent audits.
• Modern protocols: WireGuard, OpenVPN or IKEv2, and no PPTP.
• A kill switch and DNS leak protection, switched on by default.
• Open-source apps, or at least apps that have had a security audit.
• Servers where you need them: close to you for speed, and in the countries whose content you want.
• A known company and country: who runs it, under which country's laws, and how it answers requests from authorities.
• Honest promises. Be wary of "total anonymity" or "military-grade" protection.
• Fair terms: a money-back period and ways to pay that suit you.

How to set up a VPN and test it

1. Download the provider's app from its own website or from your device's official app store.
2. Sign in, turn on the kill switch and, if you can choose, select WireGuard.
3. Choose a server: the nearest one for speed, or the country you need.
4. Press Connect and wait until the app says you are connected.
5. Check your IP address on a "what is my IP" website: it should now show the VPN server's address and country.
6. Run a DNS leak test and a WebRTC leak test: neither may show your internet provider or your real address.

Phones, computers and many routers also have VPN support built in: you can enter the server details your provider gives you, for example a WireGuard configuration file, without installing its app. A VPN on your router protects every device in your home, including TVs and game consoles that cannot run a VPN app.

Is using a VPN legal?

In most countries, including the whole EU, the United Kingdom and the United States, using a VPN is legal, and companies rely on VPNs every day. Some countries ban VPNs or allow only state-approved ones, for example China, Russia, Iran, Belarus, Turkmenistan and North Korea, and others punish using one to commit a crime. Whatever you do through a VPN must still be legal where you are, and the terms of the websites you use still apply: streaming services, for example, may refuse access from VPN servers.

Common myths

Glossary

IP address

The number that identifies your connection on the internet, given to you by your provider. Websites use it to guess your country and city.

Tunnel

An encrypted connection that carries other connections inside it.

Encapsulation

Packing a data packet into another one, so that it can travel through the tunnel.

DNS

The internet's phone book, which turns names like wikipedia.org into IP addresses. DNS lookups often reveal which websites you visit.

Protocol

The rules two computers follow to talk to each other; for a VPN, how the tunnel is built.

Kill switch

A feature that blocks internet access while the VPN connection is down.

Split tunnelling

Sending only some apps or addresses through the VPN.

Leak

Traffic that bypasses the tunnel and reveals your real IP address or your DNS lookups.

No-logs

A provider's promise not to record what its users do.

Web proxy

A website that opens other websites for you inside your browser tab, without installing anything.

Tor

A free network that sends your traffic through three relays run by volunteers, with layered encryption, to make you anonymous.

Last updated: 13 November 2026.