(Credit: René Ramos; Bob Al-Greene)
VPNs are no longer niche security tools. These days, every company has one for remote access, and you should have one in your personal security toolkit, ready to fire up when you travel, or even at home to keep your data safe from prying eyes. The best VPNs have tailored their services to everyday users like you and me, and it's a safe bet your favorite podcast or YouTube channel is sponsored by one. But do you actually need a VPN? This guide will help you answer that question by covering all the nitty-gritty details so you can make the most informed choice.
What Is a VPN?
VPN stands for "virtual private network." Consider your home router and Wi-Fi connection as your personal private network. Whenever you browse the internet on your private network, that data is visible and traceable back to you by anyone with access to that connection. Entities that could potentially see that data include your ISP, advertisers, trackers, and malicious snoopers.
Connecting to a VPN transforms that readable data into an incomprehensible string of characters through a process called encryption. This encrypted data arrives at the VPN’s server through a secure ‘tunnel.’ This data would be unreadable to anyone if they were to get hold of it in transit. Once your data arrives at the server, it is decrypted and sent to its original destination. After that, anyone trying to trace that information back to you will hit a dead end, as that data only goes back to the VPN server. This process severs your connection to that web traffic, and a good VPN won’t store any decrypted data of its users. Data coming back to your device makes the same trip: from the internet, to the VPN server, through the encrypted connection, and back to your machine.
When most people talk about VPNs, they are likely referring to services aimed at consumers. However, VPNs have broader applications and have been in use for decades. Before the great VPN boom, corporations used VPNs to let workers access digital resources remotely, long before many of us started working from home.
If you are getting a VPN for personal use, then you don't necessarily need another company to set up a VPN. There are a few options to set up your own, such as Outline, or you can build one with some know-how and spare PC parts. Doing so can be complicated if you’re not tech-savvy or used to working with PCs. You'll also need to rent or maintain that VPN server on your own, which is definitely more difficult (and prone to security risks) than paying a VPN service to handle it instead. While there are some things you can do to make a self-hosted VPN more accessible, it's usually best left to tinkerers who don’t mind the upkeep time and regular maintenance it will take to keep its coverage consistent.
Do VPNs Make You Anonymous Online?
It is nearly impossible to be 100% anonymous online. Someone somewhere has a trace of your data as long as you’re connected to an internet service provider (ISP). That said, a VPN makes it a lot harder for anyone to track your precise movements, location, and activity.
Take your ISP, for example. It knows everything you do online, from the sites you visit to the files you download. There’s nothing private about it. You choose your provider (if you’re lucky enough to have multiple options in your region) for access to the internet, but the payment doesn’t stop there. ISPs are known to aggregate and sell user data. This isn’t some hidden practice either. While these services don’t flaunt the fact that they do this, it is often buried within the privacy policy when you sign up.
The FTC issued a report back in 2021 outlining exactly how much your ISP knows about what you do online. It’s likely even more than you’d expect. Your ISP can sell that anonymized customer data. While that data does not have your name directly attached to it, you’re still being profited off of by a provider that, more often than not, you are forced to use thanks to a lack of competition.
That’s where a VPN comes in. It can cut off that data feed and give you some of your privacy back. Again, it can’t stop everything, but it can reduce that flood of data to a trickle. The ISP won’t be able to see any of your web data. It can still see how much data you use, when you use it, and whatever personal information you had to give to sign up.
Aside from the ever-looming eye of your ISP, VPNs also make it harder for advertisers to track you online. Many advertisers use data connected to your IP address to target advertisements and monitor your habits. A VPN removes that data source since it makes it appear as though your traffic is originating elsewhere. Unfortunately, advertisers have other tools to monitor you that a VPN can’t prevent. Cookies and trackers are on most sites you visit. When you click ‘accept’ on a cookie pop-up, you allow those sites and its advertisers to track your habits on their site and beyond. A VPN alone can't do anything about that (although many offer tools to help).
Sites and advertisers can also identify you through unique characteristics like your browser version, screen size, and so on. This information may appear harmless on its own, but it is used to form a picture of you as a user through a process called browser fingerprinting. Removing web traffic tied to your IP address makes that fingerprint much harder to pin down.
Ad and tracker blockers, like those found in some browsers or as standalone tools like the Electronic Frontier Foundation's (EFF) Privacy Badger, help further. The more data you can remove, the less clear a picture advertisers will have of you and your data.
Lastly, it's important to remember that law enforcement and government agencies have access to more advanced and invasive techniques than ever before. Given enough time, a determined, well-funded adversary can usually get what it's after.
However, a good VPN will have nothing to hand over in the event of an inquiry. While there could be other ways to trace your information, a VPN should be an unbreakable piece of your privacy armor. For example, Mullvad VPN was subjected to a search in 2023, but law enforcement left empty-handed because the service does not keep any user data.
Do VPNs Protect Against Malware?
Not directly. Some have very basic malicious file detection or ad-blocking baked in, but the most effective options partner with a dedicated antivirus. It’s becoming more common for a VPN to be part of a comprehensive security package that includes antivirus, password management, and sometimes identity theft protection. For example, Surfshark One combines antivirus with VPN, and the top NordVPN tier includes a threat protection component.
We don’t test malware protection that simply blocks access to known dangerous domains. That’s easy to do, and HTTPS as a standard prevents you from going down those perilous paths already. A VPN gets our attention when it promises full-powered antivirus protection. Once that claim is made, we test that capability in the same way we test any antivirus app. This includes collecting available test scores from four antivirus labs worldwide and challenging the antivirus component to detect and eliminate all kinds of malware, including ransomware. Results vary. For example, UltraAV scored high in our malware protection test, while NordVPN's score was mediocre.
Do VPNs Keep You Safe Online?
A VPN makes you safer in terms of data security, but it can’t protect you from every threat. Malicious individuals can still target you with scam emails, social engineering attacks, and malware. Even a robust security suite can’t stop everything. You are the last line of defense and the potential weakest link in the event of an attack. The best means of protection is educating yourself on common security threats, scam tactics, and hacking methods that bad actors use to try and steal your data.
It also helps to make informed decisions. It may be easy to hit ‘accept all’ on cookies in a rush or to skim past an app or site’s privacy policy. That’s exactly what these services want you to do. Companies and advertisers prey on your decision fatigue and apathy to get the data they want. Slowing down and being mindful of what you download and access will go a long way in limiting the data you allow companies to see.
Recommended by Our Editors
Equipping yourself with the proper tools also helps fill in the gaps. Your browser has built-in tools to detect phishing sites, as do most antivirus suites. VPN suites that come with full-on antivirus protection typically build in detection of unwanted web pages as well, and some of them are quite successful. For example, NordVPN and Surfshark One each scored 100% in our hands-on phishing protection test.
Many people reuse or use weak passwords, so get a password manager to generate and store unique, strong passwords for each site and service you use. Finally, protect your online accounts and enable multi-factor authentication whenever available.
Do VPNs Hide Your Torrenting and Online Activity?
Yes, but there are some additional factors to consider. When a VPN is active, all your traffic is encrypted. This means your ISP can't see the sites you visit or the files you download and upload, but the ISP can see that you are using a lot of data. They won’t be able to see exactly what files you are downloading or what method you use to download them. While the ISP can’t retaliate against you legally or send you a threatening letter for pirating Gex: Enter the Gecko, they can throttle your speeds and charge you for overages.
Additionally, pirating content may violate your VPN provider's terms and conditions, the way it definitely violates your ISP's, so check their documentation carefully before signing up.
Can VPNs Bypass Censorship?
Yes, a VPN can spoof your location when you connect to one of the service’s servers. You can browse the web as if you were physically located where the VPN server is. In some cases, this can get around local content restrictions and censorship. It's easily the noblest use of a VPN, and many VPNs market heavily on this aspect of their service. However, the stakes can be quite high in these situations. Users in authoritarian regimes or journalists covering sensitive topics rely on VPNs to obfuscate their identity. Even so, we don't explicitly test a VPN's ability to bypass censorship, and endorsing a VPN service for this ability could put people's lives at risk if we get it wrong. Depending on where you are, simply using a VPN may get you into legal trouble, so consider the risks before you install one on any of your devices. Proton VPN, for example, has a completely free tier specifically for people looking to bypass censorship, and even allows you to “hide” the app by changing its icon to something more innocuous in case someone searches your phone.
A VPN doesn't make your traffic invisible. Observers can see that your traffic is encrypted, but they won't be able to see the actual content of that traffic. However, the encrypted traffic alone might attract unwanted attention. Some VPNs include proprietary protocols that try to disguise VPN traffic as more common HTTPS traffic, and many more providers are working on similar technologies. These include Catapult Hydra, Stealth, and Lightway from UltraVPN (white-labeled by HotspotShield VPN), Proton VPN, and ExpressVPN, respectively.
Can VPNs Spoof Your Location?
Yes. As we mentioned above, you can hide your location by connecting to a VPN’s server network. Just keep in mind that sites and services sometimes have other means of determining your location, such as cookies stored on your devices. Some sites, such as your bank, rely on these cookies and data habits to keep you safe. If your bank sees someone claiming to be you connecting from Latvia, it may require additional security checks before granting access or lock down your account entirely. That's generally a good thing, but it can be annoying when using a VPN.
Can VPNs Unblock Streaming Content?
Yes, but access can be unreliable. Streaming services have different offerings in different countries due to regional licensing agreements. What is available on US Netflix might not be available on UK Netflix, and vice versa. You can use a VPN to access content in a region you’re not a resident of, but there’s a catch.
Like government censorship, streaming services know many people use VPNs to access their content and actively work to prevent it. We test for this, but it's a bit of a cat-and-mouse game as streaming services try to shut down VPN access and VPN providers counter with new servers and routing methods. The results above were recorded at the time of review, so they may not be consistent with your experience. Streaming libraries we test and label as Limited or Blocked during a review could be Open by the time you connect, and something marked Open today may be Limited or Blocked in a few weeks or months. This is a frustrating experience as a VPN user. While there’s no sure-fire way to access a platform every time, you can mitigate your risk by only subscribing to a VPN on a monthly basis. It’s more expensive than the cheaper annual or multi-year subscription options most VPN providers offer, but doing so allows you to switch to a different provider if your favorite stops working.
Can You Trust a VPN?
That answer will come to where you personally draw the line. You have to consider what you need from a VPN, but we can give you the criteria that we look for in one. Since all of your traffic passes through a VPN, it could potentially see your data the same way your ISP would without one. We like to see VPNs that have had their privacy claims and data storage practices tested in the real world, and backed up by independent, third-party audits.
A no-logs policy is the first step. This is a claim from the VPN that it won’t retain your data in any fashion. This policy should be accessible and easy to understand without jargon. When we review a VPN, we pore over its privacy policy and send out a questionnaire to get a sense of what efforts each company makes to protect customers' privacy. We know they could lie to us, but our goal is to put them on record. But a claim is just a claim until it is verified. VPNs that are serious about their claims will have them verified by frequent, independent audits by security companies like Cure53, KPMG, and Securitum, to name a few.
This practice ensures that the VPN stays true to its claims, and the best VPNs will undergo these audits regularly. Audits are imperfect tools, partially because they're commissioned by the VPN company, which also outlines the scope of the audit. Still, it's a valuable way to demonstrate a company's commitment to transparency.
The true test of a VPN’s claims is to see them evaluated in a real-world context. A VPN that has been subjected to a search by law enforcement and didn’t have any data to give is often one that we feel comfortable recommending and placing our trust in. Even when we don't agree with all the choices a VPN makes, we prefer companies that are up-front about their policies. A VPN should issue a transparency report outlining what requests the company has received from law enforcement and how the company responded. That way, users can make their own informed decision about whether or not to trust the company.
Do You Need a VPN?
A VPN is a great tool to lock down online data and improve privacy. It’s not the end-all be-all that it is often marketed as, but it does fill a much-needed niche in a well-rounded privacy toolkit. It doesn’t remove your online presence entirely. However, it does keep most of your data from falling into the hands of your ISP, advertisers, and snoops.
We think most people stand to benefit from a VPN. You can protect your privacy, spoof your location, hide your torrents, and potentially access regional streaming content. Even if you only see yourself using a couple of those features, the low price of most VPNs makes it an easy choice for us to suggest one.
As we've discussed, however, a VPN can’t do it all. It won’t block malware, stop sophisticated attacks, or completely prevent advertisers from pursuing you. A VPN is best paired with a strong antivirus, a password manager, and multi-factor authentication as part of a robust security toolkit. Like every tool, it works best when you use it for the right job.
Chris Stobing contributed to this article.