Is a VPN worth it? What it really protects (and what it doesn't)

Every time a streamer or influencer runs a VPN ad, the promise is the same: "become invisible online", "nobody will know what you do on the internet", "total protection against hackers". It's well-paid marketing, and most of it wildly exaggerates what a VPN actually does. That doesn't mean VPNs are useless — it means it's worth understanding exactly what they protect before deciding whether you need one.

What a VPN really does

Technically, a VPN (Virtual Private Network) creates an encrypted tunnel between your device and the VPN server. All traffic leaving your computer or phone passes through that tunnel before continuing out to the internet. Two direct consequences of that:

• Anyone on the same network as you (another customer connected to the same airport Wi-Fi, for example) can't see the content of your traffic
• Your internet service provider (ISP) sees that you're connected to a VPN server, but not what you're accessing inside the tunnel

That's basically it. An encrypted tunnel between you and the VPN server, which swaps out "who sees your traffic" — from local network + ISP to the company running the VPN.

Where a VPN genuinely helps

There are concrete scenarios where that tunnel makes a real security difference:

Public Wi-Fi. Airport, coffee shop, hotel — any network you don't control is a hostile environment by default. A fake Wi-Fi network attack (evil twin) can intercept unencrypted traffic from anyone connected to it. An active VPN in that scenario neutralises much of the risk, because the attacker on the network only sees indecipherable encrypted traffic.

A curious or hostile ISP. In some countries (and on some carrier plans), the internet provider monetises or logs customers' browsing history. A VPN takes that visibility away from the ISP.

Corporate networks or countries with content censorship. Reaching services blocked by a network firewall (corporate or national) is the most direct — and least discussed — use case. It's literally what corporate VPNs were invented for.

Does a VPN hide what you do online?

Not completely. It hides your traffic from whoever is on your local network and from your internet provider — but it doesn't make you anonymous to the sites you visit.

That's the most misunderstood point in all of VPN marketing. When you log into Instagram, Gmail or any site with your account, that site knows exactly who you are — the VPN changes nothing about that. Cookies, browser fingerprinting and simply being logged into an account keep identifying you as normal, VPN on or off.

What a VPN does NOT do

• It doesn't replace HTTPS. If the site you visit already uses HTTPS (the padlock in the browser — practically every relevant site today does), the connection between you and the site is already encrypted, with or without a VPN. The VPN adds an extra layer of who-sees-the-traffic, not "more encryption" in a sense that solves something already solved.
• It doesn't stop malware. An encrypted tunnel doesn't filter malicious files, phishing or ransomware. That's the job of antivirus software, common sense and system hardening — not a VPN.
• It doesn't make you anonymous to sites you log into. We covered that above, but it bears repeating: real anonymity is a far more complex problem than a VPN alone solves.
• It doesn't protect against third-party data breaches. If a company holding your data suffers a breach, your personal VPN has nothing whatsoever to do with it.

If you're going to use one, how to choose

If you're paying for a VPN, a few technical criteria matter more than the marketing on the provider's site:

1. An audited "no-logs" policy — it's not enough for the company to say it keeps no logs; there needs to be a published independent external audit.
2. A modern protocol — WireGuard is today the fastest and best technically reviewed standard. Be suspicious of a provider that only offers old protocols (PPTP, for example, is considered broken).
3. A kill switch — automatically cuts the internet connection if the VPN tunnel drops, to prevent accidental leakage of unprotected traffic.
4. The provider's jurisdiction — countries outside intelligence-sharing agreements (such as the "Five Eyes" alliance) reduce the risk of the company being compelled to hand over user data.

If the goal is day-to-day privacy without paying for a VPN, it's also worth considering encrypted DNS — it handles a relevant slice (blocking trackers and telemetry) of what people are actually after in a VPN, with simpler setup and generally for free.

When it's NOT worth it

If your routine is almost entirely at home, on a network you trust, on HTTPS sites and with no need to reach geo-blocked content, a paid VPN subscription is, in practice, a security layer you probably don't need day to day — the real return is low compared with the monthly cost. That doesn't invalidate VPNs as a tool; it invalidates the idea that everyone needs one all the time.

A VPN is a specific tool for a specific problem: who sees your traffic on a network you don't control. Outside that scope, protective effort pays off better elsewhere — a strong password, 2FA, basic system hardening. If you haven't sorted that out yet, the definitive guide to OPSEC and digital privacy covers the whole foundation, with VPNs included in their proper context.