A VPN encrypts your traffic and masks your IP—powerful, but not an invisibility cloak. Here’s what it really does, and what to add for practical privacy.
What a VPN does (and why it matters)
- Encrypts traffic in transit. Your ISP, café Wi-Fi owner, and nearby attackers can’t read or tamper with your traffic between your device and the VPN server.
- Masks your IP address. Sites see the VPN’s egress IP instead of your home or mobile IP, reducing location and ISP exposure.
- Stops DNS tampering when your provider resolves DNS inside the tunnel (or via DoH/DoT), defeating captive-portal DNS tricks and ISP hijacking.
- Eases geoblocking (within the law) by letting you egress in a different region.
For the best everyday experience, run a modern protocol like WireGuard (see: Why WireGuard Is the Right VPN Protocol).
What a VPN does not do
- Erase your identity if you log into accounts (Google, Meta, Amazon, banking). Cookies, logins, and app telemetry still identify you.
- Stop browser fingerprinting (screen size, fonts, GPU, time zone, canvas, etc.).
- Block all trackers or malware by itself (some VPNs offer DNS filtering, but it’s separate).
- Prevent phishing or malicious extensions.
- Override OS/app analytics or ad IDs if those settings remain enabled.
Common myths—debunked
“With a VPN, nobody can track me.”
Sites can still link sessions via logins and fingerprinting. Use separate browser profiles or containers and clear cookies.
“VPNs are slow.”
Modern stacks are fast. Protocol choice, server distance, and peering matter more than “VPN = slow.” WireGuard often reduces latency.
“All VPNs are identical.”
They differ in audits, logging posture, private DNS, infrastructure, and protocol quality. Choose transparency over marketing.
Build a realistic privacy stack (that you’ll actually use)
-
Keep the VPN on by default
-
Harden your browser
-
Separate identities
- Use email aliases and separate browser profiles (work vs personal).
- Avoid logging into everything with the same account provider.
-
Password hygiene + MFA
- Use a password manager and unique passwords.
- Add two-factor (prefer TOTP/hardware keys) everywhere that matters.
- Check exposure: https://haveibeenpwned.com/
-
Reduce app/OS telemetry
- Disable ad IDs and unnecessary diagnostics on iOS/Android/macOS/Windows.
-
Control WebRTC + DNS + IPv6 leaks
When to add Tor (and when not to)
- Use Tor for high-risk research or when you need layered anonymity. A practical pattern is Tor over VPN (connect VPN → open Tor Browser).
- Don’t use Tor for streaming or gaming; it’s slower and many services block exit nodes.
- Official downloads: https://www.torproject.org/
“No-logs” and why audits matter
Trust is earned: look for independent audits, clear DNS handling, and RAM-only or ephemeral infrastructure. Be wary of vague “no-logs” claims without detail or third-party verification.
Bottom line
A VPN is step one: it hides your IP and protects you on hostile networks. Real privacy adds browser hygiene, account discipline, MFA, and leak control. Put those together and you get durable, practical privacy—without breaking your workflow.
Related reading (internal)