A VPN changes the route taken by covered internet traffic and encrypts the connection to its VPN server. It can support remote access or reduce what a local network can observe, but it does not make you anonymous, block every advertisement or stop a phishing page from taking information you enter.
This guide explains the boundaries of a VPN and gives you a practical way to check a service before relying on it. There is no universal requirement to buy one: the right choice depends on the problem you are trying to solve.
What is a VPN?
A virtual private network creates a tunnel between a device and a VPN endpoint. A workplace VPN may provide access to an organization’s private resources. A consumer VPN typically sends covered traffic onward to the public internet, where sites generally see the VPN server’s outward-facing address.
The tunnel ends at the VPN endpoint. HTTPS remains important for the connection to a website. A VPN also changes your trust relationship: the provider sits on the path that your traffic takes. EFF explains these distinctions in its VPN selection guide.
Check what traffic is actually covered
A browser feature and a device VPN can have different scopes. For example, Firefox’s built-in VPN documentation says that the feature covers traffic originating in Firefox rather than other apps. Availability, limits and website exceptions also matter. This is an example of scope, not a recommendation to choose that product.
Before relying on any service, read its documentation for the operating system you use. Check whether it covers the whole device, selected apps, one browser or only a workplace connection. Look for exceptions, split-tunneling settings and what happens when the connection drops. Do not infer protection for your email app from a badge in your browser.
What a VPN can and cannot solve
| Your goal | What to check | What still needs separate attention |
|---|---|---|
| Access workplace resources | Employer-approved app, profile and sign-in requirements | Device policy, account security and access permissions |
| Route browsing through a VPN server | Browser or device coverage and exceptions | Signed-in accounts and information sent to sites |
| Reduce browser tracking | Browser privacy settings and extension permissions | A changed network route alone is not a tracking policy |
| Avoid fake login pages | Verified website and phishing-resistant sign-in where supported | A VPN does not verify every page or message |
| Improve a slow connection | Compare the same task with and without the VPN | No universal speed or latency improvement is promised |
Privacy is broader than an IP address
Changing the outward-facing address does not remove the identity you give a service by signing in. Treat account activity, shared files, app permissions and browser settings as separate parts of a privacy review. Our personal information privacy guide provides a worksheet for that review.
Public Wi-Fi still calls for careful browsing
Use a network you can identify and follow your organization’s requirements for work. If the browser displays a certificate warning, stop and investigate through a verified support route. Do not dismiss it because a VPN icon is visible. Avoid installing a VPN app or certificate offered by an unexpected pop-up.
Choose a service using evidence
Write down your requirement first: access an employer’s network, cover a particular device, or route a particular browser. Then compare the documented capability against that requirement. A long server list is not a substitute for the feature you need.
- Operator: identify the company responsible for the service and its support contact.
- Coverage: check supported devices, app or website exceptions and connection-loss behavior.
- Data practices: distinguish browsing records from account information, diagnostics and usage statistics.
- Independent evidence: read an audit’s date, scope and findings rather than relying on an audit badge alone.
- Cost and constraints: check recurring charges, cancellation terms, data limits and device limits before subscribing.
- Maintenance: look for supported software and a clear update process.
A privacy slogan does not describe every kind of data a service handles. For example, Mozilla’s VPN help page describes usage statistics, diagnostics and user controls. Read the corresponding privacy notice for whichever service you assess. Paid and free services should both be evaluated; price alone is not proof of security.
Set up a workplace VPN through verified instructions
Obtain your organization’s configuration from its established support channel. Do not copy server addresses or sign-in instructions from an unsolicited message.
For a configured Windows connection, Microsoft documents Settings > Network & internet > VPN. Select the required connection and connect using the authorized sign-in method. The settings page can show Connected. A status label confirms the connection state, but does not prove every app uses that route or that a website is safe.
For other systems or provider apps, use their current official instructions. Managed devices may require your administrator to provision the profile. Keep that distinction clear instead of experimenting with security settings you do not understand.
A practical verification worksheet
- Record your device, app version, connection type and intended purpose.
- List the apps or sites that should use the tunnel and any intentional exceptions.
- Check the documented behavior on connection loss before a sensitive task.
- Use a routine, non-sensitive task to check that required resources work.
- If performance matters, repeat the same task under comparable conditions and record results.
- Save the official support route and review the configuration after important app or system changes.
This worksheet is a usability and configuration check, not a security audit. A successful page load cannot prove an absence of leaks. If your work involves unusually sensitive information, obtain advice for that particular situation rather than treating a generic consumer guide as sufficient.
Glossary
- VPN endpoint: the server where a VPN tunnel terminates.
- Split tunneling: routing selected traffic through the VPN while other traffic takes another path.
- Connection-loss protection: a feature intended to block specified traffic when the VPN disconnects; its scope depends on the implementation.
- HTTPS: encrypted communication between the browser and the website.
Sources and editorial review
Updated 1 October 2026. This guide uses the linked EFF explanation, Mozilla product documentation and Microsoft setup instructions. Product examples illustrate documented capabilities; no commercial ranking, independent leak testing or guaranteed anonymity is claimed. Send corrections through our contact page.
Written and prepared by Kshitij Gupta.
