A VPN hides two things well: what you do online from the network you’re connected to, and your real IP address from the sites you visit. It can’t hide who you are from accounts you sign in to, and it can’t hide anything from the VPN company itself. That last point is why audits matter. This guide walks through each party that might be watching, and shows what changes when you switch a VPN on.
Last updated 29 October 2026.
What a VPN can and can’t hide: the short version
| Who | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider | Which sites you visit, and when | That you’re using a VPN, and how much data |
| Wi-Fi owner (hotel, café, office) | Which sites you visit | That you’re using a VPN |
| Websites and apps | Your real IP address and rough location | The VPN server’s address and location |
| Accounts you sign in to | Who you are | Still who you are |
| The VPN company | Nothing | Potentially everything, which is why no-logs audits matter |
What a VPN hides from your internet provider
Without a VPN, your internet provider can see the addresses you connect to, even when the pages themselves are encrypted. With a VPN, it sees an encrypted connection to one VPN server, and the amount of data passing through it. That’s it.
In practice, this is the main privacy benefit for most people at home. Your browsing history stops being something your provider can collect, sell to advertisers where the law allows it, or hand over on request, because it simply never sees which sites you open.
What your provider still sees: that you’re using a VPN, when you’re online, and roughly how much you download. Nothing more. Some networks use that knowledge to block VPN connections. That’s why some VPNs offer obfuscation, which disguises VPN traffic; NordVPN, for instance, publishes a protocol called NordWhisper for exactly that.
What a VPN hides from the Wi-Fi you’re on
Public Wi-Fi in hotels, airports and cafés is shared with strangers, and run by someone you don’t know. Without a VPN, the network owner can see which sites you visit, and a badly run network can expose more.
With a VPN on, the Wi-Fi owner sees only the encrypted connection to the VPN server. This is the single most useful thing a VPN does for travellers. Honestly, if you only ever use a VPN in one place, make it hotel Wi-Fi.
One practical tip: when a network makes you accept terms on a sign-in page first, connect, finish the sign-in page, then turn on the VPN. Turning the VPN on first can stop the sign-in page from loading.
What a VPN hides from websites and apps
Every site you visit sees an IP address, and that address reveals roughly where you are. With a VPN, sites see the VPN server’s address and location instead of yours.
That’s why people use a VPN to reach home services while travelling: connect to a server in your home country, and a site sees a home-country address. It’s also why some services block VPN addresses they recognise. Short version: location, yes. Identity, no.
What a VPN can’t hide
Your accounts know who you are. When you sign in to your email, a shop or a social network, that service knows it’s you, VPN or not. A VPN changes your address, not your identity.
Cookies and trackers can still follow you. Websites track visitors with cookies and browser fingerprints, not just IP addresses. A VPN alone doesn’t stop that, because the tracking happens inside your browser, on the far side of the encrypted tunnel, where the VPN has no say over what a page stores or reads. Some VPNs add tools that help: Surfshark includes an ad blocker and cookie pop-up blocker even in its cheapest plan, and Proton VPN’s NetShield blocks ads, malware and trackers using DNS filtering.
Your device knows everything. Apps on your phone can see your location from GPS, regardless of the VPN. A VPN protects the network path, not the device itself, so a weather app, a map or a photo with location tags switched on will still report exactly where you are, however carefully you’ve chosen your VPN server.
Malware is still malware. A VPN delivers a harmful download as faithfully as a safe one. Keep your system updated and get files from trusted sources. Simple. Boring. Effective.
The one party that can see everything: the VPN
When you use a VPN, you move trust from your internet provider to the VPN company. All of it. Its servers handle all your traffic. A VPN that kept logs could know more about you than your provider ever did.
That’s the whole reason independent no-logs audits matter, and the reason we rank VPNs on them. The VPNs we cover publish very different records. Proton VPN has passed 5 consecutive annual audits and publishes the reports. NordVPN has had 6 reviews of its no-logs policy since 2018. Surfshark has had 2 reviews by Deloitte. ExpressVPN lists 3 KPMG audits of its privacy commitments, alongside many security audits. Our VPN section ranks them on that evidence.
Some VPNs add a hardware safeguard: servers that run only in memory. Surfshark and ExpressVPN both say all their servers are RAM-only, wiped at every reboot, so there’s little stored to hand over even if a server is seized.
When a VPN leaks
A VPN only protects traffic that goes through it. Three things can let traffic escape.
The connection drops. For a few seconds, your device may fall back to your normal connection. A kill switch stops that; NordVPN lists an automatic Kill Switch among its features. When you set up any VPN, switch the kill switch on first.
DNS requests go around the VPN. DNS is how your device looks up a site’s address. If those lookups bypass the VPN, your provider can still see which sites you visit. Good VPN apps handle DNS themselves; NordVPN lists DNS and IP leak prevention among its features.
Split tunneling sends some apps outside the VPN on purpose. Useful for a banking app or a local streaming service, but it means those apps aren’t protected. Check what you’ve excluded.
VPN, proxy or Tor?
They get mixed up, so here’s the plain difference.
A proxy forwards traffic from one app, usually your browser, through another server. Many proxies don’t encrypt anything, so the network you’re on can still read the traffic. It changes your visible address and not much else.
A VPN encrypts all the traffic from your device and sends it through one server run by the VPN company. You’re trusting that company, which is why its audit record matters so much.
Tor sends your traffic through several volunteer-run relays, so no single relay knows both who you are and where you’re going. It’s built for anonymity rather than convenience, and it’s usually much slower than a VPN, which makes it a poor fit for streaming or big downloads.
Some VPNs bridge the two. NordVPN’s Onion Over VPN servers, for example, connect you to the Tor network from the VPN app without the Tor browser. For most people, though, the choice is simpler than it looks: a VPN for everyday privacy on shared networks, Tor when anonymity is the whole point.
A quick self-check after you connect
Switch the VPN on, then open any “what is my IP” page in your browser. The address and location it shows should be the VPN server’s, not yours. If they’re yours, the VPN isn’t carrying your traffic, and you’ve found the problem before it mattered. Do the same check after changing networks, since a phone that hops from hotel Wi-Fi to mobile data can reconnect in ways you don’t notice. Thirty seconds. Worth it.
Do you need a VPN?
You probably do if:
- You use public Wi-Fi often, in hotels, airports, cafés or co-working spaces.
- You don’t want your internet provider to keep a browsing history of you.
- You travel and need home services that behave differently abroad.
You probably don’t need one for:
- Hiding from accounts you sign in to. A VPN can’t.
- Blocking every tracker. Use a privacy-focused browser and tracker blocking as well.
- Staying safe from malware. Use updates and security software.
When you decide you need one, read our reviews of NordVPN, Proton VPN and Surfshark, or start with the VPN section.
Common misunderstandings
“A VPN makes me anonymous.” It doesn’t. It hides your network path and your IP address. Accounts, cookies and your device can still identify you.
“Incognito mode does the same thing.” No. Private browsing stops your browser from saving history on your device. Your provider and the sites you visit still see everything.
“All VPNs are equally private.” They aren’t. The difference is in what each one keeps on its servers, for how long, and who has ever been allowed to check, and the published audits, with their dates and their auditors’ names, are the only way an ordinary buyer can tell one promise from another.
“A free VPN is just as good.” Some are, many aren’t. Free services have to pay for servers somehow. Proton VPN’s free plan is an example of a free tier from a company with a public audit record; check that before trusting any free VPN.
Most people miss the last point. It turns out the price of a VPN matters less than whether anyone has checked its promises.
FAQ: what a VPN hides
Can my internet provider see what I do with a VPN on?
No. It can see that you’re connected to a VPN and how much data you use, but not which sites you visit.
Can websites see my real location with a VPN?
Not from your IP address. They see the VPN server’s location. Apps with GPS access on your phone can still see where you are.
Does a VPN hide me from Google or Facebook?
Not when you’re signed in. Those services know your account. A VPN only changes the address they see.
Can the VPN company see my traffic?
It handles all of it, so in principle yes. That’s why independent no-logs audits matter: they check that the company doesn’t keep records of what you do.