What is a VPN? How the virtual private network works

Every device on the internet has an IP address, a number that lets data packets find their way to it, comparable to a postal address. Without a VPN, your phone or laptop sends its requests straight through your internet provider to the website, and the website replies to your address. Your internet provider can see which servers you connect to, and the website can see which address the request comes from. Our guide shows you which address that currently is (→ How to find your IP address – and what it reveals about you).

A VPN inserts an intermediate stop between you and the internet. A program on your device, the VPN client (usually just the provider's app), encrypts all outgoing data and wraps it in new packets. These packets go to a VPN server, which decrypts them and forwards them to their actual destination. The reply takes the same route back. Germany's Federal Office for Information Security (BSI) describes this encrypted stretch as a «tunnel»: to anyone listening in along the way, the contents are unreadable. NordVPN puts it this way in its explainer: the server replaces your visible IP address with its own.

From this follows who sees what. Your internet provider or the operator of the Wi-Fi network now only sees that your device is holding an encrypted connection to a particular VPN server, not which websites you visit behind it. The website, in turn, sees the IP address of the VPN server and assigns you to the country where that server is located. The VPN provider sees both: where you come from and where you go. That is the core of the whole technology, and both its benefits and its limits follow from it.

So that client and server can trust each other and share a key, they perform a handshake at the start: they identify themselves to each other and agree on the keys used to encrypt the session. Exactly how that happens is laid down by the protocol, the set of rules both sides have to speak, just as HTTPS is the set of rules between browser and website. According to the BSI, VPNs were originally used mainly in working life, to connect home-office workplaces and field staff securely to the company network or to link sites together. Private individuals taking out a subscription with a commercial service in order to browse through its servers is a later development, but today it is the form in which most people encounter the term.

Company VPN: this is the classic form. The company runs a VPN server at the edge of its network, employees connect to it from home or on the road and are then inside the company network as if they were sitting in the office. The UK's National Cyber Security Centre (NCSC) describes exactly this purpose in its device security guidance, secure connections between devices in physically separate locations, and recommends that organisations use IPsec with certificates and a VPN that connects automatically so that nobody forgets to switch it on. This variety has nothing to do with streaming or anonymity; it protects access to internal systems.

VPN into your own home network: many routers can act as VPN servers themselves. According to its manufacturer's site fritz.com, the FRITZ!Box supports both IPsec and WireGuard; with WireGuard, fritz.com says scanning a QR code on your smartphone or tablet is enough, and after that you can reach your network storage, cameras or smart home from anywhere as if you were at home. The BSI names precisely this as an advantage: smart-home devices can be controlled through your own router without a detour via a manufacturer's cloud and without open port forwarding, which would be a security risk. In this case your public IP address is that of your home connection, so as far as websites are concerned you are browsing from home, even if you are abroad.

Commercial VPN services: NordVPN, Surfshark, Proton VPN, ExpressVPN, CyberGhost and many others run thousands of servers in dozens of countries and rent out access by subscription. You install the app, choose a country, and from then on your traffic runs through a server there. The BSI lists a fast connection even under heavy load and several server locations as criteria, and points out that German data protection law does not apply to servers abroad and that choosing a provider is a matter of trust, because all of your traffic passes through its servers. This third variety is what the rest of this article is about, unless stated otherwise.

What is not a VPN: a browser plug-in that only redirects the browser's traffic is, according to the BSI, not a fully fledged VPN; your email program, messengers and other apps bypass it, and protecting all of a device's network traffic requires dedicated VPN software. A plain proxy also redirects requests but does not necessarily encrypt them. Tor is a separate network with several hops and a different security model (more on that below). And a VPN is not antivirus software: it does not inspect downloads, does not detect malware and does not warn you about fake websites.

The protocol determines how client and server set up the tunnel, which encryption they use and how they renew their keys. For you as a user it is usually a menu item in the app that is set to «Automatic» by default. Still, it is worth knowing the three big names, because they differ markedly in speed, age and how easily they can be audited.

WireGuard is the youngest of the three and describes itself on wireguard.com as an «extremely simple yet fast and modern VPN». It offers no choice of cryptography and commits to a fixed set of modern algorithms: ChaCha20 with Poly1305 for encryption, Curve25519 for key exchange, BLAKE2s for hashing, SipHash24 and HKDF. The handshake follows the Noise protocol framework and, according to the protocol description, needs just one message out and one back, a single round trip; the session keys are renewed «every few minutes», so a key stolen later cannot decrypt past sessions (perfect forward secrecy). All packets travel over UDP. The project is part of the Linux kernel and, according to wireguard.com, also runs on Windows, macOS, BSD, iOS and Android; it is designed to be implementable in very few lines of code and thus auditable by individuals.

OpenVPN is the veteran. The project page describes it as a full-featured open-source SSL VPN solution whose security model is built on SSL or TLS, the same technology that secures HTTPS in your browser. For transport it uses a single UDP or TCP port, which makes OpenVPN more flexible in restrictive networks than UDP-only protocols. Encryption is handled by the OpenSSL library, integrity checks by HMAC. OpenVPN runs on Linux, BSD, macOS and Windows, is well documented and has been in use at companies and VPN services for more than two decades; in return it is considered slower and bulkier. In its blog, NordVPN contrasts roughly 400,000 lines of code in OpenVPN with a much smaller codebase in its own WireGuard derivative NordLynx (roughly 10,000 lines according to NordVPN); smaller code is easier to audit and maintain.

IKEv2/IPsec is the standard that operating systems ship with. According to Apple, iOS has the IKEv2, L2TP over IPsec and Cisco IPsec protocols built in (as at 22 October 2026); the FRITZ!Box documentation describes IPsec as directly supported by many operating systems, and the UK's NCSC explicitly recommends IPsec to organisations for VPN access because it is an open standard integrated into operating systems, with the drawback that some third-party networks block IPsec traffic. If you want to set up a VPN without an app, say to your home router or to a provider that offers it, you will usually end up with IKEv2; how that works on an iPhone is shown in (→ How to set up a VPN on your iPhone – with an app or by hand).

On top of these come the providers' in-house developments, which are generally variants of the protocols above. According to the NordVPN blog, NordLynx builds on WireGuard and adds a double NAT system: because WireGuard in its basic form would assign each user a fixed internal IP address on the server, with NordLynx all users of a server share the same local address externally, while a second interface assigns a dynamic address per session that disappears again with the session. For countries with heavy censorship, NordVPN recommends its NordWhisper protocol, because WireGuard traffic has a recognisable fingerprint and UDP is sometimes blocked on university or company networks. Such extra protocols are not a mark of quality in themselves; what matters is that the underlying technology is openly documented and audited.

Secure public Wi-Fi: in a hotel, at the airport or in a café you share the network with strangers. Switzerland's National Cyber Security Centre (NCSC) describes the risks in its weekly review 29/2024: unencrypted or poorly secured hotspots through which login details and credit card data can be intercepted, and fake access points with trustworthy-sounding names; as an example, the Swiss NCSC cites a case from Australia involving fake networks at airports and on planes. Its recommendation reads, word for word: «If you can, use a Virtual Private Network (VPN)», on the grounds that a VPN encrypts all your data traffic. The BSI puts it similarly: a VPN reduces the risk of being spied on by other users on the same network. Both authorities add, however, that you should still not handle sensitive data such as online banking on public networks and should look out for HTTPS.

Keep your internet provider out of it: without a VPN, your internet or mobile provider sees which servers you connect to. With a VPN, it only sees the tunnel to the VPN server. Whether that matters is a question of personal judgement; in Switzerland and the EU there is rarely a compelling reason, while on trips to countries with sweeping surveillance it can be relevant. The flip side is important: what your internet provider no longer sees, your VPN provider now sees.

Change your location: because the website sees the VPN server's IP address, it assigns you to the server's country. The BSI explicitly names getting around geo-blocking as a use case, but points to licensing reasons and the legal position. Typical cases are your own streaming subscription on holiday, news sites blocked from abroad, or price comparisons where providers show different prices depending on the country. It is no guarantee, and the services' terms of use may prohibit circumventing country restrictions; you should read them beforehand.

Remote access and tracking protection: with a VPN into your home network you can reach your devices at home from anywhere without exposing them to the open internet; the BSI counts avoiding open port forwarding as a security gain. Against ad tracking, a VPN helps in one respect only: your IP address, which advertising networks use as one of several signals to recognise you, changes with every server. Cookies, device fingerprinting and logins are unaffected; how to get rid of cookies is explained in (→ Clear cache and cookies – in every browser, on your computer and your phone). If your main question is whether you need a VPN at all, you will find the weighing-up in our guide (→ Do you really need a VPN in 2026? The honest guide).

No anonymity: a VPN moves knowledge around, it does not erase it. Proton VPN writes in its own blog that the VPN provider knows your real IP address, handles your DNS requests and sees the websites you visit, which is why you have to trust it. And as soon as you are logged in at Google, Facebook, Instagram or your email account, the service knows who you are anyway; Proton puts it this way: Google can then track «all aspects of your browsing», and only your current IP address stays hidden. On top of that come cookies and browser fingerprinting, meaning recognition through small differences between browsers and devices; according to Proton, neither can be prevented with a VPN.

No protection against phishing, malware and weak passwords: a VPN does not check whether the website where you are entering your credit card details is genuine. Anyone who falls for a fake hotel or TWINT page does so with or without a VPN; our news covers a recent example from Switzerland (→ Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns). Proton sums it up: «A VPN can't overcome a compromised device.» Against malware you need updates and antivirus software, against account takeovers strong, unique passwords and two-factor authentication (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey); see (→ Create a strong password – and what is actually secure in 2026) and our comparison (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared).

The encryption ends at the server: the BSI stresses that VPN encryption reaches only as far as the VPN server or router and does not apply beyond it. From there to the website you are protected by what protects you without a VPN as well: HTTPS, recognisable by the padlock in the address bar, which is now standard on the vast majority of websites. That is why the BSI says explicitly that a VPN replaces neither HTTPS nor encrypted messengers. Conversely, this also means that what HTTPS already encrypts, such as passwords, content and payment details, does not become any more secure through a VPN; it is merely hidden additionally from the Wi-Fi operator and the internet provider, who without a VPN can at least see the destination address.

Slower, and a new party to trust: every detour through an additional server costs time. The BSI writes that transfer speed usually drops; NordVPN concedes that speed may drop «a little», depending on the server, network load and protocol. A nearby server and a modern protocol keep the loss small; a distant server and an older protocol increase it. And finally the question of trust: you are swapping an internet provider that is subject to the law of your own country for a company whose servers are somewhere in the world. That is why the BSI calls the choice of provider a matter of trust, and this is exactly where no-logs promises and audits come in.

Kill switch: if the VPN connection drops unnoticed, say when switching from Wi-Fi to the mobile network, your device would otherwise simply carry on browsing unprotected and reveal your real IP address. A kill switch prevents that: according to NordVPN, Proton VPN and Surfshark, it blocks internet traffic until the tunnel is back up. NordVPN distinguishes a system-level kill switch, which cuts all traffic immediately, from an app-level kill switch, which stops only selected programs; on Android, NordVPN says on its own page that it uses the system feature «Always on VPN» from Android 7. Besides the standard kill switch, which only steps in on an unintended drop, Proton VPN offers an «Advanced Kill Switch» that allows internet access only with an active Proton connection and survives a restart; on iOS, according to Proton, you will find the feature in the settings under «Security Options». Surfshark calls its two levels «Soft» (only on an unexpected drop) and «Strict» (whenever the VPN is off). If you use the VPN seriously, switch the kill switch on; if you only need it for streaming, you can leave it off, because it gets in the way on an unstable connection.

No-logs: with this, providers promise not to record what you do through their servers. Proton VPN puts it this way on its page: «We do not keep any logs of your online activity and do not store any metadata», meaning no websites visited, no session lengths, no IP address, no connection logs. Proton justifies this stance with Swiss law, which it says does not oblige VPN providers to retain data; its headquarters are in Geneva. The crucial point, though: a no-logs promise is at first only a claim by the provider. You cannot check for yourself what is stored on someone else's servers.

Audits (independent reviews): that is why reputable providers have their claims checked from outside. An audit is a report by an accounting or security firm that examines servers, configurations or apps and confirms that practice matches the claim, always only for the time of the review. On its no-logs page, Proton VPN cites reviews by the security firm Securitum and makes its apps fully open source, so that anyone can inspect the code. Surfshark points to reviews of its no-logs claims by Deloitte in 2023 and in June 2025 (as at 22 October 2026). Then there is jurisdiction, the country whose laws apply to the provider: Surfshark B.V. is based in Amsterdam, Proton AG in Geneva (as at 22 October 2026). How the individual providers handle headquarters, audits and logging is covered in our assessments (→ Surfshark review 2026: cheap, but is it good?) and (→ NordVPN review 2026: is the market leader still worth it?).

That trust is not a one-way street was shown by an incident in late summer 2026. In an incident report from September 2026, Surfshark reported that an internal test server used by its development teams had been reachable from the internet because of a misconfiguration; according to Surfshark, the first indications came on 31 August, and on 2 September the incident was confirmed and contained. According to the report, internal engineering documents, parts of system files, configurations and build credentials were accessible; «no user data and VPN services were affected», Surfshark writes, users need not do anything, and all affected credentials have been replaced. Surfshark conducted the investigation itself; an independent audit was announced. We report this neutrally: the report speaks for transparency, but also shows that even audited providers make mistakes, and that when choosing a provider you should look at how it handles such incidents.

iCloud Private Relay: Apple's service for iCloud+ subscribers is often confused with a VPN, but it is something different. According to Apple Support, Private Relay protects your browsing in Safari: requests pass through two separate relays, the first operated by Apple, which sees your IP address but, thanks to encrypted DNS requests, not which website you are visiting; the second operated by a third party, which assigns a temporary IP address and contacts the website. The aim, according to Apple, is that «no single party – not even Apple – can see both who you are and what sites you're visiting». The difference from a VPN: it applies only to Safari and not to other apps, you cannot choose a location, and according to Apple the service is not available in all countries. For everyday browsing it is a good, unobtrusive way to protect your IP address; for public Wi-Fi with all your apps, or for a different location, you need a VPN.

Tor: the Tor network pursues a different goal from a VPN, namely anonymity without a single operator you have to trust. According to the Tor Project's support pages, the Tor Browser routes traffic through three randomly chosen servers («relays»); the last one, the exit relay, sends the request on to the open internet. Your internet provider does not see which websites you visit, and the website sees only a connection from the Tor network, not your address. The Tor Browser additionally defends itself against fingerprinting, keeps no history and deletes cookies after every session. The price is convenience: the protection applies only inside the Tor Browser itself, the Tor Project explicitly advises against using Tor with other browsers, and there is no selectable location as with a VPN. According to the project, Tor is aimed at people who need to protect themselves against surveillance and censorship, not at streaming users.

Proxy: a proxy is a stand-in server that makes requests on your behalf. Unlike a VPN, it is usually set up per program, for instance only in the browser, and does not necessarily encrypt the route to it. Browser extensions that call themselves «VPN» are, according to the BSI, often exactly that: they encrypt only web traffic, while all other apps go straight out to the internet. If you want to protect all of a device's traffic, the BSI says you need dedicated VPN software.

Company VPN: if your employer has set up a VPN on your laptop, it serves access to internal systems and often also lets the company monitor traffic; the UK's NCSC explicitly advises organisations to use an always-on VPN without split tunnelling, so that apps cannot bypass the company's monitoring. Browsing privately through a company VPN therefore means, from the internet's point of view, browsing from the company's location, and the IT department can see what you do. If in doubt, use the company VPN only for work and a private device for private matters.

Using a VPN is permitted in Switzerland, the UK, the EU and most of the world; companies, public authorities and universities use one every day, and home routers such as the FRITZ!Box come with the feature built in. What is prohibited stays prohibited with a VPN: anyone who illegally downloads copyrighted material or commits fraud through a foreign server is no less liable just because the IP address is a different one. That is not legal advice but the principle the BSI also points to when it flags licensing reasons and the legal position in connection with geo-blocking.

Streaming services are a different matter. Legally, logging in to your own subscription from abroad is not an offence; contractually, the provider can prohibit circumventing country restrictions in its terms of use and, in the extreme case, suspend your account. What exactly your service says about this is in its terms; we did not check them individually for this article and therefore make no promises about which service works where.

When travelling: some countries restrict or ban VPNs. The BSI names China as an example and advises bearing this in mind when travelling; the Swiss NCSC, in its advice for trips abroad, generally recommends finding out about country-specific requirements before departure and heeding the travel advice of the Swiss foreign ministry (FDFA), and warns that border authorities in some countries may examine and retain hard drives. In practice that means: find out before travelling to such countries, install the app beforehand if necessary, and do not count on it working there. For the connection itself, incidentally, the Swiss NCSC recommends using your own mobile data connection rather than someone else's Wi-Fi; how to do that cheaply in the EU with a Swiss plan or a travel eSIM is explained in (→ EU roaming from Switzerland 2026: how to avoid the cost trap), and what an eSIM actually is in (→ What is an eSIM? How the digital SIM card works).

A VPN service costs money: servers in many countries, bandwidth, app development. Anyone offering it for free has to finance it some other way. The BSI warns that free offerings often come with limited features or poorer connection quality, and that users frequently pay with their data, which may be analysed for marketing purposes, for instance. With a service that by definition sees all of your traffic, that is a bad trade. The Swiss NCSC does mention in its weekly review that there are free VPN apps in the app stores, but names no names and gives no criteria.

One exception that can be verified is Proton VPN Free: according to Proton Support (as at 22 October 2026), the free tier comes with no data cap and no adverts; its limits are a single device and free servers in ten countries (Netherlands, Japan, Romania, Poland, Norway, Switzerland, Singapore, Mexico, Canada, USA). For occasional protection on hotel Wi-Fi that is enough; if you need a specific location or several devices, there is no way around a subscription. According to Proton, the kill switch is included in the free tier as well.

Among the paid services, prices on two-year plans are close together, while monthly plans cost several times as much. For «2 years + 3 months», NordVPN charges the equivalent of $3.49 a month for Basic, $3.99 for Complete and $6.99 for Prime, and $14.99 for the monthly plan; included are 10 devices, over 7,100 servers in 150 countries and a 30-day money-back guarantee (as at 22 October 2026, confirmed 27 October 2026). For the same term, Surfshark costs $2.49 (Starter and One) or $3.99 (One+) a month and allows unlimited devices on over 4,500 servers in 100 countries (as at 22 October 2026). Proton VPN Plus is $3.49 on a 24-month plan and $9.99 on the monthly plan for 10 devices (as at 22 October 2026); ExpressVPN quotes $2.99 for Basic in 113 countries on «2 years + 4 months», CyberGhost $2.19 on «2 years + 2 months» with over 9,500 servers in 100 countries (as at 12 October 2026). All prices are displayed in US dollars on the providers' sites; the details and the renewal conditions are in our assessments (→ NordVPN review 2026: is the market leader still worth it?) and (→ Surfshark review 2026: cheap, but is it good?).

What is fair depends on what you need. For occasional Wi-Fi protection alone, Proton VPN Free is enough, or, on an iPhone in Safari, Apple's Private Relay as part of an iCloud+ subscription. If you regularly want to access your own streaming subscription abroad, cover your family and several devices, or value audited no-logs claims, a two-year plan at the equivalent of roughly $2.50 to $4 a month serves you well; the monthly plan is only worth it for a single trip. And if anonymity is what you are after, you are better off with Tor than with any subscription. Which option suits you is covered in our guide (→ Do you really need a VPN in 2026? The honest guide); if a promotion such as NordVPN's Black Friday deal is running, we summarise it at (→ NordVPN Black Friday 2026: what the promotion really gets you).