What a VPN actually does
Without a VPN, your device sends internet traffic directly to the sites and services you use. Your ISP sees which servers you talk to (and, for older or unencrypted traffic, what you send), the local network operator can log the same, and the sites themselves see your real IP address.
With a VPN, your device opens an encrypted connection to a VPN server first. All your traffic goes through that tunnel. Your ISP only sees encrypted data flowing to one address (the VPN server). The sites you visit see the VPN server's IP, not yours. That's the whole trick — one hop that changes who sees what.
This is useful when you don't want your ISP or a network operator to build a picture of what you're doing online, when you're on a network you don't trust (hotel wifi, coffee shop, conference), or when a service you use behaves differently depending on where the request appears to come from.
When a VPN genuinely helps
Public wifi. Coffee shops, hotels, airports, and conference networks are the classic case. You don't know who else is on the network or what they can see, and network operators can inspect traffic. A VPN encrypts everything from your device to the exit server, which shuts most of that surface down.
ISP privacy. Most ISPs log which sites you visit; some sell that data. Some throttle certain kinds of traffic (video streaming, large downloads). A VPN hides which sites you're visiting from the ISP — they see traffic to the VPN provider, nothing more.
Traveling. If you pay for a streaming service, banking, or news subscription in your home country and the service checks your IP, a VPN lets you keep using what you already pay for from a hotel abroad. This is a legitimate continuity use.
Privacy on shared or work networks. If your household router logs traffic, or your workplace network is monitored, a VPN moves your traffic outside that logging perimeter for the personal stuff you don't want inspected. Do check that your employer's acceptable-use policy permits it before running one on a work device or network.
What to look for in a provider
Independently audited no-logs policy. A VPN's value depends on the provider not keeping records of what you did. Any provider can claim this; the ones worth trusting have paid a reputable third-party auditor (Deloitte, PwC, KPMG, Cure53) to verify. Read the audit report, not the marketing page.
Jurisdiction. Providers based in privacy-friendly countries (Switzerland, Panama, British Virgin Islands) sit outside intelligence-sharing arrangements like Five Eyes and generally have weaker compulsory-disclosure regimes. Providers based in the US, UK, or other Five Eyes countries can still be legitimate, but they face more legal pressure to hand over data if they have any.
Transparent ownership. Some large VPN brands are owned by the same parent company via holding entities that are not immediately visible. Not automatically disqualifying, but worth knowing. Independent journalists have written up the ownership graph — a search for the provider name plus "owner" will usually surface the map.
Kill-switch support. If the VPN connection drops, your device should stop sending traffic entirely rather than silently falling back to your regular ISP connection. Every serious provider offers this on desktop; support on mobile varies.
Server count and network quality matter less than marketing suggests. Ten thousand servers doesn't help you if the ones you actually use are slow. Read recent independent speed tests (TomsGuide, PCMag, restoreprivacy have regular roundups) rather than the provider's own numbers.
What a VPN doesn't do
A VPN does not make you anonymous. If you log into a site, that site knows who you are. If you use the same browser you use everywhere else, browser fingerprinting can identify you across sessions. A VPN only changes who can see your traffic *in transit* — not who can identify you at the destination.
A VPN does not block ads, trackers, or malware on its own. Some providers bundle these as extra features; a browser extension or DNS-level blocker (uBlock Origin, NextDNS, Pi-hole) is generally more effective for that specific goal.
A VPN does not stop the sites you visit from doing what they do. If a site collects analytics, embeds trackers, or requires account signup, the VPN doesn't change any of that. It only changes the network path between your device and the server.
A VPN can slow you down. Every extra hop adds latency. Good providers minimize this; bad providers turn a 50ms connection into a 500ms one. Speed tests before committing to an annual plan are worth doing.
The rough shortlist
The category is competitive and specific rankings change with every audit cycle. As of mid-2026, the five providers that consistently show up on independent recommendation lists (TomsGuide, WIRED, PCMag, restoreprivacy, TechRadar Pro):
- NordVPN — ~$3.09/mo on a 2-year plan · Panama-based, multiple third-party audits (Deloitte, PwC), 6,000+ servers across 60+ countries. Strongest all-rounder for most people.
- ExpressVPN — ~$4.99/mo on a 2-year plan · British Virgin Islands-based, audited by KPMG and PwC, TrustedServer RAM-only infrastructure. Historically the most reliable option for accessing streaming services while traveling.
- Proton VPN — Free tier available; Plus ~$4.49/mo on a 2-year plan · Swiss, run by the Proton Mail team, has a genuinely usable free tier with no data cap. Best pick if you want to try before paying.
- Mullvad — €5/month flat, no promos, no annual discounts · Sweden-based, uses anonymous account numbers instead of email signup, accepts cash. Best pick for privacy purists who don't want an account tied to their identity.
- Surfshark — ~$2.19/mo on a 2-year plan · Netherlands via BVI, aggressive pricing, unlimited simultaneous devices per account. Best pick if you're covering a whole household on one subscription.
Pricing changes constantly — check each provider's own site for the current promo. The honest answer is that at the shortlist level they're broadly comparable. Read the most recent independent review roundup, look at current pricing (a 2-year plan is normal, monthly plans are meaningfully more expensive), and check the audit dates — a provider that hasn't been audited in three years is a weaker signal than one audited last quarter.
