What a VPN actually protects you from (and what it doesn't)
VPN advertising tends toward the dramatic — hackers lurking on every network, corporations tracking your every move, data pouring out of your devices at all times. The suggested fix is always the same: subscribe to our VPN and be protected.
VPNs do something real and useful. It's just not most of what the marketing implies.
What a VPN actually does
A VPN routes your internet traffic through a server operated by the VPN provider, encrypting the connection between your device and that server. This does a few specific things:
It hides your traffic from your internet service provider. Without a VPN, your ISP can see which domains you visit. With one, they can see that you're connected to a VPN server, but not where your traffic goes after that.
It hides your IP address from the websites you visit. Instead of seeing your home IP, they see the VPN server's IP. This can be useful for accessing content that's region-restricted, or for not leaving your home IP in the logs of every site you visit.
It provides some protection on untrusted networks — hotel WiFi, airport lounges, public hotspots. An attacker on the same network might try to intercept your traffic, and a VPN makes that harder.
These are real benefits. They're just narrower than "security."
What a VPN doesn't protect you from
The threats that actually affect most people aren't ones a VPN addresses at all.
Phishing. If you click a link in an email and enter your password on a fake site, the VPN does nothing. The traffic travels through the VPN tunnel to the fake site just fine.
Malware. A VPN doesn't scan files you download or block malicious software. It's a network-level tool, not an endpoint protection tool.
Compromised passwords. Credential stuffing — where attackers try leaked credentials from one site across other sites — doesn't care whether you're on a VPN. The attack happens at the server side, not your connection.
The VPN provider itself. When you use a VPN, you're choosing to route all your traffic through their servers. That's a significant trust decision. VPN providers vary widely in how they handle data, how honest they are about their logging practices, and how they respond to legal requests. You're not becoming anonymous; you're shifting who can see your traffic.
Browser tracking. Cookies, browser fingerprinting, and login sessions follow you regardless of your IP address. If you're logged into a service, they know who you are whether you're using a VPN or not.
When a VPN is genuinely worth using
There are cases where a VPN provides real value:
On genuinely untrusted networks — public WiFi where you can't verify who set up the router — a VPN makes sense for anything sensitive, particularly if you're doing work that involves privileged access. Note that HTTPS already encrypts the content of your connections even without a VPN, which significantly reduces the risk of the classic "man in the middle on coffee shop WiFi" scenario. But a VPN adds an additional layer, and for high-sensitivity work on unknown networks, that extra layer is worth having.
If ISP-level privacy matters to you — whether for personal or professional reasons — a VPN from a provider with a credible no-logging policy is a reasonable choice.
For accessing geo-restricted content, a VPN works fine, though this is a convenience use, not a security use.
What actually improves your security posture
The account security measures that protect against the threats that affect people most are simpler and more impactful than a VPN:
Unique, strong passwords on every account — which means a password manager in practice, since no one can remember dozens of distinct credentials. Two-factor authentication on email, banking, and anything that matters. Caution about phishing links, especially in email and text messages. Keeping devices updated.
A VPN is a tool. It solves specific problems. The marketing around it tends to conflate "security" with "privacy," overstate the threat of network interception in a world where HTTPS is standard, and imply that a subscription makes you broadly protected. That's not accurate.
If you have a VPN and it's something you find useful, keep using it. If you're considering one primarily because you're worried about hackers or account security, the time and money spent on a password manager and 2FA will help more.