The Off-Key Bard
Technology

What Is a VPN Actually Hiding?

Or: incognito mode for your whole internet connection? Not exactly. A VPN changes the route your traffic takes — not whether you exist on the internet.

Or: Incognito Mode, but for Your Whole Internet Connection? Not Exactly.

VPN advertising loves a particular image: a shadowy figure in a hoodie, green code cascading across six monitors, a map showing your location — and then a switch is flipped and you vanish. Hackers can't find you. Your ISP goes blind. Websites lose your trail.

VPNs are genuinely useful technology. But they're not an invisibility cloak, and the mythology built around them can lead people to misplace their trust. To understand what a VPN actually protects, we need to stop asking "does a VPN make me private?" and start asking a more specific question: private from whom?

What a VPN Actually Does

When you connect to a VPN service, your device establishes an encrypted connection to a VPN server. All your outgoing internet traffic travels through that tunnel before reaching its final destination. The simplified path changes from:

Your device → Router → ISP → Website

to:

Your device → Router → ISP → VPN server → Website

Your ISP still carries the traffic — the packets physically travel across their network. But instead of seeing your individual connection destinations, the ISP primarily sees encrypted traffic flowing between you and the VPN server. It loses visibility into what's inside that tunnel.

The destination website, meanwhile, sees the VPN server's IP address instead of your home connection's public IP. That's the most concrete thing a VPN does: it changes what your ISP can observe about your traffic, and it changes what websites see as the source of your connection.

What Your ISP Could Learn Without One

Even when HTTPS encrypts web page content, your ISP can still observe metadata from network traffic — which services you're connecting to, when, and how much data you transfer. Depending on DNS configuration and protocol details, it may be able to infer which domains you're visiting even when content itself is encrypted. A VPN reduces this visibility significantly.

That said, HTTPS was already encrypting most web content before VPNs became mainstream consumer products. Without a VPN, your ISP can't simply read your passwords or the private messages you send through encrypted services as though they were postcards. A VPN adds an additional encrypted layer, but it's not replacing no security with some security — it's adding a layer on top of existing HTTPS protection.

Moving Trust, Not Eliminating It

A VPN doesn't abolish the need for trusted intermediaries. It moves trust from one party to another.

Without a VPN, your ISP occupies a privileged position in your network path and can observe traffic metadata. With a commercial VPN, you've inserted another company into that position. Your ISP sees an encrypted connection to the VPN provider. The VPN provider receives your traffic and forwards it toward the internet. You've shifted trust away from your ISP and toward the VPN company.

That can be a worthwhile trade — particularly if you trust your ISP less than you would trust a reputable, audited VPN provider. But you haven't removed a trusted intermediary from the equation. You've selected a different one.

This is why VPN privacy policies matter. "No logs" claims vary enormously in what they actually mean — connection timestamps, source IP addresses, DNS queries, destination information, and bandwidth usage may each be handled differently. Some providers have undergone independent audits that verify their claims. Others have had those claims tested through legal proceedings. Many have simply put reassuring words on a website. The VPN provider occupies a privileged network position, so understanding who you're choosing to trust matters.

What VPNs Don't Do

Logging into accounts identifies you. Turn on your VPN, connect through a server in Switzerland, open Facebook, and log in. Facebook knows it's you. The IP address changed. Your identity didn't. The same applies to Google, Amazon, your email provider, your bank, and any other service where you provide your credentials. A VPN obscures the origin IP of the connection — not the fact that you just authenticated with your username and password.

Cookies and browser storage persist. Websites store cookies that maintain sessions and recognize returning visitors. If you logged into a site before enabling your VPN, then enabled your VPN and revisited the site, the cookie may still identify your session regardless of the new IP address. A VPN operates at the network layer; it doesn't touch browser storage.

Browser fingerprinting still exists. Websites can use combinations of characteristics — browser version, operating system, screen properties, time zone, language, installed fonts, graphics capabilities — to distinguish browsers and devices across sessions. Changing your IP address is one privacy measure; these other identifiers remain unchanged.

Advertising tracking continues through other means. If an advertising network tracks you through cookies, account logins, or mobile ad IDs, changing your IP doesn't stop that tracking. The cookie still identifies the same browser. The account login still identifies the same person.

A VPN doesn't make malicious sites safe. If you navigate to a phishing site, your VPN will deliver the fake login page efficiently and with excellent encryption. If you download malware, the VPN will securely transport it to your computer. The encrypted tunnel protects traffic in transit — it doesn't evaluate whether the destination or the content is trustworthy.

GPS and device location are different from IP location. A VPN changes the IP address that websites see. It doesn't affect your phone's GPS receiver, Wi-Fi positioning, or cellular location signals. If you've granted an app location permission, the VPN doesn't override that. Your network traffic might indicate one location while your device hardware reports another.

IP Location and What It Actually Reveals

An IP address can be associated with a general geographic area — often a country, region, or metropolitan area — but IP geolocation is an estimate, not GPS precision. Websites can't take your IP and pinpoint your street address. A VPN can change which IP address websites see, making your traffic appear to originate from the VPN server's location. This is useful for changing your apparent network location, but it's worth knowing IP location is only one of many signals websites use to understand where you are.

When VPNs Are Actually the Right Tool

Public Wi-Fi is still a reasonable use case. HTTPS has dramatically improved security on untrusted networks compared to the early days of public Wi-Fi — someone sitting nearby can't simply read your passwords out of the air on modern encrypted connections. But a VPN adds an encrypted tunnel for all your network traffic and reduces your reliance on the local network's DNS infrastructure. It remains a useful addition, particularly for applications or protocols that may not use HTTPS.

Hiding your home IP from websites is something a VPN does cleanly. If you don't want a web service to associate your real home IP with your activity there, routing through a VPN server achieves this.

Remote work and corporate networks are where VPN technology was originally designed to be used. Employees connecting to internal company systems that aren't exposed to the public internet need a secure tunnel back to those resources. The goal isn't anonymity — it's securely extending access to a private network across untrusted infrastructure. Most corporate VPNs are doing exactly this.

Censorship circumvention is another legitimate use. In regions where certain sites or services are blocked at the network level, VPNs can route traffic around those blocks by making it appear to originate from a different location.

The Bard's Take

VPNs do something specific and useful: they create a protected network path between your device and a VPN server, hiding much of your destination traffic from your local network and ISP, changing the IP address that destination websites see, and letting you securely access remote private networks.

What they don't do is erase your identity from the internet. If you log into your accounts, the accounts know who you are. If your browser carries tracking cookies, the VPN doesn't clear them. If you grant apps location permissions, the VPN doesn't override GPS. If you enter your credentials into a phishing site, the VPN will faithfully encrypt your password's journey to the scammer.

The most useful question isn't "am I hidden?" It's "who can see what?" Without a VPN, your ISP has significant visibility into your network traffic. With a VPN, the ISP sees much less — but the VPN provider becomes the intermediary that forwards your traffic, and the destination websites still know everything you voluntarily tell them through accounts, cookies, and browser behavior.

A VPN doesn't remove you from the internet. It changes the route you take through it. And once you understand who you're hiding what from, VPNs stop looking like magic and start looking like what they've always been: a very useful networking tool, being sold with considerably more mystique than the technology actually possesses.

Sources

← Back to the Desk — Technology