The VPN, Explained: What It Protects and What It Doesn’t

You land after a five-hour flight, find the airport wifi, connect, and up pops that login screen with the certificate warning you’ve never once read. You click through, check your bank balance, answer a few emails, done. That ninety seconds of convenience is exactly the moment a VPN is built for — and it’s also the moment most people misunderstand what the tool actually did for them.

I’ve written before about getting hacked and about the 30-minute lockdown I think everyone should run, so this post is the missing piece: what a VPN really protects, what it flatly does not protect, and where it fits in a security stack that includes free tools like credit freezes and password managers.

Disclosure: this post includes affiliate links. If you sign up through one, I may earn a commission at no extra cost to you. I only recommend tools I use or would use myself. I’m not a financial advisor, and this isn’t financial advice.

What a VPN Actually Does (In One Paragraph)

A VPN creates an encrypted tunnel between your device and a server operated by the VPN company. Everything you send and receive travels through that tunnel, so three parties can’t casually read it: the network you’re on, your internet provider, and anyone sniffing traffic between you and the VPN server. Websites you visit see the VPN server’s IP address instead of yours, which is why your apparent location changes.

That’s the whole trick. It’s an encryption service plus an IP shuffle. It is not magic, and understanding the boundaries of that trick is the entire difference between people who use a VPN well and people who buy one because a YouTube ad told them to.

The Honest Capability List

Here’s the table I wish came in the box. Read the right column as carefully as the left.

What a VPN does	What it does not do
Encrypts your traffic on networks you don’t control	Make you anonymous — your VPN provider still knows who you are
Hides your IP address from the sites you visit	Remove viruses or stop you from installing malware
Stops your ISP from logging the sites you visit	Protect you from phishing emails you willingly click
Helps you use services as if you’re somewhere else	Guarantee that every service allows it — many block VPN IPs
Secures logins on shared hotel or coffee-shop wifi	Replace a password manager or two-factor authentication
Reduces tracking tied to your IP address	Stop ad tracking driven by cookies and logins

What It Doesn’t Do — The Part the Ads Skip

The “you’re totally anonymous with a VPN” pitch is the most overcooked claim in tech advertising. If you log into your email, your bank, or your social accounts while on a VPN, those companies know exactly who you are. Anonymity requires a stack of behaviors most people never attempt, and a VPN is only one layer of it.

Malware is the second hype gap. A VPN encrypts traffic; it does not scan downloads, block you from running a bad file, or clean an infected laptop. If a tool claims VPN plus antivirus plus identity protection in one bundle, read the fine print on what each part actually is, because bundled products are rarely best-in-class at any of them.

Third: a VPN can’t protect an account that has no second factor on it. If someone guesses or steals your password, they don’t need to be on your network to get in. That’s why the VPN is not the first tool in the drawer — it’s maybe the fourth.

Where a VPN Genuinely Earns Its Keep

Travel and public wifi

Hotel networks, airport wifi, conference halls, coworking spaces — these are shared networks where you have no idea who else is connected or how the router is configured. Modern encryption (the HTTPS padlock on most sites) already protects much of what you do, and that’s the honest nuance: public wifi is far safer than the 2010s scare stories suggested. But HTTPS protects specific connections, not everything, and the login pages and odd apps that still use plain connections are exposed. On a trusted home network, I’d argue most people barely need one at all. On the road, it’s the use case that justifies the subscription.

Financial logins away from home

Checking a bank account from a shared network is the scenario where I want the tunnel. Not because banks are careless, but because I have no visibility into the network itself, and the cost of encrypting that session is a few dollars a month.

Working from anywhere

Anyone handling client data, business email, or company systems from a laptop that travels should already understand this use case — many employers require it, and for good reason. When your office is wherever you happen to be standing, the “network perimeter” is your own responsibility.

Home privacy from your ISP

This one is quieter but real. Depending on your provider and country, your internet company can log the domains you visit and, in some markets, monetize that history. A VPN collapses that log into “connected to the VPN server.” It’s a legitimate privacy improvement at home, though honestly it’s the least dramatic of the benefits.

How This Fits the Rest of the Stack

Think of security as layers with different jobs. The password manager handles unique passwords so one breach doesn’t cascade. Credit freezes shut down new-account fraud, which is the attack that actually damages finances — that’s the 30-minute identity-theft lockdown I keep recommending. Two-factor authentication catches the password that leaks anyway. The VPN covers the network layer, which matters most when you travel. None of these replace each other, and the free ones do more heavy lifting than any paid one.

I covered the breach-and-hijack angle in more depth when I wrote about being proactive about getting hacked, and the theme hasn’t changed: layered defenses beat any single hero tool.

What I Look For When Picking One

• Independently audited. A third-party audit of the no-logs claim is the minimum bar, because you’re shifting trust from your ISP to the VPN company. Make sure that company earned it.
• Kill switch. If the tunnel drops, traffic should not leak outside it. This matters more than speed marketing.
• A clear business model. Free VPNs pay for servers somehow. If the product isn’t the payment, you usually are.
• Server locations you’ll actually use — and a sane refund window so you can test it on your real commute, not a speed-test website.

The service I use hits those marks, and if you want to try it, this is my referral link. Use it or don’t — the checklist above is the part that protects you regardless of which service you pick.

The Verdict

A VPN is a narrow, honest tool: it encrypts your connection and moves your apparent location. It’s near-essential for people who work or log in from public networks, nice-to-have at home for privacy, and completely irrelevant to the threats that actually hurt most families — credential theft and identity fraud. Buy it for the airport, not for peace of mind.

Here’s my challenge for tonight: before you spend a dollar on security software, do the free stuff first. Freeze your credit with all three bureaus, turn on two-factor for your email and bank, and get your passwords into a manager. Those three moves take one evening. If you’ve done them, then a VPN is a reasonable fourth layer — and if you haven’t, no subscription will save you.