VPNs explained: what they do, what they don't

What does a VPN do? A VPN, or virtual private network, creates an encrypted connection between a device and a server run by the VPN provider, which hides your internet traffic from the local network you’re on, such as a café hotspot, and makes websites see the VPN server’s address instead of yours. It doesn’t stop scams or malware, and it doesn’t remove the need to trust someone with your traffic. This guide explains how VPNs work, what the Australian Signals Directorate’s ACSC says about them, and what consumer VPN providers state about their services.

How a VPN works

Normally, a device sends its traffic through whatever network it’s connected to (home Wi-Fi, a hotspot, mobile data) and on to the internet. Anyone running that network can see where the traffic goes, even when the content itself is encrypted.

With a VPN switched on:

1. The VPN app on the device encrypts the traffic before it leaves.
2. The encrypted traffic travels through the local network to the VPN provider’s server. The local network can see that the device is connected to a VPN, but not what it’s doing.
3. The VPN server decrypts the traffic and sends it on to the website or app.
4. The website sees the VPN server’s IP address, not the device’s.

This encrypted connection is often called a tunnel, because it carries the traffic privately through the existing network. The rules for creating that tunnel are called protocols. WireGuard, OpenVPN and IKEv2 are common ones.

What a VPN protects

The ACSC describes a VPN as “a service that encrypts and secures your data when using the internet”, and says it “acts as an extra layer of protection when using public Wi-Fi hotspots.” The ACSC explains that public hotspots “can be accessed by anyone, and are often free and unsecured”, and that anyone, including cybercriminals, can set one up or copy a legitimate one. Its guidance says: “If you use public Wi-Fi hotspots frequently, install and use a reputable VPN service on your device.”

Many websites already encrypt their connections. The ACSC says that when a webpage is secure, “the information that you send to it is encrypted”, and describes looking for “https” and the lock symbol. A VPN adds encryption for everything the device sends, not only secure websites, and hides which sites are being visited from the local network. Our guide to using public Wi-Fi and travelling with devices covers other public Wi-Fi precautions the ACSC describes.

What a VPN doesn’t do

• It doesn’t stop phishing. A fake login page works just as well over a VPN. A message that tricks someone into entering a password or paying money isn’t affected by how the traffic travels. See how phishing, smishing and vishing work.
• It doesn’t stop malware. A harmful app or download still reaches the device through the VPN, because the VPN only changes how traffic travels. Some providers add separate blocking features, which they describe on their own sites.
• It doesn’t make a person anonymous. Websites still recognise accounts that are signed in, and cookies and other tracking continue. Payment details link an account to a person: Mullvad, for example, notes that card, PayPal and bank payments go through third parties and aren’t anonymous.
• It moves trust rather than removing it. The VPN provider’s server sees the traffic the local network no longer sees. The ACSC notes that “VPN providers have access to a large amount of their user’s data”, and describes looking at independent reviews “to make an informed, secure decision.”
• It doesn’t replace a secure home network. At home, the router’s own security matters more; see how to secure home Wi-Fi.

Do you need a VPN?

It depends on how a person uses the internet. The ACSC’s guidance says: “If you use public Wi-Fi hotspots frequently, install and use a reputable VPN service on your device.” For someone who rarely uses public Wi-Fi, the built-in habits the ACSC describes (a trusted connection for sensitive tasks, secure https websites, and not auto-joining public hotspots) cover much of the same ground. On a secured home network or mobile data, a VPN’s main benefit is privacy from the network operator rather than protection from a fake hotspot.

A VPN adds something mainly for people who often use hotspots in cafés, airports or hotels, or who want to hide which sites they visit from the local network. It isn’t needed to reach an employer’s systems; that’s the job of a work VPN.

What to compare

• Protocols. Which protocols the apps use. Providers describe their choices on their sites.
• Logging policy. What the provider says it records, such as activity, connection times or IP addresses. A “no-logs” policy is the provider’s own statement; the policy text sets out exactly what is and isn’t kept.
• Jurisdiction. Where the company is based, which affects which laws apply to it. Providers state their own location.
• Independent audits. Some providers say outside firms have reviewed their no-logs policies or apps. The provider’s audit page or report describes the scope and date.
• Kill switch. A feature that blocks internet traffic if the VPN connection drops, so traffic isn’t sent outside the tunnel. Providers differ on whether it’s on by default.
• Device limits. How many devices can connect at once.
• Platforms. Which operating systems, browsers and TVs have apps.
• Account and payment details. What personal information is needed to sign up and pay.

The ACSC’s public Wi-Fi guidance describes similar checks: reading the provider’s privacy policy, how it stores and shares data, and independent reviews.

How the products compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. Logging and audit statements are each provider’s own claims. Prices aren’t shown; each provider’s site has current plans.

The product summaries below set out what each provider states.

How to set up a VPN

The steps are similar across providers:

1. Read the provider’s privacy policy and logging policy on its official site.
2. Download the app from the provider’s official site or the official app store for the device.
3. Sign in, then connect to a server.
4. Check the kill switch setting, since providers differ on whether it’s on by default.
5. Connect before joining a public hotspot, or set the app to connect automatically if it offers that.

Each provider’s help pages have the exact steps for each device.

Work VPNs and consumer VPNs

The two serve different purposes. A work VPN is set up by an employer to connect staff to the organisation’s own systems, such as files and internal apps. The ACSC notes that “remote access solutions are increasingly being used to access organisations’ systems and data”. A work VPN is managed by the organisation, which sets the rules for its use.

A consumer VPN connects a person’s device to the provider’s servers and then to the public internet. It doesn’t give access to an employer’s systems. People who work from home normally follow their employer’s IT policy on which VPN to use; our guide to working from home securely covers the ACSC’s remote working guidance.

Things to watch for

• Unofficial apps. Apps from outside official stores or the provider’s own site may not be genuine.
• Broad permission requests. An app’s permission requests show what it can access on the device.
• Free services. Running servers costs money. The provider’s privacy policy describes how a free service is funded and what data it collects.
• Big promises. Wording such as “total privacy” goes beyond what a VPN does, as the limits above show.
• Automatic renewal. Many subscriptions renew automatically; the provider’s terms describe how cancellation works.

Common questions

What does a VPN do?

A VPN creates an encrypted connection between a device and the VPN provider’s server, hiding traffic from the local network, such as a café hotspot, and showing websites the VPN server’s IP address instead of the device’s. The ACSC describes it as an extra layer of protection on public Wi-Fi. A VPN doesn’t stop phishing or malware, and the provider can see the traffic the local network no longer sees. See how a VPN works.

Do I need a VPN at home?

It depends on what someone wants from it. On a secured home network, a VPN’s main benefit is privacy from the network operator rather than protection from a fake hotspot. It doesn’t replace a secure home network: at home, the router’s own security matters more. The ACSC’s VPN guidance is aimed at people who use public Wi-Fi hotspots frequently. The guide on how to secure home Wi-Fi covers the router settings the ACSC describes.

Should I use a VPN on public Wi-Fi?

The ACSC’s guidance says: “If you use public Wi-Fi hotspots frequently, install and use a reputable VPN service on your device.” It explains that public hotspots can be accessed by anyone, and that cybercriminals can set one up or copy a legitimate one. For people who rarely use hotspots, the ACSC also describes using a trusted connection for sensitive tasks and looking for https and the lock symbol. See Do you need a VPN?

Does a VPN make me anonymous?

No. A VPN hides traffic from the local network and hides the device’s IP address from websites, but websites still recognise signed-in accounts, cookies and other tracking continue, and payment details can link an account to a person. Mullvad, for example, notes that card, PayPal and bank payments go through third parties and aren’t anonymous. The VPN provider can also see the traffic. See what a VPN doesn’t do.

What is a no-logs VPN?

It’s a VPN whose provider states that it doesn’t record users’ online activity. Mullvad, NordVPN, Proton and Surfshark each make a no-logs statement and describe outside reviews, but these are the providers’ own claims. The provider’s logging policy sets out exactly what is and isn’t kept, such as connection times, IP addresses or payment records. The ACSC describes looking at independent reviews before choosing a provider. See the comparison table.

Is a free VPN safe?

It depends on the provider. The ACSC notes that VPN providers have access to a large amount of their users’ data, and describes reading the provider’s privacy policy, how it stores and shares data, and independent reviews. Running servers costs money, and a free service’s privacy policy describes how it’s funded and what data it collects. Proton, for example, describes a Free plan for 1 device at a time, with fewer server locations. See things to watch for.

Where to get official help

• The ACSC’s guidance on connecting to public Wi-Fi covers hotspots and VPNs.
• The ACSC’s remote working guidance is written for people working away from the office.
• Fake apps and scams can be reported to Scamwatch.

Related guides

• How to use public Wi-Fi more safely
• How to secure home Wi-Fi
• Working from home securely
• How phishing, smishing and vishing work
• Antivirus software: do you need it