Quick answer: A VPN encrypts your connection to the VPN company and hides your traffic from the local network, but it does not make you anonymous. Free VPNs carry real risks, so research any app first, avoid free ones for banking, and rely on HTTPS and other basics too.
VPN apps are heavily advertised as a cure for all privacy problems. They are not. A VPN moves trust from your internet provider or café Wi-Fi to the VPN company, so the company you pick matters a lot.
This explainer is general information for readers in the US, UK, Canada, Australia and Europe. It is not a product recommendation.
What does a VPN actually do?
The EFF says a VPN is mainly useful for routing your network connection through a different network. Companies use them so staff can reach private sites from elsewhere. For home users, the same idea hides your activity from the local network and shows websites the VPN’s address instead of yours. See the EFF’s analysis of TunnelVision and VPN advice.
What does a VPN not do?
- It does not make you anonymous. The EFF says a VPN does not provide anonymity online.
- It cannot always stop attacks on your local network. Researchers behind the TunnelVision attack said VPNs “were not designed to mitigate LAN attacks on the physical network.” In that attack, someone on your network can reroute traffic outside the VPN while it looks connected.
- It does not fix bad habits. Phishing links and weak passwords still work against you. Use a password manager.
Are free VPNs safe?
Often not. Norton lists risks including data logging and selling, weak encryption, malware, intrusive ads, browser hijacking, slow speeds, data caps of 2 GB to 10 GB, and leaks. It cites Top10VPN research that found antivirus tools flagged about 20% of 100 free Android VPN apps as potentially harmful. Norton sells security products, so treat its advice as one view, but the risks match what other sources say.
If a service is free, ask how it pays for itself. Sometimes the answer is your data.
What did US officials say about personal VPNs?
As TechRadar reported in December 2025, the US cyber agency CISA said, “Do not use a personal VPN,” as part of a broader alert on sophisticated spyware. CISA argued personal VPNs “simply shift residual risks from the internet service provider (ISP) to the VPN provider, often increasing the attack surface,” and said many providers have questionable security and privacy policies.
That guidance was aimed mainly at high-risk users such as government staff, so for ordinary users it is a reason to be careful rather than a ban. TechRadar’s own suggestions, not CISA’s, include a provider with an independently verified no-logs policy, WireGuard or OpenVPN, a kill switch and DNS leak protection.
How do I choose and use a VPN safely?
- Research the app first. The FTC’s tips (from 2018, but still sensible) say to research the app before downloading it.
- Check its permissions. Question any that seem unrelated to what a VPN does.
- Confirm it encrypts your data and check whether it shares information with third parties.
- Look for modern protocols and a no-logs policy. Norton suggests AES-256 encryption, OpenVPN or WireGuard, and a kill switch.
- Use a money-back guarantee or trial so you can test before paying.
- Skip free VPNs for banking, shopping or work. That is Norton’s advice.
When can a VPN still help?
A VPN can be useful when you want to route your connection through a different network, which is the use the EFF describes. Some people use one on hotel or café Wi-Fi, and the FTC notes that free public Wi-Fi is often insecure, which is why some people turn to VPN apps. Some workplaces also supply a company VPN, and that one is a different thing: your employer runs it, and it is meant for reaching work systems.
Treat a personal VPN as one layer, not a shield. Keep your phone and apps updated, use unique passwords and turn on two-factor sign-in. A VPN also does not stop a website from knowing who you are once you log in, since your account identifies you either way.
Be careful with browser extensions that call themselves VPNs. Norton warns that some extensions can redirect traffic to ad-heavy or phishing sites. Install apps only from the official store, read the privacy policy, and delete any VPN you no longer use.
What else protects me on public Wi-Fi?
The EFF notes that HTTPS, encrypted DNS and encrypted messengers are free and can give basic protection on untrusted networks. The FTC also says free public Wi-Fi networks are often insecure. Where you can, use mobile data instead, and secure your own network with our home router guide. If you are scammed anyway, see where to report a scam. More guides are in the Apps and Software news and guides category.
Frequently asked questions
Do I need a VPN at home?
Not necessarily. A VPN hides your activity from your internet provider but shifts that trust to the VPN company. HTTPS already protects most web traffic.
Is a paid VPN always safe?
No. Price alone does not prove privacy. Look for a clear no-logs policy, independent audits and modern encryption.
Can a VPN make me anonymous?
No. The EFF says a VPN does not provide anonymity online.
What is a kill switch?
It cuts your internet connection if the VPN drops, so your traffic is not sent unprotected.