If HTTPS already encrypts, why use a VPN?

HTTPS encrypts the contents of the page: what you type, what the site sends back, your cookies and your passwords. It does not hide which site you are visiting. The site's name travels in the clear in your DNS lookup and again in the first message of the TLS handshake, and the site sees your real IP address. A VPN covers those, and it covers every app on the phone, not only the browser. The two solve different parts of the problem, and they work well together.

What HTTPS protects

When the padlock is showing, the connection between your browser and the site is encrypted end to end. Anyone on the path, the Wi-Fi owner, your ISP, a VPN provider if you use one, sees encrypted bytes and cannot read the page, the form you submitted or the session cookie that keeps you logged in. It also authenticates the site, so a fake hotspot cannot quietly serve you a copy of your bank's login page under the bank's name; the certificate would not match.

That is a lot, and it is why the modern web is mostly safe to use on networks you do not trust. Nearly every site of any size is HTTPS now, and browsers warn loudly when one is not.

What HTTPS leaves visible

Encryption starts after the connection is set up, and setting it up leaks three things.

The DNS lookup. Before your phone can connect to example.com it asks a resolver for the site's address. By default that resolver belongs to the network you are on, and the query is sent in plain text. Every site you visit appears there as a name with a timestamp. The DNS privacy post follows that query end to end.

The server name in the handshake. The first message of a TLS connection carries the site's hostname unencrypted, so a server hosting many sites knows which certificate to present. This is the Server Name Indication field, and anyone on the path can read it. There is an extension, Encrypted Client Hello, that closes this, but it is still being rolled out and depends on both the browser and the site supporting it.

Your IP address. The site you connect to sees the address the request came from, which is your phone's address on the current network, and records it. Every network on the path also sees where the packets are going.

The traffic that is not a browser

HTTPS is a browser concept, but most of what a phone sends is not a browser. Games, messaging apps, background sync, ad libraries embedded in apps, and anything older or lazily built may use plain HTTP, its own protocol, or encryption that is not as carefully checked as a browser's. You cannot see a padlock for those, and you cannot make an app use HTTPS if its developer did not.

A VPN does not care what the traffic is. Everything the phone sends is wrapped and encrypted to the VPN server, so the local network sees the same thing for a well-built banking app and a badly built weather widget: encrypted bytes to one address. That uniformity is the main thing a VPN adds on a phone, more than any single browser session.

Why the two work well together

The VPN server decrypts the tunnel and forwards your traffic on. If a page is HTTPS, what the VPN server forwards is still encrypted between your browser and the site; the provider sees the destination and the volume, not the contents. So the VPN takes the site names and your address away from the local network and your ISP, and HTTPS keeps the contents away from the VPN provider. Neither one alone does both, and the what a VPN hides post draws the full boundary.

That is also why the provider's handling of what it can see, destinations and DNS, is the thing to check. Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id, and it keeps your client IP address for up to 30 days for abuse handling, as set out in its privacy policy.

When HTTPS alone is enough

If you are on your own home network, trust your ISP, are not concerned about your home address appearing in a site's logs, and only care that nobody reads your bank login, HTTPS is doing that job already. A VPN adds the most on networks you do not control, and for keeping your address out of the logs of every site and app you use; the ISP post helps decide whether that matters to you, and the encryption explainer covers what the tunnel's own encryption adds.

For everything the padlock does not cover, Culvert VPN wraps every app on the phone in one encrypted connection with a single tap, and is on Google Play.