VPN terms explained in plain English

Every VPN app, settings screen and privacy policy uses the same few dozen words, and most of them are never explained. Here they are in plain English, grouped by where you meet them: the basics, the connection, protocols, addresses and leaks, and the settings on your phone. Each entry is one or two sentences.

The basics

VPN

Virtual private network. An app that sends everything your phone does through one encrypted connection to a server elsewhere, so the network cannot read it and websites see the server's address. What is a VPN is the long version.

Tunnel

The encrypted connection itself. Each of your packets is sealed inside another packet addressed to the server, which unwraps it and sends it on. See what "tunnel" means.

Server

The computer at the far end of the tunnel that decrypts your traffic and forwards it to the internet under its own address. Also called a node. Many people share one server at a time.

Location

The country or city you pick in the app. A location usually holds several servers; the app chooses among them.

Provider

The company that runs the servers and publishes the app. It is the party that can see your traffic once the VPN is on, which is why its privacy policy matters more than its feature list.

The connection

Handshake

The short exchange at the start of a session where the app and server prove who they are and agree on encryption keys. Nothing else happens until it completes.

Encryption

Scrambling data with a key so that only the holder of the matching key can read it. In a VPN it is applied to every packet between your phone and the server, and nowhere else.

Key

The secret that encryption depends on. A VPN uses a long-term key to identify each side and short-lived session keys, made fresh in each handshake, to encrypt traffic.

Session

One continuous period of being connected, from handshake to disconnect. Sessions have a lifetime, after which the app reconnects; in Culvert VPN that ceiling is 24 hours.

Keepalive

A tiny packet the app sends every so often so that routers between your phone and the server do not forget the connection during a quiet spell.

Latency

The time for a packet to reach the server and a reply to come back, measured in milliseconds. Distance dominates it, and it is not the same thing as speed: a link can have low latency and still carry little data per second.

Server load

How busy a server is relative to what it can carry. A lightly loaded distant server can beat a saturated nearby one, which is why a good app shows a real capacity figure rather than a signal bar.

Protocols

Protocol

The agreed format of the tunnel: how packets are wrapped, how the handshake works and which encryption is used. The three in common use on phones are WireGuard, OpenVPN and IKEv2, compared in VPN protocols explained.

WireGuard

A modern protocol with a small codebase, a one-round-trip handshake and low battery cost. The first choice of most current apps where the network allows it.

OpenVPN

An older, widely deployed protocol that can run over TCP as well as UDP, which lets it pass through networks that drop UDP. Slower to connect than WireGuard.

IKEv2

A protocol built into the IPsec standard and into most phone operating systems. Handles switching between Wi-Fi and mobile data cleanly.

UDP and TCP

The two ways packets travel on the internet. UDP is fire-and-forget and quick, which suits a VPN; TCP confirms delivery and is what web pages use. Some networks drop UDP, so a VPN needs a TCP option too.

Port 443

The port that HTTPS web traffic uses. Because almost no network can block it without breaking the web, VPN apps try it when their usual ports are filtered.

TLS

The encryption layer under HTTPS. A VPN can wrap its tunnel inside TLS on port 443 so that it looks like ordinary web traffic to a network that filters VPN protocols.

MTU

Maximum transmission unit, the largest packet a link will carry. Wrapping packets in a tunnel makes them bigger, so the VPN sets a smaller MTU on its interface; get it wrong and some sites hang.

Addresses and leaks

IP address

The number that identifies your phone on the network it is on, assigned by the Wi-Fi or carrier. Websites record it on every visit, and it reveals your ISP and rough location.

Exit IP

The server's public address, which is what websites see while you are connected. Shared by everyone on the server, and the single most useful thing a connect screen can show, provided the app measured it through the tunnel rather than looked it up.

DNS

The lookup that turns a site name into an address before your phone can connect to it. With a VPN on, lookups should travel through the tunnel to the provider's resolver.

DNS leak

When lookups go to the local network's resolver instead of through the tunnel, so the Wi-Fi owner or ISP sees the names of the sites you visit even though the traffic is hidden. See what a DNS leak is.

IP leak

Any way your real address reaches a website while the VPN is on: a dropped tunnel, IPv6 going around the VPN, or an app you excluded on purpose.

IPv6

The newer address format alongside IPv4. A VPN that only carries IPv4 leaves IPv6 traffic outside the tunnel, so a good app either carries it or blocks it while connected.

Settings on your phone

Always-on VPN

An Android setting that starts the VPN at boot and keeps it connected across network changes, without you opening the app.

Kill switch

Whatever stops traffic leaving your phone unprotected when the tunnel drops. On Android the real one is the system setting "Block connections without VPN", which the OS enforces; an app cannot reliably do it alone.

Split tunnelling

Choosing apps that stay outside the VPN and use the network directly. On Android the safe form is an exclude list, so anything you install later is inside the tunnel by default.

Logs

Whatever a provider records about your use. The word covers everything from a count of connections to a list of every site visited, so the useful question is always which specific things are kept and for how long, and the answer belongs in the privacy policy.

Culvert VPN uses these pieces without making you learn them: it picks the protocol itself, shows measured latency and load per city, verifies the exit IP through the tunnel, and is free on Google Play.