What is a VPN, and what does it actually do?

A VPN, short for virtual private network, sends everything your phone does on the internet through one encrypted connection to a server run by the VPN provider. The Wi-Fi network, the mobile carrier and anyone between you and that server see only scrambled data going to one address. The websites and apps you use see the server's address, not yours.

That is the whole idea. Everything else people say about VPNs, good and bad, follows from those two effects: the network cannot read your traffic, and the far end does not see where you are.

What changes when you turn one on

Without a VPN, your phone talks to each website directly. The Wi-Fi router, the café's network, your mobile carrier and the ISP behind them all see which servers you connect to, and any of them can see the names of the sites you visit, because DNS lookups and connection metadata travel in the clear even when the page itself uses HTTPS.

With a VPN connected, your phone opens one encrypted tunnel to the VPN server and pushes every connection through it. From the outside, there is one stream of encrypted data to one address. The site you visit, meanwhile, sees a request arriving from the VPN server's public address, which is called the exit IP.

The last row matters. A VPN does not remove the party that can see your traffic; it moves that role from the network you happen to be on to a company you chose. Whether that is a good trade depends entirely on how the provider handles what it can see, which is why the privacy policy is the most important page a VPN publishes.

What a VPN is good for

Three situations account for most of the value:

• Networks you do not control. Hotel, campus, airport and café Wi-Fi are run by someone else, and anyone else on the same network can try to watch it. A VPN turns your traffic into a single encrypted stream that is useless to them.
• Keeping your address out of every site's logs. Every website records the IP address of every visitor. With a VPN, they record the exit IP instead, which is shared by many people.
• Restrictive networks. Some Wi-Fi networks filter ports or block common VPN protocols. A well-built app tries several connection methods in order and keeps the one that works.

What a VPN does not do

A VPN is not an anonymity tool, and the marketing that says otherwise is wrong. If you are signed in to an account, that service knows who you are regardless of your IP address. Browser cookies, device identifiers and the apps you have installed all carry on identifying you. A VPN also does nothing about malware, phishing pages or weak passwords, and it will not make a slow connection faster. The post on whether a VPN makes you anonymous goes through this properly.

How you know it is working

The honest test is the exit IP. When the tunnel is up, the app should be able to ask a server "what address did this request come from?" and show you the answer. If that address belongs to the VPN server, your traffic is going through it. Culvert VPN does exactly this on the connect screen, asking its own server through the tunnel rather than a third-party "what is my IP" site, so the check itself does not leak anything. The exit IP explainer covers why that distinction matters.

What it costs, in speed and battery

Encrypting every packet costs a little processing, and routing through a server costs a little distance. On a modern phone with a nearby server, both are small: a few milliseconds of added latency and a few percent of battery over a day. The usual cause of a slow VPN is a distant or overloaded server, not the encryption, which is covered in why your VPN is slow.

If you want to try one without handing over an email or a card, Culvert VPN's free tier connects to servers in the Netherlands, France and Germany with a single tap, and is on Google Play.