A VPN encrypts traffic between your device and a VPN server and exits to the internet from that server’s IP. That is powerful — and frequently oversold.
Pick based on threat model. Streaming convenience ≠ journalist-level threat protection.
The tunnel protects the leg between your device and the VPN server. Past that server your traffic re-enters the ordinary internet, so the site you visit still sees a request arriving — just from the VPN's address rather than yours. Almost everything you read is already encrypted end-to-end by HTTPS anyway; what the VPN adds is hiding which sites you contacted from whoever runs the network you are sitting on, and hiding your home address from the sites themselves.
That is a narrow, real benefit. It is not invisibility, and the difference matters when you are deciding what to pay for.
A client can say "connected" while traffic escapes around it. Three vectors account for nearly every failure we see in testing:
A kill switch is the backstop for the moment the tunnel drops: it blocks traffic instead of letting the operating system fall back to the normal route. Test it by killing the client process, not by clicking Disconnect, which usually shuts things down cleanly.
Providers commission firms such as Deloitte, PwC, KPMG or Cure53 to examine their logging claims. A good audit is meaningful: it inspects configuration and interviews engineers at a point in time. It is still a snapshot of a system the provider controls, scoped by the provider, and it cannot prove what happens the following month. Read who performed it, when, and what was in scope — an audit from four years ago covering one server cluster is close to decoration.
A VPN does nothing about the identity you hand over voluntarily. Log into an account and you are that account, from any address on earth. It does not stop malware, phishing, or a browser fingerprint built from your fonts, screen size and extensions. It does not make torrenting legal. And it moves trust rather than removing it: your ISP no longer sees your browsing, the VPN operator now could. That trade is worth making only if you trust the operator more than the ISP — which is a judgement about jurisdiction, ownership and audit history, not about marketing.
No. It hides your address from the sites you visit and your browsing from the local network, but any account you log into identifies you, and browser fingerprinting works regardless of your IP address.
Yes. A VPN encrypts a network path. It does not inspect downloads, block phishing pages, or protect a reused password. Those are separate jobs done by separate tools.
Running a global server network costs money, so a free service is being paid for somehow — usually by advertising, data collection, or throttling. If privacy is the reason you want a VPN, a free one undercuts the reason.