A VPN does one narrow, useful thing: it moves the point where your traffic enters the public internet from your local network to a server you have chosen, inside an encrypted tunnel. That is it. Everything else in VPN advertising, the anonymity, the hacker-proofing, the "military-grade" protection for your bank login, is either a side effect that HTTPS already delivers or simply untrue. This piece works through the five most common myths, then lays out the cases where a VPN genuinely earns its subscription and how to pick one that will not betray the trust you are placing in it.
What a VPN technically does: one encrypted tunnel, one new IP
When you switch a VPN on, your device wraps every packet in a second layer of encryption and sends it to the VPN provider's server. That server unwraps the packet and forwards it to its real destination, using the server's IP address instead of yours. Replies come back the same way.
Two things change as a result, and only two:
- Your local network and ISP see less. The coffee-shop router, your ISP or your employer's network can see that you connected to a VPN server and how much data moved, but not which sites you visited or what you sent.
- Websites see a different address. Sites, ad networks and streaming services see the VPN server's IP and location, not yours.
What does not change: the content of the pages you visit, the accounts you are logged into, the cookies in your browser, the malware on your machine and the fingerprint your browser leaves. Opera's security team put it neatly in a March 2026 explainer: encryption protects the connection, and only verification protects the destination.
Myth 1: "A VPN makes you anonymous"
It hides your IP address from websites. That is a long way from anonymity. As Opera points out, if you are logged in to a social network, an email service or an online store, that service knows exactly who you are regardless of the VPN. Cookies and trackers you already carry follow you through the tunnel. Browser fingerprinting, which identifies you by your screen size, fonts, GPU and installed extensions, does not care about your IP at all.
The VPN provider, meanwhile, now sees everything your ISP used to see. You have not removed the observer; you have chosen a different one. Whether that is an improvement depends entirely on whether the provider keeps logs, which is the subject of the audit discussion below.
Myth 2: "You need a VPN to be safe on public Wi-Fi"
This was true in 2012. It is mostly not true now, because nearly all web traffic is already encrypted end to end with HTTPS. Google's October 2025 announcement that Chrome will warn before loading any plain-HTTP public site by default (from Chrome 154, due October 2026) came with the data: HTTPS usage has sat in the 95 to 99 percent range since around 2020, and for public sites Windows is at about 98 percent and Android and Mac are over 99 percent.
The FTC's consumer guidance has caught up with this. Its current position is that because encryption is so widespread, connecting through a public Wi-Fi network is usually safe, and the thing to check is the lock icon in the address bar. Proton VPN, a company that sells VPNs, concedes the same point: HTTPS keeps your connections secure, and what a VPN adds on public Wi-Fi is privacy, not security. Specifically, it stops the network operator from seeing and potentially selling the list of domains you visited.
That is a real benefit. It is just a much smaller one than "protects you from hackers at the airport."
Myth 3: "A VPN protects you from hackers and malware"
A VPN protects packets in transit. It does nothing about what is at either end. If you download a trojan, the VPN encrypts the download beautifully. If you enter your bank password into a phishing site, the VPN delivers it to the criminal over a private tunnel. Opera's explainer is blunt about this: a VPN encrypts data sent to untrustworthy destinations without validating whether those destinations are safe.
Some VPN apps bundle a DNS-based blocklist that stops known malicious domains from resolving. That is a genuine, if modest, layer of protection, but it is a bolt-on rather than something inherent to the VPN, and a browser with Safe Browsing enabled does most of the same job.
For actually keeping accounts safe, the defenses that matter are unique passwords, phishing-resistant sign-in and up-to-date software. If you want to spend a subscription on account security, our Bitwarden vs 1Password vs Proton Pass comparison is where to start.
Myth 4: "VPNs are always slow"
They used to be. Older protocols like OpenVPN carried significant overhead, and providers ran overloaded servers. Two things changed. WireGuard, a modern protocol with a much smaller codebase and faster cryptography, became the default across the industry; Mullvad went as far as removing OpenVPN entirely on January 15, 2026 to focus on WireGuard. And providers have invested in server capacity.
Proton's guidance is that with a good provider and a nearby, uncrowded server the effect on speed is minimal, and that holds for HD streaming and video calls. You will notice a slowdown when connecting to a distant country, or on a free service that routes you through whichever server has capacity left.
Myth 5: "Self-hosting your own VPN is more private"
Running your own VPN on a cloud server sounds like the privacy purist's answer, and it does keep your traffic away from a commercial VPN company. But Proton makes the counter-argument well: a self-hosted server has one user, so its IP address uniquely identifies you to every website you visit. You also hand your billing details to the cloud provider, which can see exactly as much of your traffic as a VPN company could.
A commercial VPN mixes your traffic with thousands of other users behind the same shared IP, which is what makes individual tracking hard. Self-hosting is a fine way to reach your home network securely or to get a fixed IP for work. It is not a privacy upgrade.
The cases where a VPN genuinely helps
Having dismantled the marketing, here is what is left, and it is a respectable list:
- Hiding browsing metadata from your ISP or network operator. In countries where ISPs are allowed to sell browsing data, or on any network you do not control, this is the core use case.
- Bypassing network-level blocks and censorship. School, workplace and national firewalls generally filter by destination; a VPN hides the destination.
- Changing your apparent location. For streaming catalogs, regional pricing or testing how a site looks abroad.
- Untrusted networks where you cannot verify what is happening. Hotel and conference Wi-Fi often inject ads or intercept DNS. A VPN with its own DNS sidesteps that.
- Torrenting and other peer-to-peer traffic, where your IP is otherwise visible to every other peer.
- Journalists, activists and anyone with a specific adversary who might be watching their network connection.
If none of those describe you, you probably do not need a VPN running all day, and turning it on only when you are on an unfamiliar network is a reasonable compromise.
How to judge a VPN provider: audits, logging, jurisdiction, protocol
Because a VPN provider sees what your ISP used to see, the whole exercise depends on trusting it. Trust should rest on evidence, not adjectives. Four criteria:
Scroll sideways to see the full table →
| Criterion | What to look for | Why it matters |
|---|---|---|
| Independent audits | Named firms, published reports, repeated over years | "No logs" is a claim; an audit is a check on it |
| Logging policy | Explicit statement of what is and is not stored, tested by audit | Determines what can be handed over or leaked |
| Jurisdiction and account model | Country of incorporation, whether sign-up needs an email or payment identity | Limits what can be demanded and what links you to the account |
| Protocol and code | WireGuard or a modern equivalent, open-source clients | Fewer bugs, faster, and inspectable |
Two providers illustrate what a good track record looks like. Mullvad publishes its full audit history: Assured and Cure53 in 2018, Cure53 in 2020, Atredis in 2022, an X41 D-Sec app audit in 2024, and NCC Group and Assured assessments in 2025. In early 2026 Assured audited GotaTun, Mullvad's own Rust implementation of WireGuard, and found no critical, high or medium issues, just two low-severity findings that were fixed. Mullvad also requires no email address to sign up and charges a flat monthly fee, which its pricing page lists at 5 euros a month as of August 2026.
Proton VPN, based in Switzerland, has now passed five consecutive annual no-logs audits by Securitum, the most recent published in 2026 after several days of on-site review. The auditors found no persistent records that would let Proton link a user to activity on a reviewed server.
An audit is a snapshot of the systems the auditor was shown, not a guarantee. But a provider that submits to this scrutiny every year and publishes the results is behaving very differently from one whose evidence is a banner reading "no logs."
Avoid free VPNs that are not the free tier of an audited paid service. Running servers costs money, and if you are not paying, your browsing data usually is.
Our view: spend the money on a password manager first
If you have a fixed security budget and no specific reason from the list above, the ranking is clear. A password manager with unique passwords everywhere prevents the credential-stuffing attacks that actually take over accounts. Passkeys, which our setup guide walks through, remove phishing as a risk for the accounts that support them. Phishing-resistant two-factor authentication, covered in our 2FA methods explainer, protects the rest.
A VPN addresses none of those threats. It addresses network observers, which for most people at home on a reputable ISP is a lower-order concern. Buy the password manager first, turn on passkeys, and then, if you travel, torrent, or live somewhere your ISP sells your history, add an audited VPN.
A VPN is an encrypted tunnel to a server you trust more than your local network. It hides your browsing from your ISP and your IP from websites, and that is genuinely useful in specific situations. It does not make you anonymous, it does not stop malware or phishing, and on today's HTTPS-everywhere web it adds privacy rather than security on public Wi-Fi. Pick a provider by its audits and account model, not its ads, and put a password manager and passkeys ahead of it on your list.
Sources and further reading
- Busting VPN myths: what a VPN can do for your privacy and what it can't (Opera Security)blogs.opera.com
- What can (and can't) a VPN do? Common VPN myths, busted (Proton VPN)protonvpn.com
- Are Public Wi-Fi Networks Safe? What You Need To Know (FTC Consumer Advice)consumer.ftc.gov
- HTTPS by default (Google Security Blog)blog.google
- Mullvad VPN app security audits (Mullvad, GitHub)github.com
- Removing OpenVPN 15th January 2026 (Mullvad VPN)mullvad.net
- Mullvad's new GotaTun protocol passes first independent audit (CyberInsider)cyberinsider.com
- Proton VPN passes 5th annual external audit of no-logs policy (Proton VPN)protonvpn.com
- Pricing (Mullvad VPN)mullvad.net