On this page
Maybe a site is blocked on your hostel Wi-Fi, or an ad promised "total privacy" for free. The gap between what a VPN does and what people think it does is where the trouble starts.
What does a VPN do?
A VPN (virtual private network) is an encrypted connection from your device to a server run by the VPN company, which relays all your traffic to the website. The UK's National Cyber Security Centre describes VPNs as "encrypted network connections" that protect data crossing a network you do not trust.
According to the Electronic Frontier Foundation's guide to choosing a VPN, that has two effects:
It hides your traffic from the local network and your internet provider. The café, hostel or college running the Wi-Fi, and your ISP, see only scrambled data going to one server.
It swaps your IP address. Websites see the VPN server's address, so you appear to be wherever that server is.
Our walk-through of what happens when you type a website address shows where IP addresses and DNS fit in. If you want to firm up the computing ideas underneath, the Fermi Concept Library has a lesson for every concept in physics, chemistry, biology, mathematics and computing.
What does a VPN not hide?
The EFF puts the catch plainly: while a VPN hides your browsing from the ISP, "it's all visible to the VPN provider".
A VPN also leaves these untouched:
Your accounts. If you are logged in to Google or Instagram, that company knows it is you, whatever your IP address says.
Tracking. The EFF lists GPS, cookies, tracking pixels and browser fingerprinting as ways companies can still track you. Our guide to what website cookies store explains the cookie part.
Attacks on you. The EFF says ads promising that a VPN will stop cyber criminals, malware and tracking "vastly oversell the benefits of VPNs". A VPN will not stop you clicking a fake link or reusing a weak password; our post on why password length beats symbols helps with the second.
Doesn't HTTPS already encrypt my traffic?
Partly. The padlock in your browser means the page's content is encrypted, but the EFF notes that "HTTPS only protects the content of your communications, not the metadata": the domain names of the sites you visit, and when, stay visible to your ISP and anyone listening on the Wi-Fi. A VPN can hide that metadata from them, but the VPN provider sees it instead. Because most web traffic now uses HTTPS, the EFF says a VPN on public Wi-Fi "isn't as necessary for everyone anymore".
Which VPN myths do students believe?
"A VPN makes me anonymous." The EFF is direct: "A VPN is not a tool for anonymity."
"A free VPN is just as good." The EFF warns that VPNs can be free but "sell your data". A 2016 study of 283 Android VPN apps from the Google Play store found that 18% used tunnelling without encryption, over 38% showed some malware presence according to VirusTotal, and 75% used third-party tracking libraries. Apps have changed since, but the habit of checking first still applies.
"If it's on the Play Store, it's safe." The EFF says not to assume a VPN app is safe just because it is in an official store.
"My VPN protects everything on my phone." The NCSC notes that "only traffic which is routed over the VPN will be protected by it".
"VPN companies in India keep no records." In April 2022, CERT-In directed VPN service providers to keep validated customer names, allotted IP addresses, validated addresses and contact numbers, and the purpose for hiring the service for 5 years or longer.
Should you use a VPN? A two-minute check
Take Riya, a Class 12 student in a Kota PG who studies on shared Wi-Fi. Four questions:
Am I on a network I don't trust? Shared or public Wi-Fi run by people you don't know is where a VPN you trust can help.
Am I getting around rules I agreed to? School and college networks have usage policies; read them first.
Is my real worry websites tracking me? Then log out, clear cookies and check app permissions; a VPN will not fix that.
Who runs this VPN, and how does it make money? If you cannot answer, do not install it. As the EFF puts it, "a claim is not a guarantee", so look for an independent check of any "no logs" promise.
Riya answers yes to the first question and no to the next two, so a VPN whose owner and business model she can name makes sense for her. A friend who wants to hide from Instagram should spend those two minutes on privacy settings instead.
Next time an app promises total privacy, ask which party it hides you from, and which new party it lets in.
