01What the tunnel really does
A VPN moves the point where your traffic enters the public internet. Without one, your requests leave from your own network, visible to that network’s operator and to the sites you reach. With one, your traffic is sealed in an encrypted tunnel to a server you chose, and enters the internet from there.
02Protocols, in order of relevance
The protocol is the grammar of the tunnel. Modern clients negotiate this for you, but the names appear in every settings panel, so they earn a plain gloss.
| Protocol | Lineage | What to know |
|---|---|---|
| WireGuard | Modern kernel-space | About four thousand lines of code; fast handshakes; the current default recommendation of most independent reviewers. |
| OpenVPN | Mature userspace | The long-serving standard. Audited for two decades; slightly slower than WireGuard and easier to configure badly. |
| IKEv2 | Standards-track | Handles network changes (wifi to mobile) gracefully; common on mobile clients from larger vendors. |
| “Proprietary” | Vendor-specific | Unauditable by outsiders. Not automatically worse — automatically unverifiable. |
03What a VPN does not do
Useful technology deserves honest limits. A VPN does not anonymise you against services you log into — an account is an account regardless of network path. It does not remove the need for HTTPS; the padlock is doing separate work. And it does not defeat fingerprinting techniques that read your browser, not your address.
04Choosing a provider, calmly
- Jurisdiction and logging policy. Read the actual policy, not the landing page. The gold standard is a policy that has survived an independent audit or a real-world seizure test.
- Protocol defaults. A provider defaulting to WireGuard or OpenVPN with sensible settings is showing its work; one hiding behind a branded protocol name is asking for trust instead of evidence.
- Court record. What happened when authorities asked for data? “Nothing to hand over” is the answer you want confirmed by events, not slogans.
- Pricing sanity. The market has settled; extreme discounts and extreme premiums are both signals worth reading.
- Client quality. You will live in this app. A clumsy client is a daily tax.
05Everyday habits that matter more
In rough order of impact: unique passwords in a manager, automatic system updates, HTTPS everywhere, and scepticism toward grant-request dialogs. A VPN sits below all of these on the risk ladder — it complements basics, never replaces them.
06Frequently asked
Is using a VPN legal?
In most jurisdictions, yes — it is ordinary encryption. A handful of countries restrict or license VPN use; knowing your local law is part of the checklist, not an afterthought.
Do I need one on a home network?
For threat models most people actually have, rarely. The clearest everyday cases are hostile wifi, censorship circumvention where lawful, and hiding your location from services you deliberately pay to see less of you.
Does a VPN slow the connection?
Some, by physics: encryption and distance cost a little. Well-run WireGuard endpoints often cost single-digit percentages on decent lines.
What about “free” services?
Bandwidth is not free; if you are not paying a subscription, examine what you are paying with. Exceptions exist. Verify rather than assume.