A VPN is the simplest single step you can take to control what your devices tell the internet about you. But it is a step, not the whole journey, and the difference between services lives in details that never appear in the advertising: what is actually logged, who has checked that claim, and what happens in the second your connection drops. This guide covers what to check before you choose, how to set the service up so the protection is real, and where the honest limits of a VPN are.
What a VPN protects, and what it does not
With a VPN connected, the traffic between your device and the VPN server is encrypted, and the sites you visit see the server’s IP address instead of yours. Your internet provider can see that you are connected to a VPN, but not which sites you visit inside the tunnel. That is real protection, especially on networks you do not control.
| A VPN helps against | A VPN does not help against |
|---|---|
| Your internet provider seeing which sites you visit | Signed-in tracking: Google, Meta and others recognise your account, not your IP address |
| Others on the same public WiFi reading your traffic | Browser fingerprinting: fonts, screen size and settings can still identify your browser |
| Sites tying your visit to your home address via your IP | Malware, phishing and fake sites: a VPN is not antivirus software |
| Your approximate location being revealed by your IP address | Whatever the VPN provider itself can see: trust is moved, not removed |
That last point is the one to understand properly. A VPN does not remove the trust question, it moves it from your internet provider to the VPN company. The rest of this guide is about choosing a company that deserves that trust, and checking that the protection is actually switched on.
What to check before you choose
A logging policy someone else has verified. Every VPN says it does not log. The difference is whether an outside audit firm has checked the claim. NordVPN’s policy has been examined by PwC in 2018 and 2020 and by Deloitte several times between 2022 and 2025. Surfshark had Deloitte verify its no-logs policy in 2023 and 2025. Proton VPN’s apps are open to inspection by anyone because the source code is published, and its no-logs position has also been independently audited. A company that points only to its own policy page is asking you to take its word, and nothing else.
Related: what a no-logs policy actually means.
Where the company is based, and what that means. Jurisdiction decides which data retention and disclosure laws apply to the provider. Proton VPN operates from Switzerland, NordVPN from Panama, and Surfshark is registered in the Netherlands. No country is magic, and a strong policy matters more than a flag on a homepage, but a company that is open about where it is and which laws it answers to is far easier to judge than one whose ownership cannot be found.
A kill switch and leak protection. The kill switch blocks all traffic if the VPN connection drops, so nothing escapes unencrypted while the app reconnects. Leak protection makes sure DNS requests and WebRTC do not reveal your real IP address around the side of the tunnel. Both should exist, and the kill switch should be able to stay on permanently, not only per app.
Everyday transparency. Servers that run only on RAM, like Surfshark’s, cannot store data on a disk because everything vanishes at reboot. Published ownership, clear prices including renewal, and reachable support are boring details, but they are where the difference between a serious company and a marketing page shows.
Set it up like this, step by step
- Turn the kill switch on. If it has two modes, choose the one that blocks all traffic whenever the VPN is off or the connection drops, not only when the app crashes.
- Enable auto-connect on unfamiliar networks. Set the app to connect by itself when your device joins any WiFi that is not your home network. The protection is then in place before you open your email at the airport, the hotel or on the train.
- Leave the protocol on automatic. Modern protocols such as WireGuard, or the provider’s own variant of it, are the right default for most people. Change it only for a specific reason.
- Check that nothing leaks. Visit a site that shows your IP address, first without the VPN and then with it on. The address should change, and the location should match the server you picked. Run the DNS check if the tool offers one. It takes a minute, and it is the only way to know the settings actually took.
- Protect the account itself. Your VPN account has a password, and with several providers your payment details too. Use a unique password and turn on two-factor authentication where it is offered. A stolen VPN account is a back door you paid for yourself.
- Keep the app updated like other software. Security fixes arrive through updates. Turn on automatic updates if the app allows it.
About free VPNs, honestly
Servers, bandwidth and development cost money every month. A free service is therefore always paid for somehow, and in the worse end of the market the usual way is collecting data about the users. That is the exact opposite of what you bought a VPN for. The exception is free tiers from companies that sell a paid service and state the limits openly: Proton Free costs nothing, requires no card, and works on one device at a time with a limited server choice. It is a reasonable way to try the idea, not a full replacement for a paid plan.
Keep reading: how to browse anonymously with a VPN.
Proton VPN is the only provider in this round with a free plan that has no data limit, according to Proton itself. Securitum has audited the no logs policy five years in a row.
Habits that matter as much as the service
A VPN hides your IP address, but you still sign in. If you use the same accounts, the same browser and the same cookies, you are identified by the account, not the connection. For anyone who wants to go further, the next steps are a browser set up to limit tracking, separate profiles for separate purposes, and restraint with extensions, because extensions can see everything you do in the browser regardless of any VPN. And the basics still hold: updated software, unique passwords and two-factor authentication protect against more real-world harm than any single privacy feature.
Frequently asked questions
Does a VPN make me anonymous online?
No, and be sceptical of anyone who promises that it does. A VPN makes your connection private in relation to your internet provider, the network around you and the sites you visit. Your accounts, your browser and your own behaviour can still identify you. Private is the honest word, anonymous is not.
Can the VPN provider see what I do?
The provider can see that your device is connected and how much data passes, the same way your internet provider otherwise would. An audited no-logs policy means independent examiners found that the provider does not store records of the sites you visit. That is why the audits, not the marketing, are what you should look at.
Is using a VPN legal?
In the United States, the United Kingdom, the EU and most other democracies, yes, completely. VPNs are everyday tools for companies, journalists and private individuals. A VPN does not change the legality of anything else, though: what is unlawful without one stays unlawful with one.
Is a free VPN enough for privacy?
To try how the technology feels, yes, if you choose an open free tier from a company that sells a paid service. As a permanent arrangement, no. And a free app from an unknown company with no visible funding is worse than no VPN at all, because you are handing your traffic to someone you know nothing about.
Will a VPN slow my connection down?
Encryption and a detour through a server add a step, so some effect is normal. We do not measure speeds and we publish no speed figures. Pick a server near you when privacy is the goal, which keeps the detour short.
The bottom line
Staying private with a VPN comes down to three things: choose a company whose no-logs claim has been checked by someone other than the company itself, switch on the kill switch and auto-connect so the protection applies even when you are not thinking about it, and remember the limits. A VPN hides your traffic and your IP address. It does not make you anonymous, replace antivirus software, or remove tracking inside your signed-in accounts. Within those limits, it is the most effective single privacy tool most people can set up in ten minutes.
VPN Runner may earn a commission from links on this page. We verify prices, plan terms, server lists, refund terms and app availability on the providers' sites. We have not measured speeds.
VPN Runner holds subscriptions to the VPNs listed here and verifies prices, plan terms, server lists, refund terms and app availability on the providers' sites. We have not measured speeds.