A VPN encrypts your internet traffic and routes it through a remote server. Your internet service provider sees encrypted data going to the VPN, not the websites you visit. The websites see the VPN's IP address, not yours. That combination hides your browsing from your ISP and your identity from the sites you visit. VPNs are common on public Wi-Fi, where unencrypted traffic can be intercepted. They are also used to bypass geographic restrictions and censorship.

A VPN is not anonymity. The VPN provider can see your traffic unless it has a no-logs policy, and even then you are trusting their claim. A VPN shifts trust from your ISP to the VPN company. That is an improvement if the VPN is reputable and the ISP is not. It is a lateral move if both are equally untrustworthy. VPNs also do not protect against malware, phishing, or tracking cookies. They encrypt the tunnel, not the content. Corporate VPNs serve a different purpose. They give remote employees access to internal resources. The traffic is encrypted and the user is authenticated. That is remote access, not privacy. The two use cases get conflated. They are not the same.

VPN use cases

• Public Wi-Fi — encrypt traffic on untrusted networks
• Remote work — access corporate resources securely
• Privacy — hide browsing from ISP
• Geo-unblocking — access content restricted by region
• Censorship circumvention — bypass government blocks

A VPN is a tunnel. What goes through it and who controls the ends determines whether it helps or hurts.