A VPN — virtual private network — creates an encrypted tunnel between your device and a server run by the VPN provider. Everything you send goes into that tunnel before it touches the network you are connected to.
What it hides
- From the network you are on (café Wi-Fi, hotel, your provider): which sites you visit and what you send them.
- From the sites you visit: your real IP address, and therefore your rough location and your provider's identity.
- From anyone watching the local network: your DNS lookups, because they travel inside the tunnel too.
What it does not hide
- Anything you type into a service while signed in. If you log in to an account, that account knows it is you.
- Cookies, browser fingerprints and trackers already on your device.
- Malware. A VPN encrypts traffic; it is not antivirus.
Why the provider matters more than the technology
Once you use a VPN you have moved your trust from your internet provider to your VPN provider. That is why the logging policy matters more than any feature list: a provider that keeps records of what you connect to has simply relocated the problem.