A VPN creates an encrypted connection between your device and an intermediary server. In short: your device ← encrypted tunnel ← VPN server ← the internet.
Without a VPN, your connection goes directly from your local network and ISP to the destination website. Although HTTPS encrypts the content exchanged with the site, your ISP or local network operator can still see connection metadata, such as the destination IP address.
A VPN changes this routing by adding an extra encryption layer and directing your traffic through an intermediary server. For the basics, see our companion guide, What Is a VPN?
This process happens automatically, in moments, handled by the software.
The VPN client performs a handshake with the destination server and exchanges encryption keys.
Before leaving your device, network packets are encrypted according to the active protocol.
Encrypted data passes through your local network. Your ISP sees the connection to the VPN, not its content.
The VPN server decrypts the data and forwards it to the destination website on your behalf.
The response travels back through the same encrypted tunnel and is displayed on your device.
One of the most common misunderstandings is treating VPN encryption and website (HTTPS) encryption as the same thing.
Puts your covered traffic inside an encrypted tunnel as far as the VPN server; this layer generally covers your ISP and local network.
Encrypts the connection between your browser and the destination website; keeps passwords and form content hidden from any intermediary, including the VPN server.
A realistic understanding of security tools prevents false confidence. A VPN generally does not:
When you're connected to a VPN, no single party has access to everything. The destination website sees the VPN server's IP instead of your real one. Your ISP can tell you're connected to a VPN server and can see the overall volume and timing of your traffic, but it generally can't tell exactly which sites you're visiting or what content is being exchanged, since that's inside the encrypted tunnel. DNS requests, in a correct configuration, pass through that same tunnel.
The VPN server itself generally sees your device's real IP; but if you're connecting to HTTPS sites, TLS encryption means it generally can't read page content, form data, or passwords.
Both change your IP, but a VPN typically covers the whole system and encrypts the path, while a proxy often covers just one app (like a browser) and its encryption depends on the proxy type. For a closer look, see our guide on VPN vs. Proxy.
WireGuard is a modern, lightweight, fast protocol using modern cryptography. Xray/V2Ray is a communication platform supporting a variety of transport methods. REALITY is a technology within the Xray ecosystem designed for traffic-camouflage characteristics, architecturally distinct from a VPN protocol like WireGuard. Read a closer comparison in WireGuard vs. V2Ray.
If a kill switch is enabled, the VPN software typically tries to immediately cut off internet traffic. If it's disabled or unavailable, your traffic may fall back to a normal connection and your real IP may become visible; the exact behavior depends on the client and OS. See our guide on why a VPN won't connect.
"The VPN server can see all my passwords."
RealityOn HTTPS sites, TLS encryption remains in place inside the tunnel too; the VPN server generally can't read form content or passwords.
"All connection protocols perform the same."
RealityWireGuard focuses on speed, while Xray/REALITY are designed for traffic camouflage.
"A VPN always forcibly encrypts all traffic."
RealitySplit tunneling can exclude certain apps from VPN coverage.
Yes — destination websites see the VPN server's IP address as the connection's source, instead of the IP assigned by your ISP.
Yes. Your ISP can see that your device is exchanging data with a VPN server's IP, but generally cannot read the content inside the tunnel; the timing and overall pattern of your traffic can still be visible.
In full-tunnel mode, yes, unless an app has been excluded via split tunneling.
A VPN typically adds a small amount of latency. The exact impact depends on the protocol, server distance, network route, and connection quality.
In a correct configuration without a DNS leak, DNS requests can pass through the tunnel and be resolved by the DNS configured for that connection.