What is a VPN and how does it work? A plain-English guide

A VPN is an encrypted tunnel between your device and a server on the internet. Everything you send and receive travels through that tunnel first and only then goes out to the wider web. From the outside, the tunnel looks like a stream of meaningless bytes: your internet provider, the owner of the café Wi-Fi or someone on the same network cannot see which sites you open or what you send.

VPN stands for Virtual Private Network. Such networks were originally built for companies, so employees at home could reach the office network as if they were sitting at their desks. Today a VPN is a mass-market product used by hundreds of millions of people — mostly not to reach an office, but for privacy and a more reliable internet.

How a VPN works: the path of one request

Say you open a website. Without a VPN the request goes like this:

1. Your phone sends the request to your home router or your carrier’s cell tower.
2. Your provider passes it through its equipment and sees where it is going.
3. The request reaches the website and the response comes back the same way.

With a VPN there is one more stop:

1. The VPN app encrypts the request on your device.
2. The encrypted packet goes to your provider, which only sees that you are talking to a VPN server — not which site or what is inside.
3. The VPN server decrypts the request and sends it to the website on your behalf.
4. The website’s response returns to the VPN server, is encrypted and delivered to you.

To the website you look like a visitor with the VPN server’s IP address. To your provider you look like someone exchanging encrypted data with one server all day.

What your provider sees with and without a VPN

Note the volume row: a VPN does not make you invisible. Your provider knows you are online and how much data you use — it just does not know where it goes.

Why people use a VPN in 2026

Safety on public Wi-Fi

Networks in cafés, airports, hotels and malls are the weakest link. Dozens of strangers share them, and the owner of the hotspot can see which sites visitors open. A classic attack is a fake hotspot with a convincing name like “Airport_Free_WiFi”: you connect, and all your traffic flows through the attacker’s laptop. With a VPN they only see an encrypted stream. We list practical public Wi-Fi habits in our guide How to choose a VPN.

Privacy from your provider and ad trackers

ISPs and carriers can technically collect the list of domains you visit. With a VPN that list is empty for them. Websites also see the server’s address instead of your home IP, which makes it harder to link your visits and pinpoint your location.

Reliable access to the services you use

Many people turn on a VPN when a site or app works badly on their network: pages do not load, video buffers, calls drop. The reasons range from congested routes to deliberate restrictions — see YouTube, Instagram and WhatsApp blocked in Russia. If the route through the VPN server is clear, everything works normally.

Travel

Abroad, banking apps and streaming services sometimes refuse foreign IP addresses, and hotel Wi-Fi may block the ports you need. A VPN server in a convenient country solves both.

Remote work

Companies still use VPNs to reach internal systems. That is a separate class of product set up by your IT team, and it can run alongside a personal VPN.

What a VPN cannot do

An honest list of what a VPN does not protect you from:

• Viruses and phishing. If you download an infected file or type your password into a fake site, a VPN will not help.
• Tracking inside your accounts. Once you are logged in to a social network or email, the service sees everything you do there.
• Browser fingerprinting. Sites can recognize you by cookies and your browser “fingerprint”: fonts, screen size, OS version.
• The VPN provider itself. The VPN server can technically see which domains you connect to. Choosing a VPN is a matter of trust — and free VPNs are especially risky: see Free VPNs: the hidden risks.
• The law. A VPN is an encryption tool, not a permission slip. For Russia specifically, see Is it legal to use a VPN in Russia?

VPN protocols in one minute

A protocol is the “language” the app uses to talk to the server: how the connection starts, how data is encrypted and what the traffic looks like from outside.

• OpenVPN — old and dependable, but fairly slow and easy to recognize.
• WireGuard — fast and modern, but it also has a recognizable signature, so it is unstable on heavily filtered networks.
• IKEv2 / IPsec — built into iPhone and Mac, handles switching between Wi-Fi and mobile data well.
• VLESS (with Reality or XTLS) — one of the most modern options: the traffic looks like an ordinary HTTPS connection to a website. Klen VPN runs on it. Details in VLESS and Reality explained.

For most people the choice comes down to one thing: does the VPN work reliably on your network? Modern protocols like VLESS win exactly there.

How to start using a VPN

The flow is similar everywhere; with Klen VPN it takes about a minute:

1. Choose a plan and pay.
2. Install a free client app such as Happ — available for iPhone, Android, Windows, macOS and Linux.
3. Add your key (subscription link) to the app, usually with one tap.
4. Tap “Connect”.

Step-by-step guides: iPhone and iPad, Android, Windows and macOS. If something does not work, see VPN not connecting: causes and fixes.

Summary

• A VPN encrypts the connection between your device and a server: your ISP and Wi-Fi owners cannot see which sites you visit.
• Websites see the VPN server’s IP address instead of yours.
• A VPN protects you on public networks, improves privacy and helps when services work poorly on your network.
• It does not protect against viruses, phishing or tracking inside your accounts.
• When choosing a service, what matters most is trust, a protocol that works on your network and a clear refund policy.