What is a VPN? Definition + how it works + WireGuard vs OpenVPN + 2026 best VPNs

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a VPN server, protecting your internet traffic from being intercepted and masking your IP address from the websites you visit. When you connect to a VPN, all your internet traffic is encrypted before it leaves your device, routed through the VPN server, and decrypted at the other end. The VPN server's IP address is what websites see — not your real IP. This protects you from: (1) eavesdropping on public Wi-Fi (coffee shops, airports, hotels), (2) ISP tracking and throttling, (3) geo-restrictions (Netflix region libraries, etc.), and (4) basic IP-based tracking by advertisers. Modern VPNs use the WireGuard protocol (default for most providers since 2023) which is ~3x faster and 10x simpler than OpenVPN.

VPNs are one tool in a privacy stack — they don't make you anonymous. The VPN provider can see your traffic (so choose one that doesn't log), and you're still vulnerable to phishing, malware, and account-based tracking. For full anonymity, layer VPN + Tor + privacy-focused browser. For most users, a reputable paid VPN (Mullvad, ProtonVPN, NordVPN) on a trusted device with HTTPS everywhere is sufficient.

What is a VPN in simple terms?

A VPN is a secure, encrypted connection between your device and the internet. Think of it as a private tunnel through the public internet:

Without VPN	With VPN
Your ISP can see every website you visit	Your ISP sees only encrypted traffic to a VPN server
Public Wi-Fi attackers can intercept your data	Public Wi-Fi attackers see only encrypted data
Websites see your real IP address	Websites see the VPN server's IP address
Throttling based on activity (streaming, torrenting)	Activity hidden from ISP — no throttling

The "virtual" in VPN means there's no physical cable — the encrypted tunnel is software-defined, running over the regular internet. The "private" means the connection is encrypted and authenticated.

How does a VPN work? (5-step process)

The 5-step process when you connect to a VPN:

1. VPN client authentication — your VPN app and the VPN server exchange cryptographic keys (handshake). WireGuard uses Curve25519 for key exchange, OpenVPN uses RSA/ECDSA.
2. Encryption — your internet traffic is encrypted using ChaCha20 (WireGuard) or AES-256 (OpenVPN/IPsec) before leaving your device. Without this step, your traffic would be plaintext.
3. Tunneling — encrypted traffic is encapsulated inside another packet (using UDP for WireGuard, TCP/UDP for OpenVPN) and sent through the internet to the VPN server.
4. Decryption — the VPN server receives your encrypted traffic, decrypts it, and forwards your request to the destination (e.g., google.com). The destination sees the request coming from the VPN server's IP, not yours.
5. Return path — the destination's response travels back through the same encrypted tunnel to your device.

The whole process adds 5-30ms of latency (more if the VPN server is far away) and typically reduces download speed by 5-30% on a fast VPN (more on a slow one).

What is WireGuard vs OpenVPN vs IPsec?

WireGuard is the modern default (since 2023). OpenVPN is the legacy. IPsec is enterprise-grade. Comparison:

Feature	WireGuard	OpenVPN	IPsec/IKEv2
Codebase size	~4,000 lines	~100,000+ lines	Large, complex
Speed	Fastest (kernel-level)	Moderate	Fast
Encryption	Fixed (ChaCha20, Curve25519)	Configurable (AES-256, etc.)	Configurable (AES-256, etc.)
Mobile battery	Excellent (efficient)	Poor (battery drain)	Good
Setup complexity	Simple (5 min)	Moderate	Complex
Auditability	Easy (small codebase)	Difficult	Difficult
Best for	Most users (2026 default)	Legacy compatibility	Enterprise site-to-site
Used by	Mullvad, NordVPN, Proton, Mozilla	Older providers, custom setups	Cisco, corporate VPNs

For most users, WireGuard is the right choice in 2026 — faster, simpler, more battery-efficient, and easier to audit. Most major providers have switched to WireGuard as default. Use OpenVPN only if WireGuard is blocked (some restrictive networks block UDP). Use IPsec only for enterprise site-to-site scenarios.

What are the 5 best VPN providers in 2026?

The 5 best VPN providers in 2026 (ranked by privacy, speed, audit history, jurisdiction):

Provider	Price/mo	Jurisdiction	Audited	WireGuard	Best for
Mullvad VPN	€5 flat	Sweden	Yes (2024 Cure53)	Yes	Privacy purists, flat pricing
ProtonVPN	$4-10	Switzerland	Yes (Securitum 2024)	Yes	Privacy + free tier
NordVPN	$3-12	Panama	Yes (Deloitte 2024)	Yes	Feature-rich, fast
ExpressVPN	$6-13	British Virgin Islands	Yes (Cure53 2025)	Yes	Streaming, reliability
Surfshark	$2-10	Netherlands	Yes (Deloitte 2024)	Yes	Budget, unlimited devices

Top recommendations by use case:

• Privacy purist: Mullvad (€5/mo flat, anonymous payment via cash or crypto, no email required)
• Free VPN: ProtonVPN (only reputable free tier, based in Switzerland)
• Streaming: ExpressVPN (unblocks Netflix, Disney+, BBC iPlayer across 94 countries)
• Budget: Surfshark ($2/mo on 2-year plans, unlimited devices)
• All-around: NordVPN ($3/mo on 2-year plans, 6,000+ servers, Threat Protection)

Avoid: most "free VPNs" — they monetize by selling your data, injecting ads, or using your device as a botnet node. The exceptions are ProtonVPN Free, Windscribe Free (10GB/mo), and Cloudflare WARP (1.1.1.1).

Do I need a VPN in 2026?

It depends on your threat model. Most users benefit from a VPN; not all users need one.

You should use a VPN if...	You probably don't need a VPN if...
You use public Wi-Fi (coffee shops, airports, hotels)	You only use trusted home Wi-Fi
You want to hide browsing from your ISP	You're not concerned about ISP tracking
You want to access geo-restricted content	You don't travel or use streaming
You want to prevent IP-based ad tracking	You're fine with targeted ads
You work remotely and need to access corporate networks	You don't need to bypass any restrictions
You live in / travel to countries with internet censorship	You live in a country with open internet

For most users, a VPN is a reasonable privacy upgrade but not essential. HTTPS already protects most browsing from eavesdropping. ISPs can still see the domains you visit (via DNS), but not the content. A VPN adds protection against Wi-Fi eavesdropping and IP-based tracking, but it doesn't make you anonymous — for that, you need Tor or a layered approach.

What does a VPN NOT protect you from?

A VPN is NOT a complete privacy solution. Common misconceptions:

• ❌ A VPN does NOT protect you from phishing — if you enter your password on a fake site, the VPN doesn't help
• ❌ A VPN does NOT protect you from malware — if you download a malicious file, the VPN doesn't help (use antivirus)
• ❌ A VPN does NOT make you anonymous to the websites you log into — Google still knows it's you when you log in
• ❌ A VPN does NOT protect you from your VPN provider — if the VPN logs, your privacy depends on the provider's honesty
• ❌ A VPN does NOT bypass account-based tracking — Facebook/Google track via login cookies, not just IP
• ❌ A VPN does NOT prevent browser fingerprinting — canvas fingerprinting, font enumeration still work

For full privacy, layer a VPN with: privacy browser (Firefox with uBlock Origin + Privacy Badger), password manager (1Password, Bitwarden), 2FA on all accounts, and Tor Browser for sensitive browsing.

Are free VPNs safe?

Most free VPNs are NOT safe — they monetize by selling your data, injecting ads, or stealing bandwidth. A 2017 CSIRO study found that 38% of free Android VPNs contained malware, and 84% leaked user traffic. In 2026, the situation is better but still risky.

Free VPNs to AVOID:

• Any "100% free" VPN with no paid tier (no revenue model = selling data)
• VPNs based in 14-Eyes countries with poor privacy laws
• VPNs that require excessive permissions
• VPNs with no published privacy policy or audit

Free VPNs that ARE safe:

• ProtonVPN Free — Swiss-based, audited, ad-free, unlimited bandwidth (but slower than paid)
• Windscribe Free — 10 GB/month, Canada-based, audited
• Cloudflare WARP (1.1.1.1) — US-based, ad-free, doesn't sell data
• Hotspot Shield Basic — limited free tier

Rule of thumb: if a VPN is free, you are the product. Either pay for a reputable provider or use one of the safe free options above.

How do I set up a VPN on my iPhone / Mac?

Setting up a VPN on iPhone (iOS 27) or Mac (macOS 27):

Option 1: Provider app (recommended)

1. Subscribe to a VPN provider (Mullvad, ProtonVPN, NordVPN, etc.)
2. Download their app from the App Store
3. Log in with your credentials
4. Tap "Connect" — the app configures the VPN profile automatically
5. iOS shows a "VPN" indicator in the status bar when connected

Option 2: Manual WireGuard setup

1. Download the WireGuard app from the App Store (free)
2. Get your WireGuard config file from your VPN provider
3. Import the config (QR code or file)
4. Toggle the switch to connect

Option 3: IKEv2 / IPsec manual setup

1. Settings → General → VPN → Add VPN Configuration
2. Enter server, remote ID, username/password from your provider
3. Toggle the switch to connect

Performance tips:

• Choose a server geographically close to you for best speed
• Use WireGuard (not OpenVPN) for best battery life on mobile
• Connect automatically on untrusted Wi-Fi (most providers have this setting)

Is using a VPN legal?

VPNs are legal in most countries but restricted or banned in some:

Status	Countries
Legal	US, UK, EU, Canada, Australia, Japan, most of Asia, Latin America
Restricted	China (only government-approved VPNs), Russia (Roskomnadzor-approved), UAE (only for legitimate purposes), Turkey (some blocks), Iran
Banned	Belarus, Iraq, North Korea, Turkmenistan

In the US, using a VPN is fully legal for any legitimate purpose (privacy, security, streaming). Illegal activities remain illegal even with a VPN. Using a VPN to commit fraud, hack, or distribute malware is still a crime.

What is the bottom line on VPNs?

A VPN creates an encrypted tunnel that protects your internet traffic from eavesdropping and masks your IP address. Most users benefit from a reputable paid provider using WireGuard. The top 2026 picks: Mullvad (privacy), ProtonVPN (free + paid), NordVPN (all-around), ExpressVPN (streaming). VPNs don't make you anonymous — they protect against Wi-Fi eavesdropping and IP tracking. For full privacy, layer VPN + privacy browser + password manager + 2FA.

For related privacy topics, see our What is 2FA? page (MFA is more important than VPN for account security), What is phishing? page (VPN doesn't protect against phishing), What is malware? page (VPN doesn't protect against malware), and What is identity theft? page (VPN helps reduce attack surface).