What is a VPN
How a VPN's encrypted tunnel works, what it can and cannot do (not an anonymity tool or antivirus), common misconceptions and what to check in a provider.
Updated 2026-09-01 · About 5 min
A VPN (virtual private network) creates a private, encrypted channel on top of a public network. It was originally built so that employees could reach a company network safely from outside; today it is more commonly used to protect a personal device on networks you do not control. This article explains, with as little jargon as possible, how a VPN works, which problems it is good at and which ones it cannot solve.
The one-sentence definition
A VPN establishes an encrypted tunnel between your device and a remote server, usually called a node. Everything your device sends is encrypted first, travels to the node, is decrypted there and forwarded to its real destination; replies come back the same way. To every network along the path (the cafe router, your carrier, any hop in between) there is only a stream of encrypted traffic heading to the node. Nobody on that path can see the content or the sites you are using.
How the tunnel works
- Handshake and key agreement. The device and the node verify each other and agree on a session key known only to the two of them. With WireGuard, identity is a public/private key pair: the private key stays on the device, and the node holds only the public key.
- Encapsulation and encryption. Each packet the device sends is encrypted and wrapped inside a new outer packet addressed to the node. The original content, destination address and port are all inside the encrypted payload.
- Egress at the node. The node decrypts the packet and sends the original one to the destination server from its own address. The destination therefore sees the node's address, not yours.
- The return path. Replies reach the node first, are encrypted, travel back through the tunnel and are decrypted on the device for the app that asked.
The whole process is transparent to applications: browsers, games and messaging apps need no changes at all.
What a VPN can do
- Protect your data on public Wi-Fi. Other devices on an open network, and the hotspot itself, can eavesdrop on or tamper with traffic. With a tunnel, the local network sees only encrypted data. See Staying safe on public Wi-Fi.
- Hide destinations from the local network. Even with HTTPS, DNS lookups and the hostname in the TLS handshake are visible locally; through a tunnel they are visible only at the node.
- Provide a stable cross-border route. Remote work, remote access and real-time applications often suffer from congested paths between carriers. A well-run node forwards over steadier routes with less jitter and packet loss.
- Provide a predictable egress address. In business settings a dedicated egress IP makes it easy to allow-list access to internal systems or exchange APIs.
What a VPN cannot do
- It is not an anonymity tool. A VPN changes only the network-layer source address. The accounts you sign in to, your browser fingerprint, cookies and payment details still identify you. Claims that a VPN makes you invisible are inaccurate.
- It does not replace antivirus software or good judgement. A tunnel protects the confidentiality and integrity of data in transit; it cannot recognise phishing pages, malicious attachments or a device that is already compromised. Malware downloaded through a tunnel is still malware.
- It cannot beat physics. Traffic passes through a node, so the path is never shorter than a direct connection. A VPN can improve the stability and congestion of a path, not the time light takes to travel through fibre.
- It does not replace HTTPS. The tunnel covers only the leg from your device to the node; from the node to the destination, data travels in whatever form the application uses. Keep using HTTPS and pay attention to certificate warnings.
- It does not make unlawful activity lawful. Using a VPN never exempts you from local law or from the terms of the services you use.
Trust moves from the local network to the provider
With a VPN, the local network no longer sees your traffic, but the operator of the node is in a position to see traffic metadata. Choosing a VPN service is therefore choosing someone more trustworthy than the public network. Questions worth asking: does the provider state precisely what it records and what it does not; are those promises only in a policy document, or also enforced in the data model and the engineering process; are keys generated on the device; are retention periods and the status of independent audits published. TP VPN's answers are in the Trust Center and the Privacy Policy.
Common misconceptions
| Misconception | Reality |
|---|---|
| With a VPN nobody can identify me | Accounts, cookies and device fingerprints still identify you; a VPN only changes the network source address |
| With a VPN I no longer need HTTPS | The tunnel ends at the node; beyond it you still rely on HTTPS |
| A VPN always makes the connection slower | Encryption overhead is small; speed depends mostly on the node's route and distance, and a tunnel is sometimes steadier than a congested direct path |
| More protocols means more security | The number of protocols says nothing about security; one widely audited modern protocol is usually easier to reason about than several older ones side by side |
| Free and paid services are the same | Bandwidth and operations cost money; check how a provider funds itself and what data it keeps |
What to check when choosing a service
- Protocol. Prefer a protocol built on modern cryptography with a small, audited codebase, such as WireGuard; see Understanding the WireGuard protocol.
- Logging posture. The provider should list item by item what it records and for how long, rather than offering an absolute slogan.
- Key ownership. Private keys should be generated on the device and stored only in its secure storage.
- Transparent limits. Device limits, fair-use thresholds and refund rules should be stated up front.
- Verifiable operations. Node health and past incidents should be public.
How TP VPN approaches this
The TP VPN apps for iOS and Android use WireGuard only. Key pairs are generated on the device and the private key never leaves it. We do not record browsing content, DNS queries or destination addresses; those fields do not exist in our database schema, and the build pipeline asserts it. Device limits and fair-use thresholds are published for every plan. Eligible new subscribers can use the 3-day trial to verify connection quality on their own network before the selected plan is charged.