What is a VPN?

A VPN (virtual private network) creates a private, encrypted channel on top of a public network. It was originally built so that employees could reach a company network safely from outside; today it is more commonly used to protect a personal device on networks you do not control. This article explains, with as little jargon as possible, how a VPN works, which problems it is good at and which ones it cannot solve.

The one-sentence definition

A VPN establishes an encrypted tunnel between your device and a remote server, usually called a node. Traffic routed through that tunnel is encrypted between the device and node, then forwarded to its destination. Your local network can still see that you are connected to a VPN, along with timing and traffic volume. Protection depends on the active VPN configuration; traffic or DNS requests that bypass the tunnel are not covered by it.

How the tunnel works

Handshake and key agreement. The device and the node verify each other and agree on a session key known only to the two of them. With WireGuard, identity is a public/private key pair: the private key stays on the device, and the node holds only the public key.
Encapsulation and encryption. Each packet the device sends is encrypted and wrapped inside a new outer packet addressed to the node. The original content, destination address and port are all inside the encrypted payload.
Egress at the node. The node decrypts the packet and sends the original one to the destination server from its own address. The destination therefore sees the node's address, not yours.
The return path. Replies reach the node first, are encrypted, travel back through the tunnel and are decrypted on the device for the app that asked.

The whole process is transparent to applications: browsers, games and messaging apps need no changes at all.

What a VPN can do

Protect your data on public Wi-Fi. Other devices on an open network, and the hotspot itself, can eavesdrop on or tamper with traffic. With a tunnel, the local network sees only encrypted data. See Staying safe on public Wi-Fi.
Limit what the local network can observe. Routing traffic and DNS through the encrypted tunnel helps conceal destinations from the local network. HTTPS remains important for the connection from the VPN node to the website.
Provide a stable cross-border route. Remote work, remote access and real-time applications often suffer from congested paths between carriers. A well-run node forwards over steadier routes with less jitter and packet loss.
Provide a predictable egress address. In business settings a dedicated egress IP makes it easy to allow-list access to internal systems or exchange APIs.

What a VPN cannot do

It is not an anonymity tool. A VPN changes only the network-layer source address. The accounts you sign in to, your browser fingerprint, cookies and payment details still identify you. Claims that a VPN makes you invisible are inaccurate.
It does not replace antivirus software or good judgement. A tunnel protects the confidentiality and integrity of data in transit; it cannot recognise phishing pages, malicious attachments or a device that is already compromised. Malware downloaded through a tunnel is still malware.
It cannot promise lower latency. A VPN changes the route. A less congested route may help, while a distant node or extra hops may slow it down. Compare the connection on your own network.
It does not replace HTTPS. The tunnel covers only the leg from your device to the node; from the node to the destination, data travels in whatever form the application uses. Keep using HTTPS and pay attention to certificate warnings.
It does not make unlawful activity lawful. Using a VPN never exempts you from local law or from the terms of the services you use.

Trust moves from the local network to the provider

With a VPN, the local network no longer sees your traffic, but the operator of the node is in a position to see traffic metadata. Choosing a VPN service is therefore choosing someone more trustworthy than the public network. Questions worth asking: does the provider state precisely what it records and what it does not; are those promises only in a policy document, or also enforced in the data model and the engineering process; are keys generated on the device; are retention periods and the status of independent audits published. TP VPN's answers are in the Trust Center and the Privacy Policy.

Common misconceptions

Misconception	Reality
With a VPN nobody can identify me	Accounts, cookies and device fingerprints still identify you; a VPN only changes the network source address
With a VPN I no longer need HTTPS	The tunnel ends at the node; beyond it you still rely on HTTPS
A VPN always makes the connection slower	Encryption overhead is small; speed depends mostly on the node's route and distance, and a tunnel is sometimes steadier than a congested direct path
More protocols means more security	The number of protocols says nothing about security; one widely audited modern protocol is usually easier to reason about than several older ones side by side
Free and paid services are the same	Bandwidth and operations cost money; check how a provider funds itself and what data it keeps

What to check when choosing a service

Protocol. Prefer a protocol built on modern cryptography with a small, audited codebase, such as WireGuard; see Understanding the WireGuard protocol.
Logging posture. The provider should list item by item what it records and for how long, rather than offering an absolute slogan.
Key ownership. Private keys should be generated on the device and stored only in its secure storage.
Transparent limits. Device limits, fair-use thresholds and refund rules should be stated up front.
Verifiable operations. Node health and past incidents should be public.

How TP VPN approaches this

TP VPN uses WireGuard, with keys generated on the device. Our logging policy excludes browsing activity, DNS queries and tunnel destinations. Device limits and fair-use thresholds are published for each plan. Prices, periods and any eligible offers follow the purchase confirmation. Check the download page for currently available platforms.