What Is a VPN and Do You Need One?

I was sitting in Sydney Airport last year, connected to the free WiFi, about to log into my bank account when I stopped myself. Public WiFi. Hundreds of people on the same network. Anyone with the right tools could potentially see unencrypted traffic. I switched on my VPN, logged in, did what I needed to do, and disconnected. That's the kind of situation where a VPN genuinely earns its keep.

But here's the thing, VPN marketing would have you believe you need one running 24/7 or hackers will steal everything you own. That's rubbish. This guide will give you an honest, hype-free explanation of what a VPN actually does, when it's genuinely useful, and when it's not worth the money.

What a VPN Is (In Plain English)

VPN stands for Virtual Private Network. In simple terms, a VPN creates a private, encrypted tunnel between your device and the internet. When you use a VPN, your internet traffic is routed through a server run by the VPN company before reaching its destination.

Here's an analogy. Normally, when you visit a website, it's like sending a postcard, your internet provider (and anyone on the same network) can see where you're going and what you're sending. A VPN puts that postcard inside a sealed, opaque envelope. Your internet provider can see you're sending an envelope to the VPN company, but they can't see what's inside or where it's ultimately going.

A VPN does two main things. First, it encrypts your internet traffic so people on the same network can't eavesdrop on it. Second, it hides your real IP address and location by replacing them with the VPN server's IP address and location.

How a VPN Works

When you connect to a VPN, here's what happens behind the scenes:

Your device establishes an encrypted connection to a VPN server. This server could be in your country or anywhere in the world, you typically choose the location. All your internet traffic is routed through this encrypted tunnel to the VPN server. The VPN server decrypts your traffic and forwards it to the intended destination (the website or service you're visiting). The website sees the VPN server's IP address, not yours. When the website sends data back, it goes to the VPN server first, which encrypts it and sends it back to you through the tunnel.

The encryption used by modern VPNs (typically AES-256) is essentially unbreakable with current technology. Even if someone intercepted your encrypted traffic, it would take millions of years to decrypt it.

When a VPN Is Actually Useful

Despite the marketing hype, VPNs have genuine use cases where they provide real security and privacy benefits:

Public Wi-Fi networks. This is the strongest case for a VPN. When you connect to Wi-Fi at a coffee shop, airport, hotel, or library, other people on that network could potentially intercept your unencrypted traffic. A VPN encrypts everything, making it safe to use even on untrusted networks. If you regularly work from cafes or travel frequently, a VPN is worth having for this reason alone.

Preventing ISP tracking. Your internet service provider, Telstra, Optus, TPG, whoever you're with, can see every website you visit. Under Australian data retention laws, ISPs are required to store your metadata for two years. A VPN prevents your ISP from seeing which websites you visit, they only see that you're connected to a VPN server. I cannot stress this enough, the fact that VPN companies spend millions on YouTube sponsorships telling you a VPN makes you "invisible online" while conveniently ignoring that they can see your traffic instead, and that cookies, browser fingerprinting, and account logins still track you regardless, is some of the most dishonest marketing in the entire tech industry.

Accessing content while traveling. If you're traveling abroad and want to access services from your home country (like your streaming subscriptions or banking apps), a VPN can make it appear as if you're browsing from home by connecting to a server in your home country.

Privacy from network administrators. If you're on a school, university, or workplace network, the network administrator can potentially monitor your traffic. A VPN encrypts your activity so they can only see that you're using a VPN, not what you're doing.

Avoiding censorship. In countries with internet censorship, VPNs can help access blocked websites and services. This is a critical tool for journalists, activists, and ordinary citizens in restrictive environments.

When You Don't Need a VPN

VPN companies have a financial incentive to make you think you need a VPN at all times. Let's be honest about the situations where a VPN doesn't help much:

General browsing at home. Your home Wi-Fi is already encrypted (WPA2 or WPA3). The vast majority of websites use HTTPS, which encrypts data between your browser and the website. For everyday home browsing, a VPN adds minimal security benefit.

Protection from "hackers." VPN ads often show scary imagery of hackers stealing your data. In reality, VPNs don't protect against the most common threats: phishing emails, malware, weak passwords, or social engineering. If you click a malicious link, a VPN won't save you. For these threats, you need different tools, like a good password manager, two-factor authentication, and a URL checker like ScanTotal.

Complete anonymity. A VPN hides your IP address, but websites can still identify you through cookies, browser fingerprinting, account logins, and other tracking methods. If you log into your Google account while using a VPN, Google still knows it's you. A VPN is one privacy layer, not an invisibility cloak.

Protection from the VPN company itself. When you use a VPN, you're shifting trust from your ISP to your VPN provider. The VPN provider could theoretically log your traffic instead. This is why choosing a reputable VPN with a verified no-logs policy is important, you're trusting them with the same data you're hiding from your ISP.

What a VPN Does NOT Protect Against

This is worth repeating, because VPN marketing is often misleading:

A VPN does not protect against phishing attacks. If you click a phishing link and enter your password on a fake website, the VPN doesn't help, the data went exactly where the attacker wanted it to go, just through an encrypted tunnel.

A VPN does not protect against malware. If you download a malicious file, the VPN won't detect or block it. You need antivirus software and file scanning tools for that.

A VPN does not protect against weak passwords or data breaches. If a service you use gets breached, your password is exposed regardless of whether you use a VPN.

A VPN does not make you untraceable. Law enforcement can still identify VPN users through various methods, and many VPN providers comply with legal requests.

Choosing a VPN: What to Look For

If you've decided a VPN is right for you, here's what to look for in a provider:

No-logs policy. The VPN provider should not keep records of your browsing activity. Look for providers that have had their no-logs claims verified by independent audits. NordVPN, ExpressVPN, Proton VPN, and Mullvad have all undergone third-party audits.

Strong encryption. Look for AES-256 encryption and modern protocols like WireGuard or OpenVPN. Avoid providers that use outdated protocols like PPTP.

Kill switch. A kill switch cuts your internet connection if the VPN drops, preventing your traffic from being exposed. This is essential.

Speed. Good VPNs have fast servers that minimize speed impact. Look for providers with servers in many countries and a large server network.

Avoid free VPNs (mostly). Running VPN servers costs money. Free VPNs typically make money by logging and selling your data, injecting ads, or providing weak security, defeating the entire purpose. The exception is the free tier of reputable paid providers like Proton VPN, which is funded by their paying users.

Frequently Asked Questions

What I Actually Use It For

I use a VPN for exactly three things: public WiFi like airports and cafes, preventing my ISP from logging which sites I visit, and occasionally accessing my Australian streaming services when I'm overseas. That's it. I don't run it at home for everyday browsing because my home WiFi is already encrypted and every site I use regularly runs HTTPS. A VPN won't protect you from phishing, it won't stop malware, and it definitely won't make you invisible. Good passwords, two-factor authentication, and not clicking dodgy links will do far more for your security than any VPN subscription ever will. Use one when it makes sense, but don't let it give you a false sense of invincibility.