VPNs Explained — and How to Tell If Yours Is Working
A VPN wraps your internet traffic in an encrypted tunnel to a server elsewhere, so websites see that server's address instead of yours. That one trick explains everything a VPN can do — and everything it cannot. Here is the honest version, including what changes in an era of AI-driven tracking, and how to test your own connection in one tap.
How a VPN works, in one diagram
Consequences fall straight out of the picture: your ISP can no longer read your destinations (it sees one encrypted stream); websites see the exit server's IP and location, not yours; and the VPN provider now occupies the position your ISP used to hold — it could see everything your ISP could. A VPN does not make you anonymous; it moves your trust from one company to another.
The technical terms, translated
- Tunnel / tunneling protocol: the encrypted wrapper. Modern choices: WireGuard (lean, fast, current favourite) and OpenVPN (older, battle-tested). Avoid PPTP — broken since the 2000s.
- Exit server / endpoint: where your traffic re-enters the open internet — the location websites think you are.
- Kill switch: blocks all traffic if the tunnel drops, so nothing leaks over the naked connection during reconnects.
- DNS leak: your device asks your ISP's DNS “where is example.com” outside the tunnel — the ISP still learns every site you visit. Good clients force DNS through the tunnel.
- WebRTC leak: browsers' real-time-call machinery can reveal your true IP to a website even mid-VPN; test it if it matters to you.
- Split tunneling: only chosen apps use the VPN — convenient, and a classic source of “why is my banking app blocked but my browser is in Amsterdam” confusion.
- No-log policy: a promise, not a property. Only independent audits and court-tested history make it credible.
- Double VPN / multi-hop: two chained servers; more latency, marginal privacy gain for most people.
Is a VPN always safe? No — here is the honest list
- “Free” VPNs are the product: running servers costs money; several free providers have been caught selling browsing data or injecting ads — the exact harm a VPN supposedly prevents. Free tiers of audited paid providers are the exception that proves the rule.
- The provider sees your traffic metadata. A dishonest or compelled provider is a single point of failure. Jurisdiction and audit history matter more than marketing.
- HTTPS already encrypts content. The padlock means your bank login is encrypted with or without a VPN; the VPN adds who-you-are/where-you-are privacy, not extra content encryption.
- A VPN does not stop tracking that follows your identity: log into your account and the site knows you regardless of IP. Cookies and browser fingerprinting (screen size, fonts, GPU quirks) survive the tunnel completely.
- Malware, phishing and scams work fine over VPNs. It is a privacy tool, not an antivirus.
What changes in the AI era
Two things, pulling in opposite directions. First, tracking has moved up the stack: modern profiling leans on fingerprinting, cross-site identity graphs, and AI models that re-identify users from behaviour patterns — typing rhythm, mouse curves, session timing — none of which an IP-hiding tunnel touches. The industry's own shift from IP-based to model-based attribution quietly admits the VPN-shaped hole in their data was survivable. Second, AI has raised the value of every scrap of traffic metadata, which makes your choice of VPN provider weightier: you are handing a complete traffic log to one company at exactly the moment such logs became premium training and profiling fuel. The 2026-era conclusion: a reputable, audited VPN is still the right tool against ISP snooping, hostile Wi-Fi, and location-based blocking — and still the wrong tool against account-based tracking, fingerprinting, and AI profiling, where browser hygiene (tracker blocking, containerised logins, minimal extensions) does the real work.
How to check your VPN is actually working
- IP test: open What Is My IP — it should show the exit server's city and provider, not your ISP.
- Three-signal test: run Am I on a VPN? — with the VPN on you want the “likely VPN” verdict (IP in the exit city, clock and GPS at home). If it says “no fingerprint”, your traffic may not be going through the tunnel at all.
- DNS leak test: use your provider's built-in checker or any reputable DNS-leak site; every resolver listed should belong to the VPN, not your ISP.
- Kill-switch drill: with the kill switch on, disconnect the VPN mid-download — traffic should stop dead, not continue naked.
- WebRTC: if your browser matters (journalism, sensitive work), verify WebRTC is not exposing your real IP; most modern VPN browser extensions handle this.
This guide is educational, not legal advice; VPN legality and terms of service vary by country and network.