What a VPN Does Not Protect You From

A VPN does not make a fake login page safe, erase your account identity or repair an infected device. It protects a particular part of the connection. Before buying one, identify what you want to hide, who you want to hide it from, and which traffic the app will actually carry.

Where the tunnel ends#

For traffic routed through it, a VPN creates an encrypted connection between your device and its server. The destination generally sees the VPN server's address rather than your original public address. Traffic outside the tunnel does not gain that protection. This is the basic arrangement described in Cloudflare's VPN guide.

HTTPS serves a different role: it encrypts the connection to the website. Keep using HTTPS with a VPN. A VPN is no reason to ignore a browser certificate warning.

An account can still identify you#

Signing in gives the website an account identity even when your network address changes. Cookies and browser fingerprinting can also contribute to tracking. The EFF's VPN guide explains why an altered IP address is not complete anonymity.

You also need to trust the VPN operator. Routing traffic away from your local network does not remove every intermediary; it introduces the VPN service into that path. Read its privacy policy and consider what you are trying to protect before deciding whether that trade is useful.

Encrypted does not mean honest#

A fraudulent website can use HTTPS. If you submit a password to its operator, encryption in transit does not stop that operator receiving it. The FTC's public Wi-Fi guidance makes this distinction and recommends account protection and software updates.

For an unexpected billing message, open the service through a saved bookmark or its known address. Check the request there before entering credentials. If you downloaded a suspicious file, deal with the file and the device; changing the network route does not resolve that problem. Do not assume a bundle's optional blocking feature catches every harmful site or download.

Decide whether a VPN addresses your concern#

Public Wi-Fi does not automatically mean that every password is sent in plain text. HTTPS already protects website content in transit. A VPN can still be useful when you want a different network path, but fear alone is a poor basis for choosing a subscription.

Ask yourself one concrete question: what should change when the VPN is connected? If the answer is protection against account takeover, start with a strong unique password and multi-factor authentication. If you need access to an employer's private systems, follow the employer's instructions.

Our VPN buying guide covers subscription conditions. It does not rank products by claims of total protection.