Tuesday, November 03, 2026
Tech

What a VPN is actually doing when on

Rive News Research Desk

Published · 7 min read

By Rive News / Research desk | Rive News / Published October 26, 2026 at 9:00 AM PKT

Key takeaways

  • A VPN wraps your internet traffic in an encrypted tunnel between your device and a server run by the VPN provider.
  • Your Wi-Fi network and internet provider see only encrypted traffic to that server, not the sites you visit.
  • A VPN does not make you anonymous. The provider can see your traffic, and websites still see the server's address.
A person using a laptop and phone at a cafe table
A person using a laptop and phone at a cafe table

[A person using a laptop and a phone at a cafe table.] Photograph: Wikimedia Commons contributor

Image Credits: Wikimedia Commons

Turn on a VPN and, on the surface, nothing changes. The same browser, the same sites, the same speed, more or less. Underneath, the path your data takes has changed completely.

This article explains what a VPN is actually doing when you turn it on, including the encrypted tunnel, the key exchange, what your internet provider can still see, and what a VPN cannot do.

The tunnel, in plain terms

A VPN creates an encrypted tunnel between your device and a server operated by the VPN provider. Your traffic travels through that tunnel, exits from the server, and reaches the internet from there.

The tunnel is not a physical cable. It is a logical pathway built over your existing internet connection. Your data is broken into packets, encrypted, and wrapped inside new packets addressed to the VPN server.

When the packets arrive at the server, they are decrypted and forwarded to their real destination. Replies follow the same path in reverse.

This produces two practical changes. First, your traffic is unreadable in transit: anyone intercepting a packet between your device and the VPN server sees encrypted data, not content. Second, the destination server sees the VPN server's address as the origin of the request, not your device's address.

Proton VPN describes the encryption step directly. The packets are encrypted using an algorithm that converts the information from readable text to unreadable ciphertext, and only the VPN app and VPN server can decrypt those packets using a secret key.

The handshake before anything moves

Before any of your traffic flows, your device and the VPN server perform a handshake. They agree on a shared encryption key without ever sending that key across the network in readable form.

The key exchange typically uses either TLS or the Noise Protocol, depending on which VPN protocol is in use. Reputable VPNs then encrypt the session with AES-256, the same standard used by financial institutions and government agencies for sensitive data. WireGuard, a newer protocol, uses the ChaCha20 cipher instead and is known for speed and simplicity.

Authentication comes first in the sequence. The client connects to the provider's server and authenticates using credentials, certificates, or a pre-shared key, depending on the setup. Only then is the tunnel negotiated and traffic encrypted.

The protocol matters for speed and reliability. OpenVPN is widely trusted for its security and flexibility and supports multiple encryption ciphers.

WireGuard is newer, faster in many tests, and simpler in design. The choice affects performance, but the basic tunnel shape is the same.

What your internet provider sees

Without a VPN, your internet service provider can see a great deal: which sites you visit, when you connect, and how much data moves. With a VPN, that picture collapses to a single fact.

Your provider sees only that you connected to a VPN server. It cannot read the contents of the tunnel, and it cannot see the final destination of your traffic. That is the core privacy gain, and it is most valuable on untrusted networks such as public Wi-Fi, where anyone on the same network could otherwise intercept traffic.

There is an important limit here. Data between the VPN server and the final destination is not encrypted by the VPN.

In practice it is usually protected by standard web encryption, known as TLS, which is the padlock in the browser. But that protection belongs to the website, not to the VPN, and not every site uses it.

A VPN tunnel also works at the network layer, which means it covers everything leaving your device, not just the browser. Email clients, background apps, system updates, and DNS queries all travel through the tunnel. A simple proxy, by contrast, usually protects only browser traffic.

What a VPN does not do

A VPN does not make you anonymous. This is the most common misunderstanding in VPN marketing, and it is worth stating flatly.

First, the VPN provider itself can see your traffic. When you connect, the provider takes the position your internet provider used to hold.

Proton VPN states this directly: you should only use VPNs that you trust, because the provider can see the same kind of data that your ISP could when you are not using a VPN. That is why an independently verified no-logs policy matters more than any speed claim.

Second, websites still track you in other ways. Cookies, logged-in accounts, browser fingerprints, and device identifiers all survive a VPN connection. Changing your apparent location does not log you out of anything.

Third, leaks can undo the tunnel. If a VPN does not use its own DNS servers, requests can leak to the provider's DNS and reveal browsing. Some VPNs handle only IPv4 traffic, so IPv6 traffic can reveal a real address.

Video services using WebRTC can also expose a real address in some setups. And if the connection drops without a kill switch active, traffic can continue unprotected without any warning.

A kill switch is the safeguard against that last failure. It blocks all internet traffic if the VPN connection drops, so nothing travels outside the tunnel by accident.

People working on laptops in a cafe
People working on laptops in a cafe

[People working on laptops in a cafe.] Photograph: Wikimedia Commons contributor

Image Credits: Wikimedia Commons

When a VPN is genuinely useful

A VPN is most useful in three situations. On public Wi-Fi, it stops other people on the network from reading your traffic.

At home, it stops your internet provider from building a detailed picture of your browsing. And when you need to appear in another location, it gives websites the server's address instead of yours.

It is less useful as a general anonymity tool, and it is not a security product on its own. It does not block malware, it does not verify that a website is genuine, and it does not protect data once it leaves the VPN server.

The honest test for any VPN claim is simple. Ask what changes for each party: your network, your provider, the VPN company, and the website.

A VPN moves trust from your provider to the VPN company and hides your traffic from the network in between. Everything else it claims should be treated as marketing until proven.

The bottom line

When you turn on a VPN, your device encrypts your traffic, wraps it in packets addressed to the provider's server, and sends it through a tunnel that your network and provider cannot read. The server unwraps it, forwards it, and sends replies back through the same tunnel.

That is a real and useful change. It is not invisibility.

The provider can still see your traffic, websites can still recognise you, and a dropped connection without a kill switch can leave you exposed. Choose a provider you would trust with your browsing history, because that is what you are handing it.

Tags: VPN, encryption, online privacy

Rive News is a research desk that writes plain-language explainers from published studies and public sources.

Related

Subscribe for one plain-language tech explainer each week.

Rive News publishes explainers based on public sources. Corrections are made promptly when a source is shown to be wrong.

TaggedVPNencryptiononline privacy

Related stories