What Is a VPN and Do You Actually Need One in 2026?

A VPN is sold as protection against almost everything. In practice it does one job: it encrypts the connection between your device and a server run by the VPN company, and it makes websites see that server's address instead of yours. Whether you need that depends on where you go online far more than on what you do there.

What a VPN actually does

Without a VPN, your traffic passes through the Wi-Fi network you're on, then your internet provider, then the wider internet. Each of them can see which sites you connect to, and websites see your IP address, which reveals roughly where you are.

With a VPN, your device encrypts everything and sends it to the VPN server, which forwards it on. The café Wi-Fi and your internet provider see one encrypted connection to one server. Websites see the server's address.

That's the whole trick, and it comes with a catch the marketing rarely mentions. The FTC puts it well: a VPN doesn't make you anonymous, it shifts your trust from those networks to the VPN provider. The VPN company can now see what your internet provider used to see. Choosing a VPN is really choosing whom to trust, which is why a provider's audits and track record matter more than its server count.

Why public Wi-Fi is a weaker reason than it used to be

"Use a VPN on public Wi-Fi" made more sense ten years ago than it does today. Most of the web now uses HTTPS, which encrypts the content of each page between your browser and the site. Google reports that on public websites, Chrome traffic is now 98% HTTPS on Windows and over 99% on Android and Mac, and Chrome made secure connections the default for most users in September 2026.

That's why the FTC now says connecting through public Wi-Fi is usually safe for most things you do online. A VPN still hides which sites you're visiting from whoever runs the network, and it's a reasonable extra on a hotel or airport network you know nothing about. It just isn't the essential shield it's often sold as.

When a VPN is worth it

We'd recommend one in three situations:

• You don't want your internet provider logging your browsing. A VPN hides the sites you visit from your provider. It moves that visibility to the VPN company, so pick one with an audited no-logs policy.
• You travel, or use networks you don't control, often. Hotels, conferences and shared offices. A VPN makes the local network irrelevant.
• You need to appear to be somewhere else. Banking apps and streaming services sometimes behave differently abroad. Connecting to a server at home usually solves it, within the terms of the service you're using.

If none of these apply, and you mostly browse at home on your own router, a VPN adds cost and a small slowdown for very little.

What a VPN won't do

The Electronic Frontier Foundation's guide is blunt about this: a VPN does not stop cookies, browser fingerprinting or location tracking, and whoever runs the service can see your traffic. So a VPN does not:

1. Make you anonymous. Signing in to Google or Facebook identifies you whatever your IP address says.
2. Block tracking. That's the job of your browser's privacy settings and a good content blocker.
3. Protect you from phishing, malware or a reused password. Your antivirus, your browser and a password manager handle those.

How five well-known services compare

We compared each provider's published pricing model, device limits, protocols, refund terms and, above all, independent audits of its no-logs claims. An audit isn't proof a company will behave forever, as the EFF points out, but a service that has never let an outsider check its servers is asking for blind trust.

Scroll sideways to see every column.

Service	Pricing	Devices at once	Latest no-logs audit	Protocol	Refund window
Proton VPNEditors' pick	Free plan; paid from $9.99 a month, less on 1 or 2-year plans	10 (Plus)	Securitum, published 2026	WireGuard, plus Stealth	30 days
Mullvad	Flat €5 a month (about $5.69), no intro deals	5	Cure53, June 2024	WireGuard only	14 days
NordVPN	Intro price on 2-year plans, higher renewal	10	Deloitte, Nov to Dec 2025	NordLynx (WireGuard-based)	30 days
ExpressVPN	Three tiers; intro price, then renewal price	10 to 14, by tier	KPMG, as of Feb 2025	Lightway (its own)	30 days
Surfshark	Intro price for the first 27 months, then renewal	Unlimited	Deloitte, May to June 2025	WireGuard	30 days

From each provider's own pricing, support and audit pages, checked September 24, 2026. Intro prices change often, so we list how each one prices rather than a figure that may be out of date by the time you read this. Refund windows apply to direct first purchases; app store purchases are refunded by Apple or Google.

All five have recent audits and modern, fast protocols, so the differences come down to price structure and trust. Mullvad charges the same €5 a month whatever the plan length, so there's no renewal surprise. NordVPN, ExpressVPN and Surfshark all rely on steep discounts for long first terms, followed by a higher renewal price, so check what you'll pay in year three, not year one.

Proton VPN in detail

We picked Proton VPN because it is the most complete package without asking for blind faith. Its no-logs policy has been checked by the auditing firm Securitum every year since 2022, it uses WireGuard by default, and its Stealth protocol helps on networks that try to block VPNs. The Plus plan covers 10 devices. One caveat: on Macs and iPhones, Proton notes that some Apple system DNS requests can bypass the kill switch, a limitation of Apple's platform rather than of Proton alone.

Free VPNs: when they're enough, and when to run

The FTC warns that many free VPN apps make money by selling advertising or sharing your information with third parties. Research has since put numbers on the problem. The Tech Transparency Project found that one in five of the top 100 free VPN apps in Apple's US App Store in 2024 had undisclosed Chinese ownership. Citizen Lab identified hidden families of VPN apps with more than 700 million combined Google Play downloads that shared the same security flaws.

The exception is a free plan run by a company that also sells a paid one, because the paying customers fund it. Proton VPN Free has no data cap and no ads, and covers one device with servers in a handful of countries. For an occasional session on a hotel network, that's plenty.

How to choose, in four checks

Ignore server counts and "military-grade encryption" claims; every serious provider uses the same strong encryption. Check these instead:

• a recent independent audit of the no-logs policy, from a named firm;
• WireGuard or a comparable modern protocol, for speed;
• a kill switch on the devices you actually use;
• a refund window of at least 14 days, so you can test it on your own networks.

Then use it for a week on the Wi-Fi you normally use. If pages feel slower or an app you rely on breaks, ask for your money back. Keep in mind that a number of countries restrict VPNs: Iran criminalized unauthorized VPNs in 2024 and Russia blocked nearly 200 of them the same year. If you're traveling, check the local rules before you rely on one.

Questions readers ask

Is using a VPN legal?

In the US, the UK and the EU, yes. A number of countries restrict or ban them, including Russia, Iran and China, so check before you travel. Using a VPN never makes an illegal activity legal.

Will a VPN slow down my internet?

A little. Encryption and the detour through the VPN server cost some speed, more so if the server is far away. With a modern protocol and a nearby server, most people don't notice it while browsing or streaming.

Do I need a VPN on public Wi-Fi?

Less than you used to. The FTC says public Wi-Fi is usually safe because most sites encrypt your connection. A VPN still hides which sites you visit from the network owner, and it's a sensible extra on networks you don't trust.

Are free VPNs safe?

Some are, most aren't. Researchers have found popular free VPN apps with hidden owners and serious security flaws. A free plan from a company that also sells a paid one, like Proton VPN Free, is the safer route.

Can my employer or school see what I do on a VPN?

If you use their device or they manage it with monitoring software, possibly yes. A VPN protects the connection, not a computer someone else controls.