How does a VPN work? Tunnels, encryption and IP addresses
When you hit “Connect”, the VPN app agrees encryption keys with a server in a fraction of a second and routes all your traffic through it. Here’s what actually happens, and what decides whether the connection is fast.
Without a VPN
Normally your device talks to a website directly over your provider’s network. HTTPS protects the content of the page, but plenty is left in the open. The website sees your IP address, and your provider and the Wi-Fi owner can see which domains you connect to, when and for how long.
What changes when you connect
The app connects to the server you picked and both sides agree on encryption keys that are unique to the session. From then on, everything your device sends is encrypted and wrapped inside the connection to the VPN server. Your provider sees one stream of data it can’t read.
The server unwraps your traffic and sends it on to the internet using its own IP address. The website replies to the server, which passes the data back to you through the tunnel. As far as the website is concerned, it’s talking to a machine in the server’s country.
Encryption
Modern VPNs rely on well-tested algorithms, usually AES-256 or ChaCha20. Without the key, intercepted data is useless. Because keys change with every session, even a compromised key wouldn’t unlock earlier connections.
Protocols
The protocol is how the tunnel gets built. WireGuard dominates today: it’s lightweight, fast and small enough to audit properly. NordVPN runs its own version called NordLynx. The older OpenVPN is slower but very flexible, and handy on networks that block other protocols. IKEv2 copes well with switching between Wi-Fi and mobile data, so you’ll often see it on phones. Some providers have their own, like Lightway at ExpressVPN or Chameleon at VyprVPN.
In practice you rarely need to touch this, because the app picks a sensible default.
Where the foreign IP address comes from
Every VPN server has IP addresses registered to the country it runs in. Connect to a server in Germany, get a German address, and websites treat you as being in Germany. That’s why it matters where a provider actually has servers. You can check on the VPN map.
Virtual locations
Some providers also sell virtual locations. The IP address is registered in the country you choose, but the server sits in another one, usually a neighbour with better infrastructure. Websites can’t tell the difference, though you may notice extra latency. It’s more common than you’d think: in 66 of the 179 countries on our map, no provider has a physical server. The country list and individual country pages show which provider offers what.
Features worth knowing about
A kill switch cuts your internet the moment the VPN drops, so your real IP address doesn’t leak even for a second. DNS leak protection sends website lookups through the tunnel too. Split tunneling lets you choose apps that bypass the VPN, such as a printer on your home network. Multi-hop, sometimes called Double VPN, routes traffic through two servers in different countries.
Does a VPN slow you down?
A little. Encryption takes a moment and your data has to reach the server and come back. With WireGuard and a nearby server the difference is usually hard to notice. Connect to the other side of the world and latency goes up noticeably. For everyday use, pick something close, and save distant locations for when you really need an IP address from there.