"VPN" gets thrown around as a vague catch-all for "internet privacy thing," which is a shame, because what it actually does is pretty concrete and easy to explain once you separate it into its two real jobs: building a private tunnel, and encrypting what goes through it. Neither part is magic, and understanding both makes it a lot easier to tell what a VPN can honestly promise you.

The problem a VPN is solving

Every time your device talks to the internet, that traffic has to physically travel through a chain of intermediaries before it reaches its destination: your home router, your ISP's equipment, and then whatever networks carry it the rest of the way. Any of those intermediaries can, in principle, see where your traffic is headed and — for anything not already encrypted — what's inside it. On a public Wi-Fi network, that chain gets shorter and more exposed: the access point itself, and anyone else sharing it, sit directly in the path.

A VPN's job is to change where that "first hop" of visibility happens. Instead of your ISP or the local network seeing your real destinations, they see one thing: an encrypted connection to a VPN server. The VPN server then makes the actual requests to the wider internet on your behalf and relays the responses back through that same encrypted connection.

Tunneling: wrapping traffic inside traffic

The word "tunnel" is doing real descriptive work here. A VPN tunnel takes your normal network packets — the same packets your browser or apps would send anyway — and wraps each one inside a new, encrypted packet addressed to the VPN server. From your ISP's point of view, it can see that your device is exchanging data with a server operated by the VPN provider, and roughly how much, but not what's inside those wrapped packets or where they're ultimately headed once the VPN server unwraps and forwards them.

This is why a VPN doesn't require every website and app you use to individually support it. Tunneling happens at the network level, below any specific app, so it transparently covers everything your device sends — browser traffic, background app syncing, DNS lookups, all of it — without each piece of software needing to know a VPN is involved.

Encryption: making the wrapping actually private

Tunneling alone just relocates who can see your traffic's destination — it doesn't automatically make the tunnel itself unreadable. That's what encryption adds. Modern VPN protocols use public-key cryptography to establish a shared secret between your device and the VPN server without ever transmitting that secret in a form an eavesdropper could capture, and then use fast symmetric encryption (derived from that shared secret) to scramble every packet in the tunnel. Anyone intercepting the encrypted traffic — your ISP, someone on the same public Wi-Fi, a network operator anywhere along the path to the VPN server — sees ciphertext, not your actual requests.

This is the same fundamental idea as HTTPS (the padlock icon you already trust on your bank's website), just applied one layer lower, to the whole connection rather than to a single website's traffic.

Why the protocol underneath actually matters

Not all VPN tunnels are built the same way, and the protocol handling the encryption and connection setup makes a real practical difference. Older protocols like OpenVPN and IPsec/IKEv2 are flexible and battle-tested, but they're also large, general-purpose pieces of software — OpenVPN's codebase runs to well over 100,000 lines. More code means more surface area for bugs, and cryptographic bugs are exactly the kind of thing you don't want in something protecting your traffic.

WireGuard took a different approach: a from-scratch redesign focused on doing one job — encrypted tunneling — as simply as possible. Its entire codebase is roughly 4,000 lines, small enough that it's been feasible for independent cryptographers to review in full, and it deliberately supports only a small, modern set of cryptographic primitives instead of the long list of legacy options older protocols carry for backward compatibility. In practice, that also tends to make it noticeably faster to establish a connection and lighter on battery and CPU, which is part of why most newer consumer VPN apps — including UrMomsVPN's — are built on it rather than on OpenVPN.

We go deeper into the specific technical differences between WireGuard, OpenVPN, and IKEv2 in a dedicated comparison if you want the full picture.

What a VPN changes, concretely

What a VPN doesn't change

It's worth being upfront about the limits, since overselling this is where a lot of VPN marketing goes wrong. A VPN doesn't make you anonymous — the VPN provider itself is now in the position your ISP used to occupy, which is exactly why who operates it and what they log matters so much (more on that in our piece on no-logs claims). It doesn't stop websites from tracking you via cookies, browser fingerprinting, or your logged-in accounts — if you log into the same account with or without a VPN, that service still knows it's you. And it doesn't replace basic security hygiene like strong, unique passwords or two-factor authentication; encrypting the pipe your password travels through doesn't help if the password itself is weak or reused.

The short version

A VPN builds an encrypted tunnel between your device and a server it controls, so intermediaries between you and that server — your ISP, a public Wi-Fi network, anyone else on the path — see only that an encrypted connection exists, not what's inside it or where it's ultimately headed. Which protocol handles that tunnel, and which provider operates the server on the other end, are the two things that actually determine how much that protection is worth in practice.