Does a VPN Hide Your IP Address? And What It Doesn't Hide

Yes, with one precise caveat: a VPN does not hide your IP address, it replaces it.

Every site you open sees the VPN server's address instead of yours, and your internet provider sees one encrypted connection to that server instead of a list of the sites you visited. What nobody removes is the fact that an address exists: your provider still knows your real one, and the VPN operator now knows both. That trade is the whole product, and everything below is about where it holds and where it does not.

Three things are often confused with hiding your IP and are not the same: your location, your identity, and your search history. They come apart differently, so they are worth separating before you rely on any of them.

  WHAT CHANGES WHEN YOU CONNECT

  address sites see     ▇▇▇▇▇▇  swapped
  site names your ISP   ▇▇▇▇▇   hidden
  approximate location  ▇▇▇▇    follows IP
  browser fingerprint   ▇       unchanged
  who you are           ▁       unchanged

What the site actually sees

Before the tunnel, a site sees the address your provider gave you. From it, commercial databases infer a rough location — usually the city or region of the network, often wrong by a lot — and the name of your provider. After the tunnel, the site sees the server's address and infers the server's city and its hosting company.

That is the whole mechanism. There is no step where the address disappears; there is a step where it is swapped. Confirm it yourself on what is my IP: the country and provider shown should be the server's, not yours.

What it does not hide

Your identity. The moment you sign in anywhere, the account is you regardless of the address it came from. A different IP does not make a logged-in session anonymous.

Your browser fingerprint. Screen size, fonts, time zone, graphics rendering and dozens of smaller signals form a profile that survives the address change entirely, and a mismatched time zone can even make you more distinctive. See browser fingerprinting and check yours with the privacy checker.

What you type in. Forms, payments, uploads: the tunnel protects them in transit and hands them over intact at the other end.

Your search history on your own account. If you are signed in to a search engine, it records the searches under your account. The provider stops seeing them; the search engine does not.

Three ways the real address leaks anyway

A tunnel that is up is not the same as a tunnel that carries everything. Three common gaps let the real address out while the app still shows "connected".

• DNS. The name lookups go to your provider's resolver outside the tunnel. The provider keeps the full list of sites. How to check and fix: is my DNS leaking, which walks through the extended test on dnsleaktest.com or ipleak.net.
• WebRTC. A browser feature for voice and video calls connects directly and can expose the real address to a page. Run the WebRTC leak test.
• IPv6. If your network hands out IPv6 and the tunnel only carries IPv4, half your traffic goes around it. Run the IPv6 leak test.

A fourth gap is not a leak but a gap in time: the seconds between the tunnel dropping and reconnecting, when traffic falls back to the open network. That is what a kill switch is for — see what is a VPN kill switch.

Who still knows your real address

Your internet provider, always: the tunnel starts at your device and they carry it. They see that you connected to a VPN server, for how long, and how much data moved — just not what was inside.

And the VPN operator, by necessity: your real address on one side, the destinations on the other. This is why "does it hide my IP" is the wrong last question. The right one is who you would rather have holding that knowledge, and what they write down. A provider that states clearly what is and is not stored is checkable; a claim of "no logs" with no detail is not. See what does no-logs VPN mean.

When hiding the address is not enough

If the goal is for a specific site not to connect this visit to your previous ones, the address is one signal out of many — cookies, the account you are signed into, and the fingerprint usually matter more. If the goal is for nobody at all to link the traffic back to you, that is a different threat model with different tools, and a commercial VPN is not it: see VPN vs Tor vs proxy.

If the goal is that your provider and the café Wi-Fi stop seeing which sites you open, that a VPN does well, and that is most people's actual reason.

Help me read my leak test results.

What I ran: (IP page / DNS leak test / WebRTC /
IPv6).
IP page shows: (country and provider).
My VPN server is in: (country).
DNS test shows: (what servers appear).
WebRTC shows: (an address or nothing).
Protocol: (WireGuard / VLESS / other).

Tell me which of these is a real leak and which is
normal, and what to change first. If a result means
the app is not doing what it claims, say so plainly.

The short answer

A VPN replaces your IP address, and that holds as long as DNS, WebRTC and IPv6 go through the tunnel too. It does not hide who you are, it does not change your browser fingerprint, and it moves the knowledge of your real address from your provider to the VPN operator rather than erasing it. Anyone promising full anonymity from a tunnel alone is selling something else.

404 VPN runs on VLESS with Reality and WireGuard, resolves DNS inside the tunnel and has a kill switch, and the privacy policy lists what is and is not stored. The builds available today are Android and macOS, with other platforms in progress: see the download page.