A VPN, or virtual private network, is an app that wraps everything your device sends to the internet in an encrypted tunnel to a server run by the VPN provider. Your Wi-Fi network and internet provider see one encrypted connection to that server and nothing else. Websites see the server's address instead of yours. That is the whole idea: it moves the point where your traffic becomes visible from your local network and ISP to a server you chose. Everything else, good and bad, follows from that.

What happens without a VPN

When you open a website, your device asks a DNS server, usually your ISP's, for the site's address, in plain text. Then it connects directly. The content of the page is encrypted by HTTPS, so nobody in between reads it. But the ISP, and anyone running the Wi-Fi you are on, sees the name of every site you connect to, when, and how much data moves. The site sees your real IP address, which reveals your country, city and provider. The full picture is in what can my ISP see.

What the VPN changes

The VPN app creates a virtual network interface on your device. Every packet from every app goes into it, gets encrypted, and travels to the VPN server. The server decrypts it and sends it on to the website, then encrypts the reply and sends it back.

  • The network and ISP see an encrypted stream to one address. No site names, no DNS queries, no app traffic. Only the amount of data and the fact that a VPN is in use.
  • Websites see the VPN server's address. Your location, as far as the site can tell, is wherever the server is.
  • On public Wi-Fi, the person at the next table and the café's router see the same encrypted stream, which closes every gap HTTPS leaves open.

How the tunnel is built

Two things happen when you press connect. First, your device and the server authenticate each other, using keys or certificates, so nobody can impersonate the server. Second, they agree on a session key and start encrypting with it. The rules for this are the protocol. WireGuard is the fast, simple modern one; OpenVPN is the older, heavier one; VLESS with Reality is built to make the tunnel look like an ordinary HTTPS connection to a normal website, which matters on networks that block VPNs. The comparison is in WireGuard vs OpenVPN and what is VLESS.

The encryption itself is the same kind banks use: TLS 1.3, AES or ChaCha20. There is no practical way to read it without the keys.

What a VPN protects

  • Your traffic on shared and public networks.
  • The list of sites you visit, from your ISP and local network.
  • Your IP address, from websites and from the other party in direct connections such as calls and games.
  • Your accounts when traveling: connecting to a home-country server keeps banks and email from flagging a login from abroad.

What a VPN does not protect

  • You from the websites you log into. They know who you are from your account, cookies and browser fingerprint, whatever your address is.
  • You from phishing and malware. The tunnel carries what you send; it does not judge it.
  • You from the VPN provider. The server is where traffic is decrypted, so the provider is in the position your ISP was in. Whether it records anything is a policy question; how to read one is in what does no logs mean.
  • Anything, if the tunnel leaks. DNS outside the tunnel, IPv6 outside the tunnel, or a dropped connection that falls back to the open network all undo the protection. That is why a kill switch and DNS inside the tunnel matter.

When you actually need one

  • Any time you use Wi-Fi you do not control: cafés, airports, hotels, offices.
  • When you do not want your ISP to have your browsing list.
  • When traveling, for banking and email.
  • On networks that inspect or throttle traffic.

At home on your own network the case is weaker: the ISP still sees your site list, but nobody else is on the network. Many people run it everywhere for consistency; it costs a little speed, explained in does a VPN slow down your internet.

Checking that it works

After connecting, open What Is My IP: the address and country should be the server's. Then run the WebRTC leak test and the IPv6 leak test, and a DNS leak test. If all four show only the server, the tunnel is doing its job.

404 VPN builds the tunnel with VLESS or WireGuard, keeps DNS inside it, blocks traffic during reconnects with a kill switch, and publishes a privacy policy that lists what is and is not stored. The connection is described on the how it works page; get started here.