What a VPN is, what it is used for, and how to connect

Many people first meet the word in the Settings app on their phone. That entry is only the system’s hook for VPN connections: until a configuration has been added it is empty, and toggling it does nothing.

What makes a VPN work is the pair at each end: a client on your device and a server run by someone else. The client may be built into the system or be an app; the server belongs to an employer, a school or a VPN provider. A corporate VPN brings staff back onto the office network; a provider’s VPN gives you an exit in another region. Both use the same technique.

So “downloading a VPN” really means opening an account with a provider and installing the client it tells you to use. Prefer clients published by the vendor or a well-known open-source project; How to Recognise a Risky VPN App explains why.

Without a VPN, your device talks to each website directly. The carrier and whoever runs the Wi‑Fi can see which sites you connect to, and the site sees your own IP address.

With a VPN there is one stop in between. The client encrypts everything and sends it down a tunnel to the VPN server; the server unwraps it, fetches the site for you, and sends the answer back the same way.

• Your local network sees one conversation with one server, and cannot read it.
• The website sees the server as its visitor. That address is the exit IP: pick a server in a region and your exit is in that region.
• The VPN provider sits in the middle, which is why the choice of provider matters. HTTPS content stays encrypted to it, but it knows which addresses you connect to.
• Different VPNs build the tunnel with different protocols, each suited to different networks — see VPN Protocols Compared.

• It changes your exit region. Reaching overseas sites from inside China, or using Chinese video, music and banking services from abroad, both come down to the exit IP being somewhere else.
• It separates your traffic from everyone else on public Wi‑Fi in hotels, airports and cafés.
• It connects you back to an office or home network, so internal systems, a NAS or cameras behave as if you were on site.
• It does not make you anonymous. A site you are logged in to still knows who you are, and cookies and device details are outside the VPN’s reach.
• It does not stop malware or phishing. A malicious link or an infected installer works just the same with a VPN on.
• It does not make the broadband itself faster. A VPN adds a leg to the journey and your local connection remains the ceiling; what it fixes is “cannot reach” and “takes a bad route”, not bandwidth.
• A proxy in the form of a browser extension covers that browser only, and other apps bypass it — see What a Web Proxy Is and When to Use One.

Every system follows the same pattern: install the client and log in or import a configuration once; after that, on and off are one tap.

• iPhone and iPad: once the client has connected for the first time, its configuration appears under VPN in Settings. Switch it on in the client or with the VPN toggle in Settings; a VPN badge at the top of the screen means it is on. One more tap turns it off.
• Android: tap connect in the client and allow the “set up a VPN connection” prompt the first time. A key icon in the status bar means it is on. Disconnect from the client or from the notification.
• Windows and macOS: open the client and click connect; the system’s network settings also list the VPN and show its state. Disconnect in the client; quitting the client disconnects too.
• There are usually only three things to set: a server address or a configuration file, a username and a password. Most providers wrap these in a QR code or an importable file so nothing is typed by hand.
• To confirm it worked, open an IP-lookup page: if it shows the region you chose, you are connected.
• If it will not connect or is slow once connected, follow the troubleshooting checklist.

• On: a site or app does not open on your current network, or is offered only in another region.
• On: you are logging in to accounts or working on public Wi‑Fi you do not trust.
• On: you are travelling and need services from home, or need to reach devices at the office or at home.
• Off: you are using only local sites and apps. Sending everything through the VPN makes local sites take a detour. Turn it off, or use split routing, where traffic that needs the route takes it and local sites go direct.
• Should the VPN switch on an iPhone be on? If you never installed a VPN client, leave it alone — it is off already. If you did, the two rules above apply: on when needed, off otherwise.
• Battery: a VPN uses a little extra power for encryption and keeping the connection alive, so switch it off when it will sit idle for long.

• First, whether it works on your network. Campus networks, office networks and different carriers behave very differently, so use a free trial before paying where one is offered.
• Where the client comes from. Clients from the vendor or an open-source community can be traced to their source; an installer of unknown origin is a risk in itself.
• Which devices it covers. TVs, consoles and NAS boxes cannot run a client and need a router — see Choosing a VPN Router.
• Which direction you need. Getting out of China and getting back in are opposite jobs; the second needs a genuine mainland exit — see How to Choose a China VPN.
• Whether someone answers when it breaks, and whether you can get a refund.
• Free options do fit some situations; Free or Paid China VPN? covers the trade-offs, and VPN vs proxy subscriptions vs accelerators explains the neighbouring product types.

1. Create an account and claim the 24-hour free trial; no credit card is needed.
2. Pick a connection method for your device and network. One account has six: router, OpenVPN, Cisco (AnyConnect), Hiddify, web proxy and private network (Tailscale). Which connection method fits which scenario helps you choose.
3. Install the matching client from the download centre. Every client comes from its vendor or an open-source community.
4. Choose a region, connect, and open an IP-lookup page to confirm the exit.
5. If one method struggles on your network, change region or change method; the same account works for all of them.