What is a VPN, in plain words: what a site and your provider see

Everyone explains a VPN the same way: “a secure tunnel that changes your address”. That is true, but it leaves out the main thing — what exactly changes, and for whom. We did not retell it: we brought up a real connection, opened the same pages directly and through the tunnel, and recorded what a site sees and what is visible from outside, along the way. Below — in plain words, with our measurement, with what it looks like on a phone, and with what a VPN does not do.

What a VPN is, in plain words

Without a VPN the road looks like this: phone → Wi-Fi or mobile operator → site. Everyone the road passes through sees where you go: the site’s address, and most of the time its name as well. The site itself sees your address and uses it to guess your country and operator.

With a VPN the road is different: phone → encrypted tunnel → the VPN service’s server → site. The operator sees one connection to one server and cannot see what is inside. The site sees the server’s address — and assumes that is where you came from.

It is like a letter sealed in a second envelope and sent to a middleman. The post office sees only the middleman’s address. The recipient sees the middleman’s return address. The middleman sees both — and that is the price, which has its own section below.

Where the word comes from. VPN stands for Virtual Private Network. It was invented for companies: so that an employee at home could reach the office’s internal network as if sitting at their desk. “Private” because a closed channel of its own is built on top of the shared internet; “virtual” because nobody lays any cables for it. Today a VPN more often means a service for one person: an app plus servers in different countries.

Why an ordinary person would want one. So that the owner of the Wi-Fi in a café or hotel cannot see where you go (what they see without a tunnel — our separate measurement); so that your operator does not collect a list of your sites; to go online from another country’s address; so that the whole connection is encrypted, not only on the sites that took care of it. Which service to pick is a separate conversation: which ones work in Russia and paid or free.

What a site sees: our measurement

On 24 September 2026 we brought up a real connection to our line in the Netherlands and asked two utility sites that show “what can be seen about you”: what my address is, where it is from, and what arrived in the request. Once directly, then twice through the tunnel, half a minute apart — both answers through the tunnel matched.

⚠️ An honest note about the starting point. The machine we measured from physically sits in Moscow and reaches the internet through Kazakhstan. So “without the tunnel” it does not look like ordinary home internet — it looks like a Kazakh address. That in itself is a good example: a site sees not where you are, but where the address came from.

The address changes completely — that is the main thing a VPN does as far as a site is concerned. We do not print the addresses themselves: one belongs to our work machine, the other to an exit node.

A site does not see your country — it guesses it. Every site has its own “which address is in which country” database, and the databases disagree. About our very own node, three of four databases said “the Netherlands”, and one said “the United States” and named an American telecom operator. According to the address registry, this address range has been handed over to the European one; judging by the answer, that database seems to hold old records about the range’s previous owner — but this is our guess, not a verified fact. The practical takeaway is simple: if a site shows “the wrong country”, the cause may be the site’s database rather than the service.

Everything else stays the same. The program and the request data reached the site unchanged. We measured with a utility program, and a browser tells much more about itself: language, screen size, the phone’s own time zone, saved cookies and your logged-in account. A VPN touches none of that — more on this below.

What your provider sees: our measurement

Your provider is whoever connects you to the internet: a mobile operator, your home internet, the owner of the Wi-Fi in a café. To look at the connection through their eyes, we recorded the packets at the outer network interface of the same machine while making the same requests directly and through the tunnel. We looked only at addresses, ports and sizes. As a control, we asked for addresses using one-time names that cannot be confused with anything else.

Directly, your provider sees whom you connect to and, most of the time, the site’s name. Page contents are locked behind https, but the name sits in the first packet of the connection in the open: we found it in the recording. The question “what is this site’s address” also goes out in plain text, name included.

Through the tunnel there is one connection to one address. Not a single site address, site name or address query showed up outside: in our app those queries go inside the tunnel by default.

What still shows. That you are connected to some server, when, and how much data went through. A VPN hides “where and what”, but not “how much and when”. The tunnel has a weight of its own, too: in our measurement 20 MB turned into 22.8 MB on the wire (how much data the tunnel uses — a separate write-up). And one more thing: if you let some apps go around the tunnel — in our app the setting is called “Split tunneling” — your provider sees them as usual.

What “mimicry” means. With ordinary tunnels the first packets look alike as twins, and the connection is easy to recognise by them without decrypting anything. With ours, the first packet is shaped like a packet of a common utility protocol. In this run it matched the format of a STUN request exactly — the way video calls and browsers learn their outside address. A neighbouring run the same morning got the shape of the start of QUIC, the protocol part of today’s websites run on: the pattern is picked anew each time the settings are issued. Then came four packets of random size with random contents, and only after them the handshake itself. The server simply throws such packets away. It is worth being clear: this is not a second layer of encryption — there already is encryption — it is the shape of the envelope. How this disguise works is covered separately.

What a VPN is on a phone

On Android a VPN is not a separate feature of the phone but an app the system has allowed to pass traffic through itself. Android has a system interface for this called VpnService — that is its name inside the system. Four things follow from this that are worth knowing.

The system consent dialog. The first time such an app connects, Android itself shows a “Connection request” dialog. Its text is the same for every such app, and it is the system’s text, not the developer’s:

It sounds alarming, but it is honest: whoever runs the tunnel can technically see where your traffic goes. So the decision “accept or not” is a decision about trusting a particular service, and Android asks you to make it consciously.

The key icon. While the connection is up, a small key sits in the status bar at the top of the screen, and the notification shade says “VPN activated”. It is the simplest way to make sure the tunnel is actually up, not just that a button was pressed. The drawing is from stock Android; manufacturers’ skins draw it their own way, and we have not checked every brand.

One such connection at a time. Android has one slot for it. Normally a new one pushes the old one out, but an app that has “Always-on VPN” enabled in the phone’s settings does not give up its slot — and the new one will not come up however many times you try. What it looks like and what to do — separately.

How to turn it off. In the app itself or in the phone’s settings, in the network section. Where everything is on Android and on iPhone, and what to do if the internet disappears after you turn it off — in how to turn off a VPN.

How to use one: four steps

1. Install the app from a store or from the service’s own site, not from a random link in a chat: the consent dialog above asks you to trust the source for a reason. Store or the service’s site — covered separately.
2. Sign in and tap “Connect”. The first time, the system dialog will appear — accept it if you trust the service. It usually asks only once.
3. Check that you are connected. A key in the status bar, and the connection status in the app (ours is called “Protected”).
4. Check that the address changed. Open a page that shows your address — for example, our IP address check — before and after you connect: the address should change, and on sites that show a country it should become the one you picked — allowing for the fact that address databases disagree. How to check your address and your address queries — step by step.

If some app behaves differently with the tunnel on than without it, most often it is a bank: why that happens and what to do about it.

What a VPN does not do

• It does not make you anonymous. A site sees a different address, but if you are signed in to an account, it knows it is you. Cookies, saved logins, the browser, the language, the phone’s time zone stay the same, and you are recognised by them, not by your address.
• It does not protect you from scams and malware. A fake login page opens perfectly well through the tunnel, and a malicious file downloads just the same. What is encrypted is the road, not what travels along it.
• It does not hide you from the VPN service itself. What your provider used to see — where you go — can now be seen by whoever runs the server. Android says so plainly in the consent dialog. That is why the main question when choosing is not “how fast” but “whom do I trust, and what does it say about itself”.
• It does not change the rules. What the law in Russia says is in a separate explainer.

What we see and store

Since a VPN service takes the provider’s place, it is only fair to say what we write about this. Here is the box from our privacy policy, word for word:

But “we do not collect the contents” is not the same as “we store nothing”, and we do not write the second, because it would not be true. What is stored, according to the same policy:

• the address and time of requests to our servers — to run the service and protect it from attacks (under the policy, technical access logs are kept for 90 days);
• daily traffic volume per account — how many bytes were sent and received, “volume counters only: no website addresses, no app names and no connection contents are stored”; kept for 180 days;
• a short journal of the app’s own actions — Connect and Disconnect taps, the outcome of a connection, errors; it is linked to the account and the request address is stored alongside, while site addresses and other apps’ names are not in it; kept for 90 days.

“What is this site’s address” queries go by default through the tunnel to the public address servers of Cloudflare and Google, and to them the source looks like our node, not your phone; we do not store these queries. The full list and retention periods are in the section on storage.

What we checked

• What a site sees — with two utility sites (ifconfig.co and httpbin.org), on 24 September 2026 at about 08:10 Moscow time: once directly and twice through the tunnel, half a minute apart. Both times through the tunnel the address of our Netherlands node came back, and the program and request data matched word for word.
• The country — in four databases in the same hour: ipinfo.io, ip-api.com and country.is placed the node in the Netherlands, ifconfig.co in the United States. Whose address range it was checked against the registry: it has been handed over to the European one.
• What is visible from outside — by recording packets at the outer network interface of the same machine. Other traffic passes through it too, so we recorded selectively — the addresses of the two sites, address queries and the tunnel port — and with a control: the same one-time name sent directly shows up in the recording, through the tunnel it does not.
• Mimicry — on the first packets of this very connection: the first packet is 20 bytes in exactly the STUN format, followed by four random ones. A neighbouring run the same morning got the QUIC shape.
• The live tunnel — with an instrument, not from a description: settings issued, handshake done in 2 seconds, exit address matched the node’s address.
• The volume — with the same instrument: 20,000,000 bytes took 20.6 MB on the wire directly and 22.8 MB through the tunnel.
• The consent dialog, the notification, the key icon and “Always-on VPN” — from Android’s source code, not from memory and not from a screenshot of someone else’s phone.
• What we store — from the text of our policy, the version of 21 September 2026.

What we do not know

• What it looks like for you. We measured from a work machine, not from a phone through a mobile operator. The end-to-end path “your phone → your operator → the tunnel” is not in this measurement.
• What a site sees in a browser. A utility program tells little about itself, a browser tells a lot. We did not measure a browser fingerprint and describe it only as the way browsers work.
• How often address databases get it wrong. We asked four, one named a different country. No “share of the internet” follows from that.
• How manufacturers’ skins draw the icon. We checked stock Android.
• What other services do. We answer for ours and show ours.

Short answers

What is a VPN, in plain words? An encrypted tunnel from your device to a server that opens sites in its own name. The site sees the server’s address, your provider — only a connection to that server.

What does “VPN” stand for? Virtual Private Network. It first meant a closed channel into a company network; now it more often means a service for one person.

What is a VPN on a phone? An app Android has allowed to pass traffic through itself. On the first connection the system asks for consent, and while the tunnel is up a key icon sits at the top of the screen.

How do I know the VPN is on? By the key in the status bar and the “VPN activated” notification. More reliable — check your address.

How do I turn off a VPN on my phone? With the button in the app itself or in the phone’s settings, in the network section. Step by step — separately.

Can I run two VPNs at once? No: Android has one slot for such a connection, and a new one normally pushes the old one out.

Does my provider see which sites I open with a VPN? In our measurement — no: from outside there was only a connection to one address. What shows is that you are connected, when, and how much data went through.

Does a VPN make me anonymous? No. It changes your address, but not your accounts, cookies or browser — and the service running the tunnel sees where you go.

What is a VPN configuration? A set of connection settings: the server address, keys and parameters. In our app the server issues it when you connect, and nothing has to be typed in by hand; what it is made of — field by field.

Is it legal? What the law in Russia says is collected in a separate explainer.