What Is a VPN and What Does It Do?
Updated on
A VPN, or virtual private network, is an encrypted tunnel between your device and a server somewhere else, carrying all of your internet traffic. The network you are on sees only scrambled packets; the sites you visit see the server's address instead of yours. Here is how that works, and where it stops.
Virtual private network, explained
The idea comes from the corporate world. Companies with several offices once paid for dedicated private lines to connect them. A VPN replaced those lines with an encrypted tunnel running over the public internet: private in effect, virtual in construction. The same mechanism is now used by individuals, not to reach a company network, but to protect their own connection and choose where it appears to come from.
Each word in the name earns its place. Network: your device and the server behave as if they shared a local network. Private: the traffic between them is encrypted, so nobody in the middle can read or alter it. Virtual: no physical cable is involved; the tunnel rides on whatever connection you already have, whether home fiber, hotel Wi-Fi, or a mobile plan.
How a VPN works: the tunnel, step by step
When you switch the VPN on, the app on your device and the provider's server exchange cryptographic keys and agree on an encrypted channel. From that moment, every packet leaving your device is encrypted and wrapped inside a second packet addressed to the VPN server. The network you are connected to, whether a café's Wi-Fi or a mobile carrier, sees only those outer packets. It can tell you are talking to one server; it cannot read the contents or learn the real destination.
At the server, the outer packet is removed and your request is sent onward to the internet using the server's own IP address. The reply travels the same road in reverse. As far as the website is concerned, you are in the city where the server sits. As far as your local network is concerned, you are exchanging data with a single address and nothing else.
The encryption depends on the protocol. With WireGuard, which SuaVPN uses, traffic is encrypted with ChaCha20-Poly1305 and keys are exchanged with Curve25519, both modern and publicly reviewed. WireGuard also offers no weaker options to fall back on, which removes a whole class of misconfiguration.
What does a VPN do for you?
A VPN does four practical things: it hides the sites you visit from the network you are on, replaces your IP address with the server's so websites cannot place you, keeps your internet provider from listing the domains you open, and lets your traffic exit from another location. Most people buy one for two of those.
Knowing which of the four is yours makes comparing providers much easier, because the criteria that matter change with the reason.
Two things are deliberately missing from the list below: a VPN does not make your connection faster, and it does not get you around a mobile data cap, because the carrier still counts every encrypted byte.
- Privacy on public Wi-Fi: the hotel, airport, café, or campus network stops seeing which sites and services you connect to.
- Hiding your IP from websites: they see the server's IP, not yours, and cannot place you by your connection.
- Keeping your internet provider from building a list of the domains you visit, since DNS lookups travel inside the tunnel too.
- Appearing in another country: your traffic exits from the location you picked, so websites place you there. The locations you can connect to are the ones listed on the status page.
- Remote work: reaching a company network over a corporate VPN, which uses the same technology for a different purpose.
Does a VPN slow down your internet?
Yes, a little, and distance is almost always the reason rather than the encryption. WireGuard's cryptography costs very little on a modern phone or laptop; what you feel is the extra trip your packets take to the server and back. A nearby location is barely noticeable, one across an ocean is not.
Two other things matter: how many people share the server at that moment, and the quality of the provider's own upstream connection. Neither is something a landing page can promise, which is why SuaVPN publishes the state of each location on the status page instead of speed figures, and gives you seven days to test it on your own connection.
The VPN entry in your phone settings
Android and iPhone both have a VPN entry in their settings, which leads many people to assume the phone ships with a VPN service. It does not. That entry is the operating system's built-in support for tunnels: it lets an app such as the official WireGuard client create one and route all of the phone's traffic through it. When a tunnel is active, Android shows a small key icon and iPhone shows a VPN badge in the status bar.
This is also why SuaVPN has no app of its own. The tunnel is built by the free, open-source WireGuard app on every platform; your SuaVPN dashboard generates one configuration per device, imported by scanning a QR code on a phone or loading a .conf file on a computer, each with its own revocable key pair. Step-by-step guides live on the apps page and in our walkthroughs for Android, iPhone, Windows, Mac, and Linux.
What a VPN is not
It is not anonymity. Any service you sign in to knows who you are with or without the tunnel; cookies and browser fingerprints keep working as before. It is not antivirus: a malicious link opened inside the tunnel is still malicious. It is not Tor, which bounces traffic through several volunteer relays and trades speed for a much stronger form of anonymity. And it is not a browser proxy, which covers a single application and often sends data in the clear, whereas a VPN covers the whole device with encryption.
Turning a VPN on is a trade, and it is worth stating plainly: you stop trusting the local network and start trusting the VPN provider, which now sits where your internet provider used to. That makes the provider's written logging policy the most important thing to read before you pay, ahead of server counts and speed claims.
| VPN | Browser proxy | Tor | |
|---|---|---|---|
| What it covers | The whole device: every app, plus DNS lookups | One program, usually the browser | Apps set up for it, mainly the Tor Browser |
| Encryption | Yes, from your device to the VPN server | Often none | Yes, in layers across three relays |
| Who can see your destinations | The VPN provider | The proxy operator, and often the local network too | No single relay sees both you and the destination |
| Speed | Close to your normal connection | Varies with the operator | Noticeably slower, by design |
| Choosing the exit country | Yes, among the listed locations | Sometimes | Limited, and never guaranteed |
| Who pays for it | Your subscription | Free or paid, often unclear | Volunteers who run the relays |
VPN types, protocols, and legality
A personal VPN, bought for privacy, and a corporate VPN, used to reach an office network from home, run on the same technology with different goals. Three protocols are in wide use today: WireGuard, modern, small, fast, and part of the Linux kernel; OpenVPN, mature and flexible but heavier and slower to connect; and IKEv2/IPsec, common on mobile devices and in corporate setups. Older protocols such as PPTP are considered broken and should not be used.
Using a VPN is legal in most countries, including Brazil, the United States, and EU member states; encrypting your own connection is ordinary internet use. Anything illegal without a VPN remains illegal with one. A handful of countries restrict or block VPN traffic, so check local rules before relying on the tunnel while traveling.
Want to try one? SuaVPN's plans differ only in device count: Basic with 3, Pro with 5, Family with 10. Current prices are on the pricing page, in Brazilian reais, payable by card through Stripe from anywhere. You can cancel at any time, and under Brazilian consumer law you have seven days from purchase to ask for a full refund. Questions before or after signing up go to the support page.
| Protocol | Where it fits | What to know |
|---|---|---|
| WireGuard | The current default, and what SuaVPN runs | Small codebase, modern cryptography, built into the Linux kernel, reconnects quickly |
| OpenVPN | Mature and supported almost everywhere | Flexible and heavily reviewed, but heavier and slower to establish |
| IKEv2/IPsec | Common on phones and in corporate setups | Handles network changes well; more moving parts to configure |
| PPTP | Obsolete | Its cryptography is broken; do not use it |
Frequently asked questions
What is a VPN, in one sentence?
An encrypted tunnel between your device and a server that hides your destinations from the network you are on and shows websites the server's IP address instead of yours.
What does a VPN do on a phone?
The same as on a computer: once the WireGuard app has a profile and the tunnel is on, every app on the phone sends its traffic through the tunnel, on Wi-Fi and on mobile data alike.
Is WireGuard safe?
The protocol is publicly documented and reviewed, encrypts traffic with ChaCha20-Poly1305, exchanges keys with Curve25519, and ships inside the Linux kernel. Beyond the tunnel, safety depends on the provider: read the logging policy and check that each device gets its own key.
Do I still need a VPN if websites use HTTPS?
HTTPS encrypts the content of each page but not which sites you visit or your DNS lookups. A VPN covers that gap and protects you from rogue Wi-Fi networks that imitate legitimate ones.
What is the difference between a VPN and a proxy?
A proxy redirects one application, usually the browser, and often without encryption. A VPN routes the whole device through an encrypted tunnel.
Does SuaVPN have its own app, a browser extension, or split tunneling?
No. SuaVPN runs on the official WireGuard app with a profile generated per device. There is no browser extension, no dedicated IP, no business plan, and no split tunneling: the profile routes all of the device's traffic through the tunnel.
Sources
Try SuaVPN
WireGuard, a card subscription, several devices per subscription and cancellation whenever you want.
See plans