How Does a VPN Work? The Short Answer

Your device opens an encrypted connection to a server run by a provider you chose, and sends its internet traffic through that connection instead of straight out to the network you are sitting on. The provider passes your traffic onward and sends the replies back the same way. That is it.

This page is deliberately brief. The fuller version, and the reason the three-party picture is the part worth keeping, is in how a VPN works, in just enough detail to travel with one.

Which question are you actually asking?

“How does a VPN work” usually stands in for one of three narrower questions, and they have different answers.

“What does it change about who can see me?” The network you are on loses sight of which services you use; the service you reach sees the provider’s address instead of yours; the provider sees both ends. The limits of that are in what a VPN does not change about your location.

“Why is it not working here?” Almost always the network beneath it rather than the tunnel itself — most often a guest network that needs you to sign in first, covered in why hotel and airport Wi-Fi breaks your VPN. If a specific site is refusing you rather than the tunnel failing, work through blocked by the network or the service.

“Will it get me access to something?” Sometimes, and less often than advertised. It depends on whether the service decided from your address or from your account, which is set out in how a website decides which country you are in.

What you do not need to know

Protocol names, key exchange, and the details of how each packet is wrapped make no difference to any decision you will make as a traveller. Everything practical follows from the one-paragraph answer above: traffic goes to a server you chose before it goes anywhere else.

Bottom line

Encrypted connection to a server you picked, traffic forwarded from there, replies back the same way. If you want more than that, read the longer version — and if you are here because something is broken, it is far more likely to be the network you joined than the tunnel you are running.

Editorial note: this page duplicates the question answered at how a VPN works and exists only because the URL predates that post. It is kept short rather than padded into a second version of the same article.