Does a VPN make me invisible?

Dan is at a café, on its free Wi-Fi, scrolling. An ad pops up: a little figure in a cloak, and the promise “Be INVISIBLE online!”

“This ad says a VPN makes me invisible online,” says Dan. “Sold!”

“Invisible?” says Liz. “Let's follow your browsing.”

Stop one: the lock your sites already have

Every page Dan opens travels from his phone, through the café's Wi-Fi, through his internet provider, and out to the website. Think of each one as an envelope.

The first surprise: almost every envelope is already sealed. That padlock next to the web address means the site uses HTTPS, which scrambles what's inside so nobody along the way can read it. Google says 95 to 99% of the pages people open in Chrome now come with that lock. That's why the FTC says using public Wi-Fi is “usually safe” these days: passwords, messages and card numbers on those sites are locked before they leave your phone.

What the café and your provider can still see

The lock hides what's inside the envelope, but not the address on the front. The café's network, and your internet provider, can usually still see which sites you visit: “recipes”, “shoes”, “weather”. Not the recipe you read or the shoes you bought. Just the names.

The same goes for anyone else on that Wi-Fi. When we say “the café”, we mean everyone sitting in the café's seat: the owner, the person at the next table, or a fake hotspot pretending to be the café.

What a VPN changes

A VPN puts all your envelopes inside a sealed tunnel that runs from your phone to the VPN company. From there, they continue to the websites.

Who's watching	Without a VPN	With a VPN
The café's Wi-Fi (and anyone on it)	Which sites you visit	That you use a VPN, and which one
Your internet provider	Which sites you visit	That you use a VPN, and which one
The VPN company	Nothing	Which sites you visit

So yes, the café and your provider now see just the tunnel. That's real, and on networks you don't trust, it's useful.

What it doesn't hide

“So I'm invisible!” says Dan.

“To the café,” says Liz. “Not to everyone.”

• The sites you sign into still know it's you. Log in to your email, your bank or a social network, and they know exactly who's there, VPN or not. The EFF puts it plainly: “A VPN is not a tool for anonymity.”
• The VPN company now sees what your provider used to. The tunnel doesn't make the site names disappear; it hands them to a different company. You're moving your trust, not removing the need for it. Many VPNs promise they keep no logs, but the EFF warns that “a claim is not a guarantee.” In 2022, members of Congress asked the FTC to act on VPN providers making false claims, citing a Consumer Reports study that found 75% of leading VPN providers misrepresented their products or made hyperbolic claims.
• A scam link is still a scam. A VPN changes the road to a website, not what the website is. A fake bank page is just as fake at the end of a tunnel.

Can someone on the Wi-Fi still reach my phone?

Yes, they can still try. A VPN wraps the traffic leaving your device, but your phone or laptop is still sitting on the café's network. On an up-to-date device that's rarely a real risk, and the protection comes from your settings, not a VPN:

• Keep your devices updated. Updates close the holes attackers look for.
• On Windows, pick “Public” for café Wi-Fi. Microsoft says this hides your PC from other devices on the network, which also turns off file and printer sharing there, and recommends it in most cases.
• Keep AirDrop on “Contacts Only” or “Receiving Off” (in Control Center on an iPhone).

What about watching shows from another country?

That's one of the most common reasons people buy a VPN: to make a streaming service think you're somewhere else. Two things to know. Netflix's terms say you can watch “primarily within the country” where you set up your account, and only what it has licensed there. And Netflix, like other services, detects many VPNs and shows an error (“You seem to be using a VPN or proxy”) instead of the show. So it often doesn't work, and it's against the rules when it does.

So, do you need one?

Back at his coffee, Dan closes the ad. “So my sites' lock already does most of the work.”

For most people, most of the time, that's our take too. A VPN makes sense if you often use networks you don't trust, or you'd rather your internet provider didn't see which sites you visit, and you're comfortable trusting the VPN company instead. Your job may also give you a work VPN, which is a different tool for reaching your office's network. But a VPN won't make you anonymous, and it won't stop the scams that cause most real trouble online.

What you can do

• Look for the padlock in the address bar, especially before you type a password or card number.
• Ask what you want hidden, and from whom, before you pay for a VPN. It hides which sites from the Wi-Fi and your provider, and shows them to the VPN company.
• Read the VPN's privacy policy. “No logs” is a promise, not a guarantee.
• On café Wi-Fi, keep your devices updated, set Windows to “Public”, and keep AirDrop on “Contacts Only”.
• Check links before you tap them. No tunnel turns a fake page into a real one.