A VPN went from something I thought about occasionally to something I leave running, after a cruise ship wifi network cost me a PayPal password. Here is what a VPN protects, what it does not, and how to work out whether you need one.
Hacking and identity theft are the kind of thing you assume will happen to someone else, right up until the day it does not. Some people still think a VPN is a business tool, but anyone who travels or connects to shared wifi at a restaurant, a hotel lobby, or an airport is working with the same exposure.
In my case, I was on a cruise to Alaska and I got a message from PayPal that my password had been changed. After looking at the situation, I suspect that someone was using a "packet sniffer" to monitor the traffic on the ship's network and intercepted my account credentials. Since that time, a VPN went from a nice thing to have when I want to cover my tracks or connect to my network at home to something I keep switched on.
What Is A VPN?
A VPN stands for virtual private network. It is an encrypted tunnel between your device and a server run by the VPN provider. Traffic inside that tunnel is unreadable to anyone watching the network you are sitting on, and the sites you visit see the VPN server's address rather than yours.
That tunnel moves your trust rather than removing it. The coffee shop and your internet provider stop seeing where you go, and the VPN company starts. This is the reason a no-logs policy is the first thing to check on any provider you are weighing, and the reason a free service with no clear way of paying for its servers deserves a hard look.
What Has Changed Since 2018
When this article was originally published in 2018, the case for a VPN was blunter than it is now. Plenty of sites still sent data in the clear, which meant someone sharing a coffee shop network with you could pull real information out of the air. That is the internet my cruise ship incident happened on.
Since then, HTTPS has become close to universal. Your bank, your email, and your social accounts encrypt the connection themselves, so a stranger on the hotel wifi is not reading your password out of your traffic the way they might have a decade ago. Anyone still telling you that everything on your devices is absolutely visible without a VPN is describing an older internet.
What a VPN still does is narrower. It hides which sites you are reaching from whoever runs the network and from your internet provider. It protects you on a hotspot you have no reason to trust, including the fake access point with the legitimate-sounding name sitting next to the real one. It covers the apps on your phone that are sloppier about encryption than your browser is. And it puts your traffic somewhere other than where you are standing, which has a set of uses that have nothing to do with security.
What it does not do is make you anonymous. It does not clear your cookies, it does not log you out of anything, and it does not stop a site you are signed in to from knowing exactly who you are. That distinction is worth reading in full, because the gap between what a VPN protects and what people assume it protects is where travelers get burned.
![Bitdefender Premium VPN | 10 Device | 1 Year [PC/Mac Online Code]](https://ads.flowmediamarketing.com/images/inventory/2258-400w.webp)
Five Reasons To Get A VPN Now
Getting a VPN is not a decision to push into next year. Five reasons it earns a place in the rotation:
- Connect to your home or office network when you are away.
- Sidestep geolocation limits on apps that hand out coupons and rewards based on where you are, rather than where you live.
- Protect your banking session on a shared network you do not control.
- Keep your browsing habits away from your internet provider, who is otherwise sitting on a complete list of every domain you reach.
- Break the link between your IP address and the advertisers building a profile around it.
If most of your exposure comes from being on the road rather than at home, the case is even stronger, and I have written separately about why a VPN matters specifically when you travel.
Paid Versus Free VPN Services
Free options exist and some of them are legitimate. A paid service is almost always ahead on:
- performance quality
- number of servers
- security level
- customer service
- privacy
The uncomfortable question with any free VPN is how it pays for the servers, because running them is not cheap and your traffic is the only thing of value passing through. I still run Private Internet Access, and I think it has the most robust security and privacy controls of anything I have used. It is also not always the fastest, and it is not always the easiest to live with. That tradeoff is the decision, and it is why I keep more than one service on hand rather than treating this as a single permanent choice.
If what you want is to keep packet sniffers off your traffic and have your IP show up somewhere other than where you are, you do not need the most configurable option on the market. Surfshark, NordVPN, TunnelBear, ExpressVPN and Proton VPN are all solid for that, and each has its own strengths and weaknesses. Match those against what you will use it for rather than against a review-site ranking. If you are weighing providers now, the features that separate them are worth going through one at a time.
![Norton 360 Deluxe, Antivirus software for 5 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]](https://ads.flowmediamarketing.com/images/inventory/2259-400w.webp)
Who Actually Needs A VPN
Remote workers, frequent travelers, and anyone who does a meaningful amount of work from public networks are the clearest cases. So is anyone who splits their work between an office machine and a home one.
The honest answer for everyone else is that it depends on what you do rather than who you are. If you spend your entire online life on your own network at home, signed in to sites that already encrypt everything, a VPN buys you less than the marketing suggests. If you regularly hand your traffic to a network somebody else runs, the calculation flips.
Set It Up Before The Trip, Not During It
Installing a VPN at the airport and trusting that it connected is how this goes wrong. Before you leave, connect it and load any what-is-my-IP page. If it still shows your real city, the app is running but the tunnel is not, and you would never know from looking at the icon.
Do that once at home, where fixing it costs you five minutes instead of a vacation.