What is a VPN?The mechanism in plain terms, with measurements

A VPN is one idea, and it is simpler than the marketing around it suggests. Your device opens an encrypted connection to a server run by the provider, and everything you send goes through it. Two things follow, and they are the only two things a VPN does.

The network you are sitting on — the café, the hotel, your home ISP — sees one encrypted connection to one address, and cannot see which sites are on the other end. And the sites you open see the server's address, which carries the server's country, rather than yours.

• Everything goes through one encrypted connection to a server you choose
• The network you are on cannot see which sites you open
• Sites see the server's country instead of yours
• It costs speed: we measured 40% to 90% of a line surviving
• It does not make you anonymous, and it does not clean an infected device

What changes, exactly

Your visible address. Every site you connect to logs an IP address, and that address carries a country. Through a VPN it is the server's. This is what makes region-locked services work, and it is the whole mechanism — there is nothing cleverer happening underneath.

What the local network can see. Without a tunnel, the operator of the network can build a list of every site you connected to, even where the content itself is encrypted, because the destination is visible in the connection setup and in DNS lookups. Through a tunnel, that list is one entry long.

Nothing else. Not what you are signed in to, not what your browser reports about itself, not the cookies you already carry. Those identify you regardless of which address you arrive from.

What it costs, measured rather than estimated

A tunnel adds a hop, and the hop costs throughput. We measured how much across 14 cities and 46 paired runs: between 40% and 90% of the raw line survived. In London, about 90% on both services we tested. In Tokyo, about half.

The useful thing about that spread is what it says about blame. Two services, same week, same method — and the difference between two cities was far larger than the difference between the services. If a VPN feels slow, the route is the first place to look, not the brand.

What it does not do

This is the part that sells fewer subscriptions and is worth more to you.

It does not make you anonymous. It removes one identifier. Your accounts, your payment methods, your browser fingerprint and the cookies already on your device are untouched. If you sign in to something, you have identified yourself, whatever address you arrived from.

It does not protect a compromised device. A tunnel carries whatever the device sends, including what it sends without being asked.

It does not stop you giving away credentials. A convincing fake login page works exactly as well through an encrypted tunnel.

It does not make anything legal. It changes which address a service sees, not what the law says about what you do.

It does not change an account's country. That is a billing record, and no amount of connecting from elsewhere alters it.

How to tell providers apart, when they all claim the same things

Every provider says fast, secure, no logs. Four things are checkable rather than asserted, and we collect all four.

• Does it have servers where you need them? Not a total — the count for your country. We recount that daily for 155 countries.
• Does it have more than one city there? That is your fallback when an address is blocked.
• Who audited the no-logs claim? Five of seven name a firm. A name you can look up is a different claim from "independently audited".
• Which country's law does it operate under? Five of seven publish it. It decides how a legal demand is handled.

Where the idea came from, and why that still matters

VPNs were built for companies, not for streaming. The original problem was letting an employee at home reach an internal system as though they were in the office, safely, over a network nobody controlled. Everything the consumer product does is a side effect of that design.

It is worth knowing because it explains the shape of the tool. The tunnel is excellent at what it was built for — making a hostile network irrelevant — and incidental at what it is sold for. Region-shifting works because addresses carry countries, not because anyone designed it that way.

How much speed actually survives the tunnel

Every VPN site says a tunnel costs you speed. Almost none of them say how much. We measured it by hand rather than repeating a claim: 14 cities, 46 paired runs, comparing NordVPN and Surfshark against the same raw line in the same session. In the 11 cities where we also measured the bare line, the share that survived the tunnel ranged from 40% to 90%.

Measured by VPN LIFE. Raw-line figures are rounded to the nearest 10 Mbps. Percentages are the share of the raw line that survived.

• 14 cities, 46 paired runs, measured by hand
• 11 of those cities also have the bare line measured
• 40% to 90% of the raw line survived
• We only name a winner in 4 cities — the rest have too few runs

The spread between cities is larger than the spread between providers. In London roughly nine tenths of the line survived on both services; in Tokyo it was closer to half. That is worth knowing before you blame the provider: "this VPN is slow" is usually "this route is slow".

We only call a winner in a city when we have five or more paired runs there and the gap is at least 10%. That threshold is met in 4 of the 14 cities — Tokyo and Los Angeles, where NordVPN averaged ahead, and London and New York, where the two were level. In the remaining ten cities we publish the numbers and say the sample is too small, rather than ranking on one run.

The apps behind our measurements

The providers we track

We rank on what we can check. Each of the five below publishes a location in this use; the tables are our own counts and the providers' own published terms, not a summary of their marketing.

ExpressVPN: the widest spread of cities

ExpressVPN publishes more multi-city countries than anyone else in our set — 11 countries where you can pick between two or more locations, including 56 in the United States, 7 in the United Kingdom, 6 in Australia and 4 in Japan. If your problem is a blocked address rather than a missing country, that spread is the thing that gets you out of it. It is the most expensive option here, and it is the one we would pick for streaming.

ExpressVPN in use

NordVPN: the largest country list, and the one we measured

NordVPN covers more countries than anything else we track. It is also one of the two services we measured ourselves, so the retention figures above are its actual numbers rather than a claim. It operates from Panama, has been audited by Deloitte, allows 10 simultaneous connections, and lists obfuscated servers and a kill switch among its features — the two things that matter where VPN traffic is filtered.

NordVPN in use

Surfshark: unlimited devices, and level with NordVPN in half our tests

Surfshark is the other service in our own measurements. In London and New York it was level with NordVPN; in Tokyo and Los Angeles it trailed by 11% and 17%. It places no limit on simultaneous connections, which makes it the sensible choice for a household rather than a person. Audited by Deloitte, operating from the Netherlands, with Camouflage Mode for networks that filter VPN traffic.

Surfshark in use

CyberGhost: the longest money-back window, with a catch

CyberGhost's 45-day money-back guarantee is the longest here, and it is the reason it appears on most lists. Read the condition: 45 days applies to the six-month and two-year plans, and the monthly plan gets 14 days. It publishes 10 multi-city countries, with 11 locations in the United States, but only a single city in Japan — so it is a weaker choice if Japanese services are your target.

CyberGhost in use

Private Internet Access: unlimited connections, US jurisdiction

PIA places no limit on devices and publishes an Advanced Kill Switch, obfuscation, multi-hop and port forwarding. Its no-logs claim has been audited by Deloitte Audit Romania. The trade-off is jurisdiction: it operates from the United States, which some readers will rule out on principle. We list it because the rest of the record is strong and because it is one of only four providers with two or more cities in Japan.

Private Internet Access in use

Frequently asked questions

Will it slow my connection down?

Yes, and we have measured how much: across 14 cities and 46 paired runs, between 40% and 90% of the raw line survived the tunnel. The variation between cities is wider than the variation between providers — London kept about 90% on both services we tested, Tokyo about half. If a VPN feels slow, the route is a more likely explanation than the provider.

Can I use a free VPN for this?

Usually not, and the reason is measurable rather than moral. Even on paid services we measured, between 10% and 60% of the raw line disappears into the tunnel — in Tokyo a 780 Mbps line came out at roughly half. Free tiers add a data cap and a much smaller server list on top of that. They also have to earn money somewhere, and where the product is free the revenue usually comes from the traffic itself.

Is using a VPN legal?

In most countries, yes, and no registration is required. A small number restrict either the use or the provision of them. Separately, most streaming services prohibit using one to change your apparent region — that is an account matter rather than a legal one, and the two get run together constantly.

What else is a VPN good for?

The everyday case is public Wi-Fi, where the network operator would otherwise see every site you connect to. The other common ones are reaching services from home while travelling — banks and government portals refuse foreign addresses constantly — and comparing prices that vary by country. We publish the underlying server and speed data for all of it on our open data page.

Conclusion

One encrypted connection, one changed address, and a measurable speed cost. Everything else you have read about VPNs is a consequence of those three facts or an exaggeration of them.

We publish the measurements rather than adjectives, including the cases where our sample is too small to conclude anything.

Every figure on this page comes from our own daily collection or our own measurements. The files are published as open data under CC BY 4.0, and the method — including what the numbers do not prove — is on how we test.