Choosing a VPN Safely: Plain-English Guide

A VPN app asks you to trust one company with everything you do online, yet most people pick one from an advert or the top of an app store list. A VPN (virtual private network) is a service that sends your internet traffic through an encrypted tunnel, a scrambled connection, to the VPN company's computers before it goes on to the websites you visit. That can be useful, but it moves your trust rather than removing the need for it, and some "free VPN" apps have turned out to be harmful. This guide explains, in plain English, what a VPN does and does not do, whether you need one, how to judge a provider without relying on marketing, and how to set one up safely. It is for households, families, older people and very small businesses. It does not recommend any product.

Key takeaways

A VPN moves trust, it does not remove it. Your internet provider or the café Wi-Fi can no longer see which sites you visit, but the VPN company can.
Many people do not need one. Most websites already encrypt your connection. Updates, strong passwords and 2-step verification protect you more.
Judge the company, not the advert. Look for named owners, a clear no-logging policy, independent audits and an honest way of making money.
Be very wary of free VPNs. Running a VPN costs money. If you are not paying, ask who is, and how.
Your work VPN is different. If your employer gives you a VPN, use that one for work, set up the way they say.

What a VPN does, and what it does not

When you switch a VPN on, websites see the VPN company's internet address (IP address) rather than yours, and your own internet provider or the owner of the Wi-Fi you are using sees only that you are connected to a VPN. The Electronic Frontier Foundation (EFF), a digital rights charity, sets out the limits clearly in its Surveillance Self-Defense guide.

A VPN can	A VPN cannot
Hide the websites you visit from your internet provider and from whoever runs the Wi-Fi you are on	Hide what you do from the VPN company itself, which can see your traffic in the same way your provider could
Hide your home IP address, and with it your rough location, from the websites you visit	Make you anonymous: cookies, logins, tracking pixels and device "fingerprinting" can still identify you
Add protection on untrusted public Wi-Fi, especially for apps that do not encrypt their own traffic	Stop you typing your password into a scam website, or protect you from a phishing email
Connect you to your work network or your home network while you are away	Remove viruses, or fix a phone or laptop that is out of date
Sometimes get round location-based blocks	Guarantee streaming services will work: many now block known VPN addresses

EFF's own conclusion is that a VPN is rarely the most important security step. Strong unique passwords, 2-step verification, keeping devices updated and using encrypted messaging apps usually matter more.

Do you actually need a VPN?

Use the situations below to decide. If none fits, you can probably spend the money and effort elsewhere.

You often use public Wi-Fi in cafés, hotels or stations: a VPN adds a layer, but most sites already show the padlock that means the connection is encrypted. Using your phone's mobile data, or sharing it with your laptop, is often just as good. See the Public Wi-Fi Safety Guide.
You do not want your internet provider to see which sites you visit: a VPN does this, at the price of the VPN company seeing them instead. Decide which of the two you trust more.
You work from home or travel for work: use the VPN your employer provides, not a personal one, for work data. See the Home Office and Remote Worker Security Guide.
You want to reach your own home devices while away: some routers and network storage boxes include their own VPN feature. This is a different use from a commercial VPN app and needs careful setup.
You use an iPhone, iPad or Mac and mainly want privacy while browsing: Apple's iCloud Private Relay, part of a paid iCloud+ subscription, sends Safari browsing through two separate relays so that, in Apple's words, no single party can see both who you are and which sites you visit. It is not a full VPN and is not available in every country.
You need real anonymity, for example as a journalist or activist: EFF points to Tor rather than a VPN. Get specialist advice.

How to judge a VPN provider

You cannot check a VPN company's computers yourself, so you are judging how trustworthy it is from the outside. EFF's advice is to treat every marketing claim as unproven, because a claim is not the same as a guarantee. Work through these questions before you pay.

Question	Good sign	Warning sign
Who runs it?	A named company with named people, an address and a history you can look up	No named owners, or ownership that is hard to find
What does it record (log)?	A privacy policy that clearly says it does not keep records of the sites you visit or your connections	Vague wording. If the policy does not clearly rule out logging, assume it logs
Has anyone checked?	Independent security audits, published and recent, plus transparency reports on government requests	No audits, or only claims of being "military grade" or "100% anonymous"
How does it make money?	A clear subscription price	Free with no explanation, or an app full of adverts. Free services may make money by selling data
Which technology does it use?	Modern connection methods (protocols) such as WireGuard, OpenVPN or IPsec	Older methods such as PPTP, which EFF and the NCSC both say to avoid
Which country is it based in?	You understand which country's laws apply to it and how it handles legal requests	Its location is unclear

Two more points. Being listed in the Apple App Store or Google Play is not proof that a VPN is safe: EFF notes that Google's "Verified" VPN badge reflects the app's own promises, not the company's servers. And an audit is a snapshot: a company can change its practices afterwards. Look for recent news stories about the provider misleading customers before you sign up.

Technical readers comparing connection methods can see the VPN Protocols Compared: WireGuard, IPsec, OpenVPN Guide.

Free VPNs and fake VPN apps

A VPN app needs deep access to your phone or computer, because everything you do passes through it. That makes it an attractive disguise for criminals.

In May 2024 the US Department of Justice announced it had dismantled the "911 S5" botnet, a network of infected home computers that criminals rented out to hide their own activity. According to the Department, the malware was spread partly through VPN programs called MaskVPN and DewVPN, and through pirated software. It was linked to more than 19 million internet addresses, and fraudsters used the hijacked home connections in schemes including pandemic benefit fraud with confirmed losses of over 5.9 billion US dollars. These are allegations in an indictment, not court findings, but the lesson for consumers is plain: an unknown VPN app can turn your computer into a tool for someone else's crime. See the Botnets Guide for how botnets work.

Only install from the official app store or the provider's own website, never from a link in a pop-up, an advert or a pirated software bundle.
Check the permissions: a VPN app has no reason to ask for your contacts, photos, microphone or text messages.
Be suspicious of urgency: pop-ups saying "your connection is not secure, install this VPN now" are a common trick.

Set it up safely

Do your checks first using the table above, and read the privacy policy section on logs.
Pay in a way you can manage: note the renewal date. EFF warns that subscriptions keep billing you if you forget to cancel.
Install the official app, then protect the VPN account with a strong unique password, stored in a password manager, and 2-step verification if offered.
Turn on automatic connection: a VPN only helps while it is on. On Android, VPN settings live under Settings, Network & internet, VPN. For VPNs set up there you can tap the gear icon and switch on Always-on VPN. App-based VPNs usually have a similar option inside the app. Menus change, so check the provider's help pages.
Look for a "kill switch" option: many apps offer a setting, often called this, that blocks internet access if the VPN drops, so your traffic does not silently go out unprotected.
Check it works: you should see a VPN indicator (a key or "VPN" symbol) at the top of your phone screen when connected.
Keep the app updated, like any other app.
To stop using it, cancel the subscription, then remove the app and the VPN profile. On Android, tap the gear icon next to the VPN and choose Forget.

Signs something is wrong

The app asks for odd permissions or keeps asking you to install other software.
Your device slows down, heats up or uses much more data even when you are not using it.
Your internet provider warns you about unusual activity from your connection, or websites keep showing you "unusual traffic" checks.
Unexpected charges appear from the VPN company or an app store.
The provider changes hands or rewrites its privacy policy to allow logging or data sharing.

What to do if it happens

Disconnect and uninstall the VPN app, and remove its VPN profile from your device settings.
Run your device's built-in security scan and install all updates.
Change passwords for important accounts, starting with email, from a device you trust, and turn on 2-step verification.
Cancel the subscription and ask your bank about blocking further payments if needed.
Report it if you lost money or think your device was used for crime (see below).

Where to get help

Report Fraud (England, Wales and Northern Ireland): the national service for reporting fraud and cyber crime, which the NCSC now points people to, at reportfraud.police.uk or 0300 123 2040. In Scotland, call Police Scotland on 101.
NCSC: its top tips for staying secure online cover the steps that usually matter more than a VPN.
Your bank: call the number on the back of your card at once if payment details may have been misused.
United States: report cyber crime to the FBI's Internet Crime Complaint Center at ic3.gov. The FTC also takes fraud reports at ReportFraud.ftc.gov (the site was offline during the October 2026 government shutdown when we checked).

For organisations, see the VPN Security Guide.

Common failure patterns

Choosing by advert: picking the VPN with the biggest discount or the boldest promise, without checking who runs it.
Installing a free VPN from an unknown developer, or one bundled with pirated films or software, which is how the 911 S5 malware spread.
Thinking a VPN makes you invisible: logging in to your accounts, cookies and tracking still identify you.
Using a personal VPN for work: it can break your employer's protections and may break their rules.
Leaving it switched off: paying for a VPN that only connects when you remember, which is rarely when you need it.
Forgetting the renewal: paying for years for a service nobody uses, or letting an old, unmaintained app sit on a device.

Practitioner checklist

Decide what you want a VPN for, using the "Do you actually need a VPN?" section.
Do the basics first: updates on, strong passwords, 2-step verification.
Check the provider: named owners, clear no-logging policy, recent independent audit, honest pricing.
Avoid free VPNs from unknown developers and anything offered in a pop-up.
Install only from the official app store or provider website, and check permissions.
Protect the VPN account with a unique password and 2-step verification.
Turn on automatic connection and the kill switch if available.
Use your employer's VPN, not a personal one, for work.
Note the renewal date and review the choice once a year.
Save the Report Fraud number, 0300 123 2040, somewhere you can find it.

Choosing a VPN Safely Guide: Plain-English Steps to Stay Safe