What a VPN Really Is

For years I heard about VPNs and ignored them, just like antivirus software: I don't use antivirus, or almost never. I keep real-time copies of everything in three places, and I am very careful about what I download, which links I click, and which websites I visit. It isn't one-hundred percent security, but it works for me. One day I saw a VPN offer for just over two euros a month and signed up out of curiosity. It works well, but it has served me little: for instance, testing a service that was only open in the United States back then. Do I feel safer? No. If they offer it to me at that price again, I might renew; if not, no. It is just my experience; it proves nothing. So I asked myself what a VPN actually does. Here is how I understood it.

Imagine you drop a letter into the mailbox with the recipient's address clearly visible. The mail carrier sees who you are sending it to, even if they cannot read it when it is sealed. That mail carrier is your internet provider. A VPN puts your letter inside another envelope, addressed to an intermediary who opens it and forwards it. Your usual mail carrier no longer sees the real address. They only see that you are writing to that intermediary.

Whoever controls the network you connect from, like airport Wi-Fi, stops seeing where you go. But the intermediary now sees what your provider used to see, and sometimes more, because all your traffic passes through them. The surveillance does not disappear: it changes hands. Hence the name.

Furthermore, almost everything you do today, such as opening your email or logging into your bank, already travels encrypted to the destination server thanks to the browser's padlock. That happens with or without a VPN. A VPN adds protection only on the first leg, up to its own server. From there, the path is the usual one.

That is why there are things it cannot promise you, even if it is sometimes marketed that way. If you have signed into your email or bank, that service knows it is you, with or without a VPN. Nor does it guarantee that no one is watching your traffic: it only changes who is watching. When the company claims it «keeps no logs», that is a promise, just like when a large platform says «your messages are encrypted, we don't read them». An audit may back it up at a given moment, but it remains something you trust to be honored, not something that cannot be broken by design.

And the content of a conversation remains the same. If your messaging app already encrypts end-to-end, a VPN adds nothing. If it doesn't, a VPN doesn't fix it either: it protects the path of the message, not what the app or its server do with it upon arrival.

None of this makes it useless. Hiding where you connect from public Wi-Fi, from a provider that might sell that history, or from a country blocking a service is real work, and it does it well. Marketing, however, usually promises far more than that layer can deliver.

The question worth asking, with a VPN or any service that promises to protect you, is not «is it encrypted?». Probably yes, at least along one stretch. It is this one: in whom am I placing the trust I took away from someone else? And what am I left with if it proves unwarranted?

A VPN, when it does its job well, only changes who the intermediary of your connection is. An app like Solo2, whose messages pass through no server at all, removes the intermediary from the conversation. They do not compete: they solve different problems.

Confusing them is a very common way to believe you are more protected than you actually are.