A VPN, or Virtual Private Network, is one of those tech terms that gets thrown around constantly yet rarely explained well. At its core, a VPN is a service that encrypts your internet connection and routes your traffic through a server in a location of your choosing, masking your real IP address and making it much harder for anyone to monitor what you are doing online. Whether you are working from a café, travelling overseas, or simply trying to keep your browsing private, a VPN has become one of the most practical digital tools available to everyday Australians.
How a VPN works, step by step
When you connect to the internet without a VPN, your device communicates directly with websites and services. Your internet service provider (ISP) can see every request you make, and any server you connect to can see your IP address, which reveals your approximate location. A VPN inserts an encrypted tunnel between your device and the internet. Here is what happens when you switch one on:
- Your device connects to a VPN server, usually operated by the VPN provider in a data centre somewhere in the world.
- All of your internet traffic is encrypted before it leaves your device, meaning your ISP can see only that you are connected to a VPN server, not what you are actually doing.
- The VPN server makes requests on your behalf and passes the responses back to you. Websites see the VPN server's IP address, not yours.
- When the data returns to your device, the VPN client decrypts it so you can read it normally.
The encryption is the critical part. Most reputable VPNs use AES-256 encryption, the same standard used by governments and financial institutions. Breaking that level of encryption with current computing power would take longer than the age of the universe, which gives you a sense of how robust it is. This is a far cry from the unprotected traffic that flows across open Wi-Fi networks, where a technically minded eavesdropper can intercept unencrypted data with relatively modest effort. The relationship between VPNs and broader cybersecurity practices is direct: a VPN is one of the most accessible layers of defence an ordinary user can add without needing specialist knowledge.
What a VPN does and does not protect you from
A VPN is a powerful tool, but it is not a magic shield. Understanding its limits matters just as much as understanding its strengths.
A VPN protects your data in transit. If you are using public Wi-Fi at an airport or hotel, a VPN stops anyone on the same network from intercepting your traffic. It also prevents your ISP from logging your browsing habits and selling that data to advertisers, which is a documented practice in many countries. Additionally, it masks your location, which is useful for accessing content that is geographically restricted, such as streaming libraries or news sites that are blocked in certain regions.
However, a VPN does not make you fully anonymous. Your VPN provider can, in principle, see your traffic, which is why the provider's logging policy matters. A no-logs provider that has been independently audited is meaningfully different from one that keeps detailed records of your activity. A VPN also does not protect you from malware, phishing attacks, or the data you voluntarily hand over to apps and websites. If you log into Facebook through a VPN, Facebook still knows it is you. The VPN only hides your activity from network-level observers, not from the services you interact with directly.
VPN protocols: the engines under the bonnet
The term "protocol" refers to the set of rules that governs how the encrypted tunnel is built and maintained. Different protocols make different trade-offs between speed, security, and compatibility. The most common ones you will encounter are:
- OpenVPN: An open-source protocol that has been audited extensively. It is considered highly trustworthy and is supported on most platforms, though it can be slower than newer alternatives.
- WireGuard: A newer protocol that is leaner, faster, and arguably simpler to audit than OpenVPN. It has become the default for many leading VPN services in recent years.
- IKEv2/IPSec: Particularly good at reconnecting quickly when your network drops, making it popular for mobile devices that switch between Wi-Fi and mobile data.
- L2TP/IPSec and PPTP: Older protocols that are now considered weaker. Most security professionals recommend avoiding them if a better option is available.
Most consumer VPN apps handle protocol selection automatically, defaulting to the fastest option that still meets a strong security standard. For the majority of users, this is perfectly adequate. Understanding that the underlying mechanics matter, though, helps you ask better questions when choosing a provider.
When should you actually use a VPN?
Not every browsing session demands a VPN, but there are situations where using one is genuinely sensible. Public Wi-Fi is the most obvious case: coffee shops, hotels, airports, and libraries all offer networks that can be monitored by others on the same connection. Turning on a VPN before checking your bank account or sending a sensitive email on public Wi-Fi is a straightforward precaution.
Travellers benefit significantly. Many countries restrict access to services like Google, WhatsApp, or certain news websites. A VPN can route your traffic through a server in a different country, bypassing those restrictions. Similarly, Australians travelling abroad sometimes find that streaming services they pay for at home have different libraries overseas. A VPN set to an Australian server can restore access to the content they are used to.
For those who value privacy as a matter of principle, running a VPN at home prevents your ISP from building a profile of your browsing behaviour. This is a reasonable position to hold in an era when data collection is pervasive. The same logic that applies to understanding machine learning and how it processes personal data applies here: the less raw data that flows from your device to third parties, the less there is to be used or misused.
Choosing a VPN: what to look for
The VPN market is crowded and, frankly, uneven in quality. Several factors separate genuinely trustworthy services from those that are more marketing than substance.
The most important is the logging policy. Look for providers that operate under a verified no-logs policy, ideally one that has been confirmed through an independent audit or, better still, a real-world legal test where authorities requested data and the provider had nothing to hand over. Jurisdiction matters too: a provider based in a country that participates in intelligence-sharing arrangements (such as the Five Eyes alliance, which includes Australia) is subject to different legal pressures than one based elsewhere.
Speed and reliability are practical considerations. A VPN that constantly drops the connection or slows your browsing to a crawl is one you will stop using. Most reputable services offer trial periods or money-back guarantees, which is worth taking advantage of before committing.
Finally, consider the business model. Free VPNs often sustain themselves by selling user data, which defeats the purpose entirely. A paid service from a provider with a transparent ownership structure and a clear privacy policy is almost always the better choice. For most Australians, a quality VPN costs between $5 and $15 a month, or considerably less on an annual plan.
VPNs and the broader picture
A VPN is not a complete privacy solution on its own, but it is a meaningful one. Combined with sensible browsing habits, strong passwords, and an awareness of what data you share with apps and services, it forms a solid foundation for digital self-defence. As more of everyday life moves online, from banking and healthcare to work and communication, the ability to control who can see your data becomes less of a technical niche and more of a basic personal right.
For Australians specifically, the combination of strong data retention laws and an increasingly targeted digital advertising ecosystem makes the practical case for a VPN quite tangible. It is not about paranoia. It is about making a considered, informed choice about your own information.