A clear breakdown of what your ISP, Wi-Fi operator, websites and the VPN provider can see with and without a VPN, plus the leaks to check for.
"Hide everything" is a common VPN promise. In practice a VPN hides some things from some parties, and nothing from others. Knowing which is which helps you use one sensibly and avoid a false sense of security.
Who can see what: without a VPN?
- Your broadband provider or mobile network can see which domains you connect to (for example, example.com), when and how much data you use. With HTTPS, which most sites now use, it cannot see the pages you read or what you type.
- A public Wi-Fi operator can see much the same as an ISP on its network.
- Websites see your public IP address, which reveals your approximate location and your ISP, plus anything you tell them.
Who can see what: with a VPN?
- Your ISP or the Wi-Fi operator sees that you are connected to a VPN server, and how much data passes, but not the sites you visit.
- Websites see the VPN server's IP address instead of yours.
- The VPN provider can, technically, see the domains you visit and your real IP address. That is why its logging policy and trustworthiness matter so much.
What a VPN does not hide?
Your identity when you log in
If you sign in to Google, Facebook, Amazon or your bank, they know it is you, wherever your traffic appears to come from.
Cookies and tracking
Advertising cookies, tracking pixels and browser fingerprinting (identifying you from your browser's settings, fonts and screen) work regardless of your IP address. Use browser privacy settings, block third-party cookies and review cookie banners. The ICO explains your choices about cookies.
Malware and phishing
A VPN does not stop you clicking a malicious link or installing a harmful app.
Your device's location services
Phone apps can use GPS and Wi-Fi location regardless of a VPN.
Payment details
Your bank and the VPN provider know who paid for the subscription.
Leaks that can undo a VPN
- DNS leaks: if your device still sends domain lookups to your ISP's servers, your ISP can see which sites you visit. Good VPN apps route DNS through the tunnel.
- IPv6 leaks: if the VPN handles only IPv4, some traffic may bypass it over IPv6.
- WebRTC leaks: a browser feature that can reveal your real IP address to websites. Some browsers and VPN extensions block it.
- Connection drops: if the VPN disconnects, traffic may flow normally. A kill switch prevents this.
Check your VPN: step by step
- With the VPN off, visit an "IP address" checking site and note your IP and location.
- Turn the VPN on, reload, and confirm the IP and location have changed to the VPN server's.
- Run a DNS leak test. The DNS servers listed should belong to the VPN provider, not your ISP.
- Turn on the kill switch in the app's settings.
- Repeat after app updates or when you change networks.
VPNs on phones
On mobile, check that the VPN app's "always-on" or "connect on untrusted networks" setting is enabled, as phones switch between Wi-Fi and mobile data frequently. Both Android and iOS also offer built-in settings that limit tracking, such as app tracking controls and private Wi-Fi addresses.
Good habits that matter more than a VPN
- Keep devices and apps updated.
- Use a password manager and unique passwords.
- Turn on two-step verification for email and banking.
- Be suspicious of unexpected messages asking you to click or pay.
The NCSC's Cyber Aware advice covers these steps in more detail.
Frequently asked questions
Does incognito mode do the same thing?
No. Private browsing stops your browser saving history and cookies on your device after you close it. It does not hide your traffic from your ISP or websites.
Is Tor the same as a VPN?
No. Tor routes traffic through several volunteer-run relays for greater anonymity, but it is slower and some sites block it.
Sources and further reading
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.