VPN and encrypted tunnel
A virtual private network routes covered traffic through a connection between your device and a VPN server. The encrypted tunnel protects that part of the route. It does not by itself make you anonymous or replace application-level security such as HTTPS.
VPN protocol
The rules and implementation used to establish and carry the VPN connection. WireGuard, OpenVPN, and a provider’s own named protocol are examples you may encounter. Compatibility and supported features vary by app and platform. A protocol name alone does not establish a performance result.
WireGuard
An open-source VPN protocol designed around a relatively small codebase and modern cryptographic choices. A commercial VPN can incorporate WireGuard into its own service. The service’s account, routing, logging practices, and applications still need separate evaluation.
OpenVPN
An open-source VPN project used by many services and manual configurations. It offers different transport choices, commonly described as UDP or TCP. Whether either option is useful depends on the network and provider setup. Always use current, supported software.
Kill switch
A connection-protection feature intended to stop some traffic from continuing outside the VPN under defined conditions. Its behavior can differ for an unexpected tunnel failure, an intentional disconnect, startup, and sleep. Read the app-specific documentation rather than assuming every “kill switch” behaves identically.
Split tunneling
Rules that send different traffic through different routes. An app or destination may be included in, or excluded from, the VPN. Be clear which direction the rule uses. Traffic deliberately excluded from the tunnel does not receive that tunnel’s protection.
DNS
The domain-name system translates names into information used to reach services. DNS configuration is part of a privacy assessment because a device can contact a resolver separately from another connection. A DNS test is one check; it does not prove the absence of every privacy issue.
Public IP address
An address visible on a public network connection. A destination usually sees the VPN server’s public address for traffic sent through the VPN. That does not remove account identity, cookies, GPS permissions, or every other identifying signal.
No-logs policy
A provider’s statement about what it does and does not record. Read the actual policy, exceptions, and scope. An independent audit can add evidence about a defined system at a particular time. Neither the label nor the audit is a permanent guarantee of every future practice.
Simultaneous connections
The number of active VPN connections allowed by an account at the same time. This can differ from the number of devices on which you may install an app. An unlimited personal-device allowance is not a claim of unlimited network capacity.
VPN client and VPN pass-through
A client establishes the VPN connection. A router that supports VPN pass-through may simply allow another device’s VPN connection to traverse it. Pass-through does not prove that the router itself can run the commercial VPN as a client.
Server location
A provider’s stated location for a VPN endpoint. Depending on the service, the advertised geographic location and the physical hardware location may differ. Check current documentation if either distinction is material to your decision.
Introductory price and renewal
An introductory price applies to the initial offer under its terms. The renewal can have a different amount and billing period. Compare the total payment and the period covered, not just a headline monthly equivalent.
For the concepts in context, read what a VPN does or compare the provider shortlist.
Sources you can check
Sources reviewed for this page on . A provider’s documentation describes its published offering; it is not our original performance test.