The essentials
- Encryption: scrambles your traffic between your device and the VPN server. Mainstream VPNs use strong, well-studied ciphers such as AES-256 or ChaCha20.
- Kill switch: blocks internet access if the VPN disconnects, so nothing leaks over your normal connection. Some apps offer an app-level kill switch that closes chosen apps instead.
- DNS leak protection: makes sure your domain lookups go through the VPN rather than your internet provider.
- Auto-connect: connects whenever you join an untrusted network.
Protocols
| Protocol | What to know |
|---|---|
| WireGuard | Modern, fast and lean. Widely supported; some providers build their own protocols on it. |
| OpenVPN | Long-established and open source. Runs over UDP (faster) or TCP (better on restrictive networks). |
| IKEv2/IPsec | Reconnects well when you switch between Wi‑Fi and mobile data. Built into many operating systems. |
| Proprietary | Provider-specific protocols. Look for independent audits. |
| PPTP / L2TP | Older. PPTP is considered insecure; avoid it. |
More in WireGuard vs OpenVPN.
Useful extras
- Split tunnelling: choose which apps or sites use the VPN. Handy for local printers, banking apps or games.
- Multi-hop (double VPN): routes traffic through two VPN servers. More privacy, but slower.
- Obfuscation (stealth mode): disguises VPN traffic as ordinary web traffic, for networks that block VPNs.
- Dedicated IP: an IP address only you use, which can reduce CAPTCHAs and help with allow-listed work systems. It’s less private than a shared IP.
- Port forwarding: lets incoming connections reach your device, useful for some hosting or peer-to-peer uses. It’s offered by only some providers.
- Tracker and ad blocking: DNS-level blocking of known ad, tracker and malware domains.
Last updated: 13 October 2026
