VPN marketing promises everything from "total anonymity" to "military-grade security," and almost none of it is accurate. What a VPN actually does is narrow but genuinely useful: it encrypts traffic between your device and the VPN server, hiding it from your ISP and anyone on the same network. Here is how to set one up correctly in 2026.
What changed in 2026
- WireGuard is now the default protocol on all major VPN apps — it's faster, uses less battery, and has a smaller codebase (meaning fewer security bugs) than the older OpenVPN.
- Audited no-log claims are the floor, not the feature. Mullvad, ProtonVPN, and IVPN have all published third-party audit results. Services without audits are harder to trust.
- VPNs don't protect against browser fingerprinting, logged-in tracking, or malware — no change here, but this distinction matters more as those vectors became the dominant tracking methods.
- Split tunneling is now supported on all major desktop clients, making it practical to only tunnel what you actually need.
What a VPN actually protects
| Threat |
VPN helps? |
Notes |
| ISP seeing your browsing |
Yes |
Encrypts traffic before it leaves your device |
| Public Wi-Fi snooping |
Yes |
Encrypts before the hotspot sees it |
| Government surveillance (local) |
Partially |
Depends on VPN jurisdiction and logs policy |
| Website tracking you |
No |
Cookies and fingerprinting are unaffected |
| IP address hiding from websites |
Yes |
Sites see the VPN server's IP, not yours |
| Malware / phishing |
No |
Wrong tool — use DNS filtering for this |
| Anonymity |
No |
Logs, payment, and browser fingerprint can still identify you |
Top VPN services in 2026
| Service |
Price (est.) |
Logs |
Protocol |
Jurisdiction |
| Mullvad |
~€5/mo |
Audited no-log |
WireGuard, OpenVPN |
Sweden |
| ProtonVPN |
Free–~$10/mo |
Audited no-log |
WireGuard, OpenVPN |
Switzerland |
| IVPN |
~$6–$10/mo |
Audited no-log |
WireGuard |
Gibraltar |
| ExpressVPN |
~$10/mo |
Policy; partial audits |
Lightway (WG-based) |
British Virgin Islands |
Mullvad accepts cash and cryptocurrency and doesn't require an email address — the best option for high privacy. ProtonVPN's free tier is legitimate and genuinely no-log, making it the best free option.
How to set it up — step by step
Step 1: Choose a service and install the app
Download directly from the official website, not from an App Store mirror. Verify the installer signature if you're on Windows.
Step 2: Enable the kill switch
A kill switch blocks all traffic if the VPN connection drops — without it, your real IP leaks during reconnection. Every major client has this; turn it on before anything else.
Step 3: Choose WireGuard as the protocol
In the app settings, select WireGuard. It's the default on most apps now, but confirm. It's faster and more stable than OpenVPN.
Step 4: Pick a server
For speed: choose a server geographically close to you. For privacy: choose a server in a jurisdiction with strong data protection laws (Switzerland, Iceland, Norway). For streaming: the service will usually have dedicated streaming servers.
Step 5: Enable split tunneling (optional but recommended)
Split tunneling lets you route some apps through the VPN and others directly. Use case: put your browser and messaging apps through the VPN; leave your work VPN and local network access direct. Available under Settings → Split Tunneling in most apps.
Step 6: Test your connection
Go to ipleak.net or dnsleaktest.com with the VPN on. Confirm your displayed IP and DNS servers are the VPN's, not your ISP's.
How to pick
- Privacy is the priority? Mullvad or IVPN — cash payment, no account email, audited no-log.
- Want a free option that's legitimate? ProtonVPN free tier — no data cap, just speed limits.
- Streaming and geo-unblocking is the main use case? ExpressVPN or NordVPN have stronger streaming unblocking track records.
- Router-level VPN? Use a service that provides WireGuard config files or has a router app (Mullvad and ProtonVPN both do).
Common mistakes
Using a free VPN that's not ProtonVPN. Most free VPN services log and sell your data, which is the exact problem you're trying to solve.
Leaving the kill switch off. Without it, an unexpected VPN disconnect briefly exposes your real IP. Turn it on.
Assuming VPN = anonymous. If you're logged into Google, Google sees your activity regardless. VPN hides traffic from your ISP, not from services you're logged into.
Running the VPN inside a work device. Corporate devices may prohibit personal VPNs and log differently. Keep personal VPN use to personal devices.
Not checking for DNS leaks. Even with a VPN on, misconfigured DNS settings can send DNS queries outside the tunnel. Test at dnsleaktest.com.
What to skip
- VPN browser extensions as your only solution — they only cover browser traffic, not OS-level traffic.
- "Double VPN" or multi-hop for everyday use — it halves your speed with marginal security benefit unless you have very specific threat requirements.
- Any VPN that markets "military-grade encryption" as if that phrase means something specific — it doesn't. WireGuard's encryption is genuinely strong without the jargon.
FAQ
Does a VPN slow my internet?
WireGuard reduces the speed penalty to typically 10–20% on a fast connection. On slow connections (<25 Mbps), you may not notice at all.
Can my employer see my traffic if I'm on a personal VPN?
If you're on a personal device on your home network with a personal VPN: no. If you're on a company device or company network: the company may have separate monitoring tools that operate independently.
Is using a VPN legal?
In most countries, yes. VPNs are restricted or banned in a small number of countries (Russia, China, UAE). Check local law if you're in a restricted jurisdiction.
Do I need a VPN if I use HTTPS?
HTTPS encrypts content but your ISP can still see which domains you visit. A VPN hides the destination too. On trusted home networks, the risk is lower; on public Wi-Fi, a VPN is worth running.
Where to go next