Skip to content
Clearward

The honest threat model

Are VPNs safe? What one actually protects — and what it doesn't

Yes, a reputable VPN is safe to use — but “safe” and “anonymous” are different questions, and most marketing blurs them on purpose. Here is the plain threat model: the exact things a VPN helps with, the things it does nothing for, and the one risk it creates.

The VPN threat model

Does a VPN help?
Your ISP or mobile carrier logging every site you openSees encrypted traffic to one VPN endpoint — not the sites.Helps
Someone snooping on open public Wi-FiTraffic is encrypted to the VPN, so the local network sees nothing useful.Helps
Advertisers tracking you across sites (cookies, fingerprinting)Unchanged — a VPN hides your IP, not your browser or cookies.No help
The accounts you sign into (Google, Meta, your bank)They still know — you logged in and told them.No help
Malware, ransomware and virusesStill at risk. A VPN is not antivirus and scans nothing.No help
Phishing and scam websitesMostly unchanged; a few VPNs bundle a blocklist that helps a little.Barely
A subpoena or police request for your activityDepends entirely on the provider: an audited no-logs VPN has nothing to give; a logging one does.Depends
A targeted, well-resourced state adversaryA VPN alone will not stop them — traffic correlation and a compromised device defeat it.No help
The VPN provider itself reading your trafficYou have moved trust from the ISP to the provider. That is the whole trade.Trust shifts

Are VPNs safe? A reputable, audited VPN is safe to use and genuinely improves your privacy against some threats — but it is not a shield against everything, and any product that implies it is should lose your trust immediately. The matrix above is the whole argument in one view: a VPN is excellent at a few specific things, useless against most of the ways you are actually tracked, and it introduces exactly one new risk of its own. The rest of this page walks through each column.

What a VPN is genuinely good at

A VPN does three things well. It hides which sites you visit from your internet provider or mobile carrier, so they can no longer build and sell a profile of your browsing. It encrypts your traffic on untrusted networks, which defangs snooping on open public Wi-Fi. And it changes the IP address websites see, which is what lets it move you past region locks. Those are real benefits, and for most people the first one is the reason worth paying for. We go deeper on the ISP and public-Wi-Fi cases in does a VPN stop hackers, your ISP and the government.

What a VPN does nothing for

This is the part the ads skip. A VPN hides your IP address, and almost nothing else about your identity. Advertisers track you with cookies and browser fingerprinting that have nothing to do with your IP. The accounts you sign into — Google, your bank, any social network — know it is you the moment you log in. A VPN is not antivirus and will not stop malware or ransomware, and it will not save you from a phishing page that you type your password into. If you take one thing from this site, take this: a VPN protects the pipe, not the person at either end. The full list of what it misses is in what a VPN does not protect you from.

Is the VPN itself safe to trust?

Here is the one risk a VPN creates: you are routing all of your traffic through a single company, so you have to trust that company more than you trusted your ISP. A good VPN cannot see inside your encrypted connections to websites, but it can see which sites you connect to and when. That is why the provider's honesty is everything, and why a no-logs claim only matters when it has been independently audited.

It is also why free VPNs are the sharp edge of this question. Running a global server network is expensive; if you are not paying, the business often runs on your data. Researchers have repeatedly found free VPN apps — including a cluster of China-owned apps with tens of millions of US downloads — that log or sell traffic, and some are linked to sanctioned companies. A free tier from an audited, reputable provider is fine. A no-name free VPN with no owner and no audit is not a tool; it is the product.

In most of the world, yes — using a VPN is legal and carries no risk to your device. They are standard tools for remote work and everyday privacy, and demand has surged around online age-verification laws: when the UK's Online Safety Act age checks began in July 2025, VPN sign-ups spiked by more than a thousand per cent in hours. A few governments restrict or ban VPNs — notably China, Russia and some Gulf states — where the legal picture is genuinely different and worth checking before you travel. Safe to use is not the same as legal everywhere.

So which VPN is actually safe?

A safe VPN is one whose no-logs promise is backed by a named, recent independent audit, that runs RAM-only servers, and ideally that has had its claim tested by a real legal demand. On those criteria, Mullvad stands out and pays us nothing to say so. For the full comparison — auditor and date for every major provider — see which no-logs claims are actually audited. Choose on evidence, not on the loudest safety promise.

Are VPNs safe? Quick answers

Are VPNs safe to use?
Yes. A reputable, audited VPN is safe to install and use, and it improves your privacy against your ISP and snoops on public Wi-Fi. The caveat is trust: you route all your traffic through the provider, so pick one whose no-logs policy has been independently audited. Avoid unknown free VPNs, which often monetise by logging or selling data.
Can a VPN protect me from viruses and hackers?
Only partly. A VPN encrypts your connection, which helps on untrusted networks, but it is not antivirus and does not stop malware, ransomware or phishing. It also cannot protect a device that is already infected. Treat a VPN as one layer for privacy, not as security software.
Is it safe to use a free VPN?
It depends entirely on who runs it. A free tier from an audited, reputable provider such as Proton VPN is safe. A no-name free VPN with no clear owner and no independent audit is a real risk — researchers keep finding free apps that log or sell user traffic. If you cannot tell who profits, assume it is your data.
Does a VPN make me anonymous?
No. A VPN hides your IP address and encrypts your connection, but the sites you log into still know who you are, and your browser can be fingerprinted. A VPN shifts your trust from your ISP to the provider; it does not erase you. For anonymity from a serious adversary you need Tor, and even that has limits.