The difference in one minute
With HTTPS, the browser authenticates the site using a certificate and encrypts the session all the way to that site. The local network, internet service provider and VPN server then cannot read the HTTPS content, although they may observe metadata required for routing.
With a VPN, the system encrypts the intended traffic as far as the VPN server. From that server, traffic continues to its destination. If it also uses HTTPS, it remains encrypted to the site; if not, the portion after the VPN server does not magically gain HTTPS protection.
| Question | VPN | HTTPS |
|---|---|---|
| Starts at | Device or VPN app | Browser or application |
| Ends at | VPN server | Site or service |
| IP address seen by the site | Exit server | Does not change it |
| Protects against fake sites | No | The certificate helps, without preventing phishing |
Sources and references
Who can see what?
The local network mainly sees an encrypted connection to the VPN server. The VPN provider sees the information needed to relay the connection, but HTTPS limits its ability to read content exchanged with the site.
The site sees the VPN’s exit IP address and everything you share with it: signed-in account, cookies, form data and browser identifiers. HTTPS protects this data in transit, not from the recipient itself.
Example on hotel Wi-Fi
You open your bank over HTTPS while the VPN is active. The hotel Wi-Fi cannot see the page content; it sees a connection to the VPN. The VPN server relays the connection, but HTTPS keeps the banking content encrypted all the way to the bank.
If a page displays a certificate warning, do not ignore it simply because the VPN is active. The tunnel does not validate the site’s identity on the browser’s behalf.
Common misconceptions
The padlock in the browser does not mean that a site is honest: it mainly means that the connection to that domain is encrypted and authenticated according to the certificate. A phishing site can also use HTTPS.
Conversely, HTTPS does not hide your connection’s IP address from the site. A VPN can change the exit address, but accounts and cookies remain visible to the site.
- Keep using HTTPS even with a VPN.
- Never bypass a certificate warning without understanding its cause.
- Check the scope of the VPN app or extension.
- Treat the VPN provider as a trusted intermediary.