The short answer
A VPN is a network intermediary. Your device encrypts packets intended for the tunnel and sends them to the VPN server, which then forwards them to the internet. Responses return along the same path.
Your internet service provider can generally see that a connection exists to a VPN server, but cannot directly see every destination carried inside the tunnel. The VPN provider, however, occupies a position of trust, so its service and practices need to be assessed.
Sources and references
What changes in practice
On a shared Wi-Fi network, the tunnel reduces traffic exposure between the device and the VPN server. Sites see the server’s exit address instead of your connection’s usual public address, subject to other data sent by your browser or account.
The VPN may also change the network route and latency. It guarantees neither higher speeds, nor access to a third-party service, nor perfect location accuracy.
What a VPN does not solve
A VPN does not remove cookies, make an account anonymous, automatically block malware or fix a device that is not up to date. It does not replace HTTPS: the tunnel ends at the VPN server, whereas HTTPS protects the connection all the way to the site.
Your choice should be based on the actual scope of the apps, documented protocols, data required to provide the service, commercial terms and clarity about limitations—not on a promise of invisibility.
- Check which applications are covered.
- Read the data policy and technical limitations.
- Check the total price and renewal terms.
- Continue using HTTPS, installing updates and choosing unique passwords.