Does a VPN protect against viruses and malware?

Original diagram — a VPN moves your connection through an encrypted tunnel to a server, which then relays it onward.

What Is a VPN, and Do You Actually Need One?

VPN advertising has done an impressive job of making a fairly modest tool sound like a force field. It is not. But it does one specific thing well — and understanding that one thing tells you clearly whether you need it.

This guide explains what a VPN actually does, what it demonstrably does not do, and the handful of situations where it is genuinely worth paying for. It also covers the free-VPN problem, which is more serious than most people realise, and the legal picture in countries where VPN use is restricted.

There are no affiliate links here and no provider recommendations. The goal is that you can make the decision yourself.

Key takeaways

• A VPN encrypts traffic between your device and the VPN server, and hides your IP address from the sites you visit.
• It does not make you anonymous. Logged-in accounts, browser fingerprinting and the VPN provider itself still know who you are.
• On public Wi-Fi, a VPN is a useful extra layer — but HTTPS already protects most of what VPN ads claim to save you from.
• For home browsing, a VPN mainly limits what your internet provider can see. Whether that matters is a personal judgement.
• Most free VPNs are not free in any meaningful sense. Research on hundreds of them found widespread excessive permissions and risky behaviour.

In this guide

1. What a VPN actually does
2. What a VPN does not do
3. Do you need one? Four situations
4. The free VPN problem
5. What to check before paying
6. Is using a VPN legal?
7. What matters more than a VPN
8. Frequently asked questions

1. What a VPN actually does

A VPN creates an encrypted connection between your device and a server operated by the VPN provider. All your internet traffic travels through that connection before reaching its destination. Two practical consequences follow.

Your local network can no longer read your traffic. Whether that is a café's Wi-Fi, a hotel network, or your own router, everything passing through it is encrypted. An eavesdropper can see that you are connected to a VPN server, and roughly how much data is moving, but not which sites you are visiting or what you are sending.

The sites you visit see the VPN server's address, not yours. Your public IP address — which normally reveals your approximate location and your internet provider — is replaced by the VPN server's. This is why a VPN can make a streaming service think you are in another country, and why it limits the profile advertisers can build from your IP.

That is the entire core function. Everything else a VPN vendor advertises is either a variation on these two things or a feature bundled alongside them.

The trust shift: a VPN does not eliminate who can see your traffic. It moves that visibility from your internet provider or the local network to the VPN company. You are trading one party's trust for another's. That is why the provider's logging policy matters more than almost any other feature.

2. What a VPN does not do

This is the part most marketing material skips, and it is the part that determines whether a VPN is worth your money.

Original diagram — the boundary between what a VPN protects and what it does not.

Privacy is not anonymity

These two words are used interchangeably in VPN marketing and they mean different things. Privacy means others cannot see what you are doing. Anonymity means nobody can identify that it was you doing it.

A VPN provides a genuine measure of the first. It provides almost none of the second. The moment you log into an account — Google, Amazon, your bank, a social network — that company knows exactly who you are, regardless of your IP address. Modern tracking also relies heavily on browser fingerprinting: the combination of your browser version, operating system, installed fonts, screen resolution, time zone and language settings creates a signature that can identify you across sites even when your IP changes. A VPN does not alter most of those characteristics.

It does not stop malicious links

A VPN will not protect you from a phishing email, a malicious download, or a fake login page. It encrypts the pipe, not the contents. If you type your password into a convincing imitation of your bank's website, a VPN encrypts that password all the way to the attacker's server. Some providers bundle phishing and malware blocking, but that is a separate feature — the VPN itself does nothing about it.

3. Do you need one? Four situations

Original diagram — a rough verdict for each common case. Your own threat model may differ.

Public Wi-Fi — the case is real but narrower than advertised

The "hacker in the coffee shop reading your passwords" scenario is largely obsolete for a specific technical reason: the overwhelming majority of legitimate websites and apps now use HTTPS, which encrypts traffic between your device and the service. Someone on the same network cannot simply read your passwords or card details in transit. Banking apps are not relying on the café router for security.

What HTTPS does not cover is narrower but still real. It does not hide which domains you are connecting to, so a network operator can infer what you are doing even without seeing the contents. DNS queries may be visible unless encrypted DNS is configured. A malicious hotspot can attempt man-in-the-middle attacks, redirecting you to imitation login pages — and HTTPS cannot stop you from typing your password into a convincing fake. A VPN closes the first two gaps and raises the difficulty of the third.

The honest verdict: on public Wi-Fi, a VPN is a reasonable precaution, not a necessity. If you use one only in that situation, you are getting most of the practical benefit.

Home browsing — where the argument is genuinely mixed

At home, the threat model changes. Random attackers on your network are unlikely. The main observer is your internet provider, which can see which domains you connect to and, in some jurisdictions, may use or sell aggregated data for advertising.

Whether that bothers you is a values question, not a technical one. A VPN does reduce what your provider can see. It does not remove the advertiser profiles that already exist, because those are built largely from cookies, tracking pixels and fingerprinting that operate above the network layer. For that problem, a tracker-blocking browser or extension is the more direct tool.

If you are on a metered or throttled connection, note that a VPN will not help with speed. In practice it usually reduces throughput slightly, because your traffic takes a longer route through the VPN server.

Travel and censorship — the clearest use case

The strongest justification for a VPN is access. On networks that block services you rely on, or when you need to reach your home country's banking or streaming services while abroad, a VPN does something no other tool does. This is also the case with the most legal nuance, covered below.

4. The free VPN problem

Running VPN servers costs real money: bandwidth, hardware, staff, and legal compliance. A free service has to cover those costs somehow. The question worth asking is how.

In 2025, researchers at Zimperium zLabs analysed roughly 800 free VPN apps across Android and iOS. The findings were not reassuring. About 65% showed risky behaviours or insecure APIs, including the ability to take covert screenshots of the user interface. Around 41% requested permissions well beyond what a VPN needs — including always-on location access even when the VPN was inactive, and in some cases permission to read system-wide logs. The researchers noted that a legitimate VPN has no justifiable reason to read system logs, and that the request should be treated as a warning sign[reference:0].

This is not a hypothetical. In December 2025, security researchers reported that a popular free VPN browser extension had been collecting users' conversations with AI chatbot platforms and passing them to third-party data brokers, affecting millions of installations[reference:1]. The extension was marketed as a privacy tool.

There are exceptions. A small number of free tiers are operated by companies with a paid product and a published, independently audited no-logs policy — Proton VPN and DuckDuckGo's VPN are the two most commonly cited, both of which have had no-log claims examined by external auditors[reference:2][reference:3]. Those are meaningfully different from an anonymous free app with no company behind it.

The uncomfortable arithmetic: if you are not paying for the VPN, and the company is not selling a paid tier, the product being monetised is likely your data. A free VPN that harvests browsing behaviour is worse for your privacy than no VPN at all.

5. What to check before paying

If you decide a VPN is worth having, these are the criteria that actually distinguish providers. Price and server count are the least informative.

An audited no-logs policy. "We don't keep logs" is a marketing sentence until an independent firm has examined the infrastructure and confirmed it. Several major providers now publish annual audit reports from recognised firms, and the specific auditor and scope matter more than the badge on the website.

Who owns the company. VPN providers are frequently acquired by larger holding companies, and ownership changes can change logging practices. A provider that publishes its ownership structure is easier to assess than one that does not.

Jurisdiction. The legal environment where the company operates affects what it can be compelled to hand over. This is a genuine consideration, though it is often overstated in marketing — a company with no data to hand over is in a stronger position regardless of where it is based.

Leak protection. A VPN that drops its connection must not silently fall back to your normal connection, exposing your real IP. Look for a kill switch and, ideally, independent testing of DNS and WebRTC leaks.

A business model that makes sense. A paid subscription, a free tier with clear limits, or a bundled service. If the funding source is unclear, assume the worst.

Realistic claims. A provider that promises complete anonymity is either misunderstanding its own product or misrepresenting it. The honest ones describe what they protect against and what they do not.

6. Is using a VPN legal?

In most countries, yes. VPNs are legal for personal and business use across the United States, the United Kingdom, Canada, Australia, India, Japan, and most of Europe. Globally, roughly one in four internet users aged 16 and over reports using a VPN for at least some activity[reference:4].

The more important principle, which applies everywhere: a VPN does not make an illegal act legal. Fraud, harassment, copyright infringement and unauthorised access remain illegal whether or not a VPN is in use. The tool is not the offence; the conduct is.

Status	Examples	What to know
Legal	US, UK, Canada, Australia, India, Japan, most of the EU	Legal for privacy, work and streaming. Underlying conduct must still be lawful.
Regulated or partially blocked	Russia, Turkey, UAE, Iran, Belarus	Often only approved providers or approved uses are permitted; unapproved services may be blocked.
Heavily restricted or banned	China, North Korea, Turkmenistan, Iraq	China permits only government-authorised services. North Korea bans VPN use outright.

Two additional details worth knowing. India's 2022 data retention rules require VPN providers with servers in the country to retain user logs for five years, which is why several international providers withdrew local servers rather than comply. And Myanmar imposed a ban on providing VPN services in January 2025. Laws in this area change; check the current position for the specific country you are in.

This section is general information, not legal advice. If VPN use is restricted where you are, or if you are travelling, verify the current rules before connecting.

7. What matters more than a VPN

If your goal is genuinely better security and privacy, a VPN is not the highest-leverage purchase. These four things are free and prevent more real harm:

• Multi-factor authentication on your email, banking and social accounts. Prefer an authenticator app or a passkey over SMS, which is vulnerable to SIM-swap attacks.
• A password manager. Unique passwords for every account, generated and stored rather than remembered. This removes the single biggest enabler of account compromise.
• Prompt updates. Most exploited vulnerabilities have had fixes available for months. Installing them is the least glamorous and most effective security habit there is.
• Tracker blocking. For the advertising-profile problem that VPNs cannot solve, a browser with built-in tracking protection or a reputable content blocker does more direct work.

A VPN sits alongside these, not above them. The honest marketing position — which almost no VPN company takes — is that it is a useful addition to basic security hygiene, not a substitute for it.

Where this leaves you

A VPN is a specific tool that solves a specific problem: it encrypts the connection between your device and a server, and it hides your IP address from the sites you visit. It is genuinely useful on untrusted networks, when travelling, and when you need to reach something that is blocked.

It is not an anonymity machine, it is not a substitute for antivirus or careful clicking, and it is not something most people need to run constantly at home. If you decide you want one, pay for a provider with an audited no-logs policy, a clear business model, and marketing that does not overpromise. And if a VPN is free and anonymous, treat that as a reason to be more careful, not less.

Frequently asked questions

Does a VPN make me anonymous online?

No. A VPN hides your IP address and encrypts your connection, but sites you log into still identify you, browser fingerprinting still works, and the VPN provider can see your traffic unless it has a verified no-logs policy. Privacy and anonymity are different things, and a VPN only delivers the first.

Do I need a VPN on public Wi-Fi?

It is a reasonable precaution but not strictly essential. HTTPS already encrypts the contents of most traffic, so a nearby eavesdropper cannot simply read your passwords. A VPN adds protection for DNS queries and connection metadata, and makes man-in-the-middle attacks harder. If you use a VPN only on public Wi-Fi, you are getting most of the practical benefit.

Can my internet provider see what I do when I use a VPN?

They can see that you are connected to a VPN server, the volume of traffic, and roughly when. They cannot see which sites you visit or what you send, because that traffic is encrypted inside the tunnel. This assumes the VPN is working correctly and not leaking.

Are free VPNs safe?

Many are not. Research on around 800 free VPN apps found widespread excessive permission requests and risky behaviour, and at least one popular free VPN extension was found collecting users' AI chat conversations. A small number of free tiers run by established companies with audited no-logs policies are meaningfully different, but the category as a whole deserves caution.

Is using a VPN legal?

In most countries, yes — including the US, UK, Canada, Australia, India, Japan and most of the EU. Some countries regulate or block VPN services, and a few ban them outright. Regardless of location, a VPN does not make otherwise illegal activity legal.

Will a VPN slow down my connection?

Usually slightly, because your traffic takes a longer route through the VPN server and is encrypted and decrypted along the way. On a fast connection with a nearby server, the difference may be unnoticeable. On a slow or congested connection, it can be significant. A VPN will not increase your speed.

Does a VPN protect against viruses and malware?

No. A VPN encrypts the connection; it does not inspect or block malicious files, phishing links or fake websites. Some providers bundle antivirus or web filtering, but that is a separate feature and should be assessed separately.

Should I leave my VPN on all the time?

It is a reasonable default if you do not want to think about it, and the performance cost is usually small. But it is not necessary for most home browsing, and it will not solve tracking or fingerprinting. If you prefer to enable it only on public networks and while travelling, you are not leaving yourself meaningfully exposed.

---

Sources and further reading: Zimperium zLabs study of approximately 800 free VPN apps (reported by ZDNET, October 2025); reporting on the Urban VPN Proxy data collection findings (December 2025); GWI data on global VPN usage cited by Bitdefender (2025); Bitdefender country-by-country VPN legality summary; CNET and PCMag explainers on VPN privacy limitations and ISP visibility; Pen Test Partners analysis of HTTPS protection on public Wi-Fi. Statistics are attributed to their sources; no performance figures or provider rankings are stated because they depend on testing conditions this article did not conduct. This article contains no affiliate links and recommends no specific provider.