Sit through a few tech YouTube videos and you’ll hear the same VPN sponsor read again and again. Military-grade encryption. Total anonymity. Watch anything from anywhere. Most of those ad claims land somewhere between half-true and plain wrong.
About the prices and versions: This explainer quotes no prices. The protocol details were current when this guide was written; check the documentation linked under Sources before assuming an app setting still matches. The latency figures are rough typical ranges, not a measurement, and yours will differ with distance, ISP and time of day.
So here’s what a VPN actually is, what really happens the second you tap connect, and where it helps versus where it doesn’t. No marketing. Just the plumbing.
postcards and a locked courier bag
Think of normal internet traffic like posting a stack of postcards. Open a website on Jio or Airtel with no HTTPS, and anyone touching that postcard on its way can read both the address and the message. HTTPS seals the message part. So the contents are hidden now, but the address scribbled on the outside? Still right there. Your ISP always knows which buildings your mail is headed to, even when it can’t peek at what’s tucked inside.
A VPN swaps out the addressing bit. Instead of dropping letters in the post one by one, you stuff everything into a locked courier bag and ship the whole bag to one office you trust, the VPN server. That office cracks the bag open, posts your letters onward under its own address, gathers the replies, locks them back in, and couriers the bag home to you. Your ISP? It only catches one thing now, a steady run of sealed bags going back and forth between you and that single office. And the websites you actually visit see the office’s address, not yours.
That’s the whole trick. A Virtual Private Network is just an encrypted tunnel running between your device and some remote server, and that server passes your traffic along to the open internet on your behalf. Nothing fancier than that.
what actually happens when you tap connect
step 1: the handshake
First thing, your VPN app and the server check each other out and settle on encryption keys. Modern protocols like WireGuard handle this with public-key cryptography, which is the same family of maths keeping your UPI payments safe. Each side holds a private key it never shows anyone, plus a public key it’s happy to hand around. The whole handshake wraps up in a fraction of a second. That’s why WireGuard connects almost the instant you tap it, while older OpenVPN setups make you wait a few seconds.
step 2: the tunnel
Keys agreed, here’s the next bit. Every packet leaving your device gets encrypted and then tucked inside a fresh outer packet, one addressed to the VPN server. That wrapping has a name: encapsulation. Your Jio router, the local exchange, every hop along the way, all they see is that outer wrapper. The inner packet, the one carrying your real destination and contents, is just ciphertext to them. Gibberish.
step 3: the exit
Now the server unwraps your packets and fires them off to where they were actually going, using its own IP address to do it. So a website over in Singapore reckons it’s got a visitor from the VPN server’s location, not from your place in Bhopal or Bengaluru. Replies just retrace the same route backwards. Want to see what the world sees? One command does it:
curl ifconfig.me
# Without VPN: your real public IP, e.g. an Airtel address
# With VPN: the server's IP, e.g. a Frankfurt datacentre addresswhat your ISP sees, with and without a VPN
If I could hand you just one thing from this whole piece, it’d be this table. Clears up most of the VPN confusion in a single glance, more or less.
| What | No VPN (HTTPS only) | With VPN |
|---|---|---|
| Websites you visit | Visible (domain names via DNS and SNI) | Hidden from ISP |
| Page contents, passwords | Hidden by HTTPS | Hidden |
| Your real IP, to websites | Visible | Hidden, they see the server’s IP |
| That you are using a VPN | Not applicable | Visible to ISP |
| Total data volume and timing | Visible | Visible |
| Your identity, to the VPN provider | Not applicable | Visible (your account, your IP) |
Read that last row twice, seriously. A VPN doesn’t delete trust. It just moves it somewhere else. You stop trusting Jio or Airtel with your browsing metadata and you start trusting the VPN company with it instead. That’s exactly why picking a provider matters so much, and it’s why I wrote a whole separate piece on how to compare VPN providers in India.
things a VPN won’t do for you
The ads oversell, so let me undersell a bit to even things out. A VPN does not:
- Make you anonymous. You logged into Google and Instagram through the tunnel, remember. Those accounts know exactly who you are, IP or no IP.
- Block viruses or phishing. Encryption is perfectly happy to carry malware along too. A fake bank SMS lands the same whether you’re on a VPN or not.
- Stop ad tracking. Cookies and browser fingerprinting couldn’t care less about your IP. For that you’ll want a proper blocker, and my DNS-level ad blocking explainer walks through the options.
- Speed up your internet, usually. Encryption piles on overhead and distance piles on latency. The rare exception is when it ends up routing around some congested or throttled path.
- Make illegal stuff legal. Should go without saying. The comments sections suggest people need telling anyway.
the protocols you’ll keep hearing about
Every VPN app has a protocol setting tucked away somewhere. And really, three names cover nearly everything you’ll meet.
WireGuard is the modern default these days. It’s roughly 4,000 lines of code, it lives right inside the Linux kernel, it connects in milliseconds, and it handles network switches gracefully, which genuinely matters when your phone keeps hopping between Jio 5G and home WiFi. Most commercial apps run it now, sometimes under a different badge. NordLynx, for instance, is just WireGuard underneath. It’s also what I’d point you toward if you ever fancy building your own VPN on a cheap VPS.
OpenVPN is the old battle-tested veteran. Slower, chattier, but here’s its trick, it can run over TCP port 443 and just blend in with regular HTTPS traffic, which helps a ton on networks that mess with UDP. On a mobile network that throttles or drops UDP, that difference can decide whether a VPN connects at all.
IKEv2/IPsec turns up a lot on iPhones, reconnects fast after a signal drop, and is perfectly fine. If your app’s got an “automatic” setting, just leave it sitting there. Only go poking around when something starts misbehaving.
is using a VPN legal in India?
The rule people usually mean is the CERT-In Directions of 28 April 2022. They require service providers, including VPN, VPS, cloud and data-centre providers, to keep ICT logs for 180 days. VPN and VPS providers must also keep validated subscriber records for five years. They do not prohibit an individual from using a VPN. They are not a complete statement of Indian law, though, and an employer, college or network can still restrict VPN use. My India VPN comparison covers the detail. This is general information, not legal advice.
Two honest caveats though. First, anything that’s illegal without a VPN stays just as illegal with one, and investigators have plenty of tools beyond IP addresses. Second, some workplaces and government departments block VPN use on their own networks, but that’s a policy thing, not a criminal one. I dig into the popular misconceptions properly over in my VPN myths article if you want the long version.
mistakes beginners tend to make
- Ignoring DNS leaks. If your device is still firing DNS queries off to your ISP outside the tunnel, your browsing list is leaking. Good apps tunnel DNS for you automatically, so just test at a DNS leak checking site once you’re connected.
- Skipping the kill switch. Without it, a dropped tunnel quietly dumps your traffic right back onto the open connection. Turn it on in settings. Nearly every decent app has one anyway.
- Trusting random free apps. Running servers costs actual money. If a free VPN has no visible way of making any, just assume your browsing data is the business model.
- Expecting anonymity while logged into everything. Sure, your IP changed. Your Google account didn’t.
- Connecting to faraway servers for no reason. Mumbai out to a nearby Singapore server might tack on 40 to 60 ms; Mumbai to New York can pile on 200 ms or more. Stick to close servers unless you actually need a distant exit for something.
FAQ
Will a VPN slow down my Jio or Airtel connection?
Usually a little. Encryption adds overhead and a distant server adds latency, so expect some loss even with a nearby WireGuard server. Compare a speed test with the VPN on and off on your own line. For browsing and streaming you’ll barely notice. For competitive gaming you will.
Is it safe to do net banking or UPI over a VPN?
Technically, yes, since banking apps bring their own encryption anyway. In practice though, some Indian banks flag logins from foreign IPs as dodgy and might block you for a bit or ask you to re-verify. The simple workaround is to disconnect the VPN, or switch to an exit in India, before opening a banking app.
Do I need a VPN on public WiFi?
It helps, though not as dramatically as the ads make out, because HTTPS already covers most of your sessions. The real payoff shows up on those shabby captive-portal networks at railway stations and airports, where a VPN shields your DNS queries and any stray unencrypted bits from whoever’s running, or snooping on, that network.
A VPN is an encrypted tunnel that shifts your trust off your ISP and onto a server you picked. Nothing more, nothing less. Get your head around that one sentence and you’ll be making smarter calls than ninety percent of the folks out there parroting ad copy.
Update history: replaced the repeated CERT-In paragraphs with one summary of what the Directions require, removed an undated speed figure, and added the WireGuard protocol source.
Sources
- CERT-In Directions under Section 70B (28 April 2022) — primary source for the dated regulatory qualification above; applicability and later amendments require current CERT-In/MeitY review.
- RFC 8446 — TLS 1.3, the HTTPS encryption referred to in the ‘what your ISP sees’ table.
- WireGuard protocol description — the handshake and encapsulation described in the tunnel steps.