You Probably Do Not Need a VPN

tl;dr: Enable “Always use HTTPS” and then use Tor if needed. Use Public WiFi without fear with/without a VPN.

I have been more privacy conscious over time and while it is evolving, my threat model has mostly stayed the same: A criminal looking to exploit my devices/data. My decisions revolve around this and I always make sure it makes a lot of sense in that context. One of those decisions is to NOT use a VPN.

If you browse anything YouTube (not even privacy related videos), you will certainly come across VPNs as a common sponsor. And the ads always seem to overstate the benefits. In reality, VPNs are much less useful than they are marketed for. For the average person with a threat model of “I want to ensure no criminal can look at my stuff”, there are already free tools that actually work.

What a VPN fundamentally does

A VPN is a networking tool - not a privacy tool. A VPN expanded is literally “Virtual Private Network”. It creates a “Private Network” between computers that aren’t physically close together. That’s why it’s highly used in corporate settings.

In other words, imagine if you had extremely long cables to connect your computers to other computers. That is practically what a VPN does. When you visit a website, it would look like it is coming from that network rather than from your computer. They do this through a process of encryption so no one else except you, the computers in the network, and the VPN provider can see it can see what is happening. To your ISP, you look like you are going to “[ insert your VPN provider ]”.

What a commercial VPN is selling is their network. So when you visit Netflix, it wouldn’t look like it came from you. It would look like it came from “[ insert your VPN provider ]”.

This doesn’t mean it prevents tracking. If you log in to an account on the website, it doesn’t matter what VPN you use - the website knows it’s you. If the website even does browser fingerprinting, it will be able to deduce with good probability who you are. The point is that you cannot rely on a VPN to anonymise you.

You can use Public WiFi safely without a VPN

Now let’s talk of Public WiFi. Most articles say that you need a VPN to protect yourself from snooping people in a public WiFi. Here’s a reality: the recommendation to avoid Public WiFi is outdated. You can safely ignore that recommendation and connect to Public WiFi to do your banking and other security-sensitive stuff.

The reason is simple: HTTPS. That basically means your traffic is encrypted and only you and the website owner knows what you are doing. Someone can still see you are visiting bank.com at a certain time but no one can see what you are doing. If they try to hijack that, you will know because your browser will tell you.

Today, if you look at CloudFlare which serves around 20% of the internet, HTTPS adoption is 98.6% exactly as of writing. And I wager that the bulk of the remaining is a redirect to the same site in HTTPS.

If you aren’t sure you are using HTTPS for all, you will know as your browser will notify you. You can see for yourself with these two websites: HTTP Forever and Never SSL. On a modern browser, you will notice that the two sites will be giving you a warning. If you do not, you are using HTTPS. This alone protects against a lot of the threats VPNs are supposed to protect against.

Before HTTPS, it was HTTP (note the missing S). Anyone can snoop in your connection by hijacking it and modifying the content. Maybe they give you malware instead of facebook.com’s homepage. Or they steal your passwords. But now? They cannot do it without letting you know something is tampering with you. You can try it with any of the red examples in Bad SSL.

For most people, just enable “Always use HTTPS”. Chrome does this automatically by October 2026. You can enable it in advance through settings which is a good idea. Firefox does this here. I don’t use an iPhone anymore but I am pretty sure you can set it as well in Safari.

If you are curious as to the technology, read this CloudFlare article about HTTP and HTTPS. It is just relatively recently that HTTPS dominated Internet connections which is why the advice about Public WiFi was actually good. These days though, the danger is practically nonexistent.

When are VPNs useful?

VPNs are useful still for some minor usecases:

1. You REALLY want to hide the fact that you are browsing the internet. If you browse Wikipedia, generally the ISP will know you browsed Wikipedia which could mean anything from their website. But what if you want to hide you went to “website-about-democracy.com”? What if you want to whistleblow and want to leave as few tracks as possible? A VPN will make it so that your ISP knows you used the internet but not what for.
2. You want to spoof your location FROM the website owner. Generally this is meant to get around georestrictions. A VPN allows you to look like you come from Germany when you’re actually in Singapore.
3. You want to hide from the website owner. A VPN acts like a middleman between you and the website so if the website isn’t something trustworthy, a VPN helps. Again, this is not enough. If you log in to a website, of course they will know it’s you. A VPN is a layer but not thick enough to do the heavy lifting.

Sometimes, you can also use VPNs to bypass local network restrictions. For example, on a corporate network, you might use a commercial VPN to bypass them blocking amazon.com. That said, that also is a huge red flag to anyone who set it up correctly and they can immediately track who actually did it FAST. For these cases, the better recommendation is to just use your mobile data.

Use Tor if needed

For most people, they will only ever need a VPN for rare instances. For those rare instances, Tor is more than sufficient.

Of course, a VPN is still useful if you need to use it 24/7 especially for bypassing georestrictions. Tor’s design means it will be MUCH slower than regular browsing and you will not be able to select which country to spoof. A VPN will still be slower than regular browsing but because it’s only one hop, it is much faster. Also, Tor is blocked in certain jurisdictions but some VPNs still work. Still, I think VPNs are very much “on a need to have basis” than something you regularly have.

This is why I suggest you get Mullvad rather than like, a 2-year plan from whatever sponsor your YouTuber currently has. It costs 5 EUR every month or 6 USD if you speak that way. If you need less than that, you can consider iVPN which offers one week plans.

No - this is not sponsored. I just don’t think it’s reasonable for most threat models to have a VPN 24/7. If you do, then by all means go for it. But most people will not be able to justify the cost and should focus on other measures to protect their privacy.