Who this guide is for
You’re new to VPNs and want to know how one works, what changes when you connect, and whether you need one.
Who it’s not for
If you mostly browse at home on a network you trust and your main worry is a hacked account or a scam email, a password manager and two-factor authentication do more.
In short
- A VPN encrypts the traffic between your device and a VPN server, so the network you’re on and your internet provider can’t read it.
- Websites see the VPN server’s IP address instead of yours, but sites you sign in to still know it’s you.
- The protocol, such as WireGuard or OpenVPN, builds the tunnel. A kill switch and leak protection help keep your traffic inside it.
- A VPN doesn’t make you anonymous, stop phishing or remove malware, and it adds some overhead rather than speed.
- Using a VPN is legal in the UK. Elsewhere the rules vary, so check the local law before you travel.
On this page
VPN stands for virtual private network. In everyday use it means an app that sends your internet traffic through an encrypted tunnel to a server run by the VPN service, and out to the internet from there. The network you’re on, whether that’s home broadband, a hotel’s Wi-Fi or a mobile connection, carries the tunnel without being able to read what’s inside it. Websites and apps see the VPN server’s IP address rather than the one your provider gave you.
That’s the whole idea. The rest of this guide explains how it works in practice, what it protects, the parts people often misunderstand, and how to tell whether it’s worth having.
How a VPN works
Without a VPN, your device sends traffic to your router, through your internet provider and on to each website or service. Each network along that route handles your traffic, and several of them can see where it’s going. With a VPN connected, the route changes.
- Your deviceThe app encrypts your traffic before it leaves.
- Encrypted tunnelThe local network and your provider see a connection to the server, not what’s inside.
- VPN serverDecrypts your traffic and passes it on.
- Website or appSees the VPN server’s IP address instead of yours.
- Your device and the VPN server agree keys. When you connect, the app authenticates with the server and the two sides agree encryption keys for the session.
- Traffic is encrypted before it leaves your device. Anything routed through the tunnel is scrambled on your device, so it’s unreadable to anyone who intercepts it on the way.
- The server passes it on. The VPN server decrypts your traffic and sends it to the website or app you asked for. Replies come back the same way, encrypted again for the trip to your device.
- Websites see the server, not you. Your traffic arrives from the VPN server’s IP address, so the site sees that address and its location rather than yours.
From the outside, the local network and your internet provider see an encrypted connection to a VPN server and roughly how much data is moving through it. They don’t see the contents, and DNS leak protection is designed to stop them collecting the list of domain names your device looks up.
What changes when you connect
| What’s visible | Without a VPN | With DarkMatter connected |
|---|---|---|
| Your IP address | Seen by every site and app you use | Replaced by the VPN server’s address |
| Which sites you visit | Visible to your network and provider | Hidden inside the encrypted tunnel |
| DNS lookups | Usually handled by your provider or the network | Designed to go through the tunnel |
| Apps that don’t encrypt properly | Readable in transit | Encrypted inside the tunnel |
| Your apparent location | Where you are | Where the VPN server is |
| Sites you sign in to | Know it’s you | Still know it’s you |
| Your connection | Your normal route | Some added overhead |
The last two rows matter as much as the first five. A VPN changes what the networks in between can see. It doesn’t change who you are to a service you log in to, and it doesn’t make your line faster.
Every feature on every plan
Encrypt your connection on up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TV
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
What a VPN protects you from
Snooping on networks you don’t control
Public and shared Wi-Fi is run by people you’ve never met. Most websites already use HTTPS, which encrypts what you send to them, but the network can still see where your device goes, and anything that isn’t encrypted properly travels readable. A VPN wraps all of it in one tunnel. Our public Wi-Fi guide goes into the specific risks.
Your provider’s view of your browsing
At home, your internet provider can usually see which domains you visit and when. Some providers also manage or slow particular kinds of traffic. Inside a VPN tunnel, your provider sees an encrypted connection to a VPN server instead. That may help where traffic is managed by type, though not where your whole line is limited.
Tracking by IP address
Your IP address is one of the signals advertisers, data brokers and websites use to recognise you and estimate where you are. A VPN replaces it with the VPN server’s address. It’s one signal among many: cookies, browser fingerprints and the accounts you sign in to still identify you, so a VPN reduces tracking rather than ending it. You can see what your connection reveals right now with our IP checker.
Where you appear to be
Connecting through a server in another country gives you an IP address in that country. That’s useful when you’re travelling and want your accounts to see a familiar location. What a website or service then shows you is up to that website, and many detect VPN addresses and respond in their own way. Our travel guide covers this in more detail.
Protocols and encryption, briefly
A VPN protocol is the set of rules that builds the tunnel: how your device and the server prove who they are, agree keys and wrap your traffic. The network DarkMatter runs on supports four.
| Protocol | What it is | Good to know |
|---|---|---|
| WireGuard | A modern protocol with a small, readable codebase | The default in our apps |
| OpenVPN | A long-established open-source protocol | Widely supported and well understood |
| IKEv2 | A key-exchange protocol usually paired with IPSec | Built into many operating systems |
| IPSec | A suite of standards for securing internet traffic | Often used together with IKEv2 |
Traffic in the tunnel is protected with AES-256 encryption. If you can’t connect on a particular network, trying a different protocol is a sensible first step, though some networks block VPN connections and we can’t promise it will connect.
The features that keep traffic in the tunnel
Encryption only helps if your traffic actually goes through the tunnel. Three features deal with the ways it can escape.
- Kill switch. Connections drop, especially on mobile and public networks. A kill switch is designed to block traffic if the tunnel drops, so your device doesn’t quietly carry on over the open connection. DarkMatter’s is in our Windows app.
- DNS and IPv6 leak protection. Name lookups and IPv6 traffic can travel outside the tunnel if nothing stops them. Leak protection is designed to keep them inside.
- Split tunnelling. Some things work better on your normal connection, such as a printer on your home network or an app that objects to VPN addresses. Split tunnelling lets you choose what goes through the tunnel. DarkMatter’s is in every app except the iPhone, iPad and Mac apps.
Do you need a VPN?
It depends on how you use the internet. A VPN is most useful when:
- you regularly use Wi-Fi you don’t control, in cafés, hotels, airports, halls or shared offices;
- you’d rather your internet provider didn’t have a readable record of the sites you visit;
- you travel and want your accounts to see a steady, familiar location;
- you want to keep your home IP address away from the services and people you connect to, such as other players in peer-hosted games.
It adds less if you mostly browse at home on a network you trust and your main worry is an account being hacked or a scam email. For those, a password manager and two-factor authentication do more. If you want the detail for a particular situation, there are guides for remote work, students, online banking, streaming, blocked websites and gaming.
Is using a VPN legal?
Using a VPN is legal in the UK. In other countries the rules vary: some regulate or restrict VPN use, and some only allow approved providers. If you’re travelling, check the law where you’re going. Wherever you are, anything that’s illegal without a VPN is still illegal with one, and our acceptable use policy sets out what we don’t allow.
How to choose a VPN
Most providers describe themselves as private and secure. These are the things you can actually check:
- What the provider holds about you. Read what they say they keep and what they can’t see, not just the headline. Ours is in the Trust Centre.
- The renewal price. Introductory prices often renew higher. Find the renewal price before you pay; ours is shown on the pricing page.
- The refund terms. Check how long you have and what’s covered. Ours is a money-back guarantee on your first purchase: 30 days, or 14 days on monthly plans.
- Apps for your devices. Make sure there are apps for what you use and that one plan covers enough of them. We have apps for Windows, macOS, iOS, Android and Fire TVWindows, macOS and iOS, and a plan covers up to 5 devices.
- What it says it can’t do. A provider that promises total privacy, guaranteed access or faster speeds is overselling.
The honest bit
What a VPN can’t do
A VPN is a useful privacy tool with clear limits, and it’s better to know them before you rely on one.
- It doesn’t make you anonymous. Sites you sign in to know it’s you, and cookies and browser fingerprints can still identify your device.
- It doesn’t stop phishing, scams or malware. The tunnel carries whatever you send, including a password typed into a fake page.
- It moves trust rather than removing it. Your internet provider sees less, and the VPN service’s network carries your traffic instead. Read what a provider holds before you choose one.
- It doesn’t make your connection faster. Encryption and the extra distance to the server add overhead, and it won’t lower your ping.
- It can’t promise access. Some networks and countries block VPN connections, and many websites and streaming services detect VPN addresses and set their own rules. We can’t promise any of them will work while you’re connected.