Your turn
Each lab is one step from the video. Flip the switches, send a message and tap a watcher to see what it can see.
Each lab isolates one idea. The addresses are documentation-only examples (203.0.113.x, 198.51.100.x) and the website is made up.
Tap the buttons and send a letter.
Switch HTTPS on and off, send a message, then peek. What can the café wifi still read with the padlock on?
HTTPS encrypts the contents. Which parts of the packet stay visible to the wifi and the ISP?
Turn the lock on and off. Send a letter. Tap a helper to peek.
Pick a key to scramble the message. Then play the snoop: can you guess the key?
A shift cipher has only 25 useful keys, so a snoop can try them all. Real VPNs use keys like AES-256.
Slide the key. The words get mixed up! Can the snoop read them?
A toy model: real encryption uses far longer keys and much cleverer maths than a letter shift.
Flip the VPN on and off, send a message, and peek. Who can see the real website? Who sees your address?
With the tunnel on, compare the outer header the ISP sees with the source address the website logs.
Turn the tunnel on and off. Send a letter. Who can peek now?
Tap each card to flip it. Which things can a VPN really do?
Flip each claim. Where does the trust go, and what does a VPN not protect against?
Tap a card to flip it.
Mix HTTPS and the VPN, send a message, and tap each watcher. Which mix hides the most?
All four observers, both switches. Note what only HTTPS protects after the VPN server.
Turn things on and off. Send a letter and peek!
When you send a message on a computer, it goes on a trip, like a letter in the post. Helpers pass it along the way.
The café wifi and the internet company pass your letter along. A little lock keeps the inside secret. But they can still read some of the outside, and can usually tell where it is going.
A VPN puts your letter into a secret code, then into a new sealed envelope. It goes through a secret tunnel. The helpers can't see where it is really going!
At the end of the tunnel, a helper opens the envelope and sends your letter on. That helper can see where your letter is going, so it must be one you trust. A VPN can't stop tricks or viruses, and it doesn't make you invisible.
A VPN (virtual private network) uses an app on your device that works together with a VPN server somewhere else on the internet. Before your data leaves your device, the app encrypts (scrambles) it and wraps it in a new envelope addressed to the VPN server. This is the encrypted tunnel.110
The wifi you're on and your internet provider only see scrambled data heading to the VPN server. They can't read it or tell which website it's really for.9 The VPN server takes off the VPN wrapping, then sends it on to the website (with HTTPS, the contents stay locked). The website sees the VPN server's IP address, not yours, so to the website you appear to be wherever that server is.16
There's a catch: the VPN company can now see everything the tunnel hid from the others. You haven't got rid of a watcher. You've swapped one for another.12
When you open a website, your device doesn't talk to it directly. Your message goes from your device to the local network (for example a café's wifi router), then to your internet service provider (ISP), the company that connects you to the internet, and then across the internet to the website's server.9 For how that trip works in detail, see how the internet works and how wifi works.
Every piece of data carries a label with two addresses: where it's going, and where it came from. The "from" address is your IP address. It works like a home address for your device: it's how answers find their way back to you, and it gives a rough idea of where you are.111 Your ISP and other networks along the way can keep logs of which sites you visit.9 A 2021 report by the US Federal Trade Commission found that many ISPs collect and share more data about their customers than people expect.13
Mostly, yes, for the contents. Today most websites use HTTPS, the version of the web with the padlock in the address bar. HTTPS encrypts what you send and receive, so people on the same wifi can't read your messages or passwords. That's why the FTC now says public wifi is usually safe to use.38
But HTTPS leaves the label readable. Anyone along the path, including the wifi owner and your ISP, can usually still see which websites you visit (like wikipedia.org) and when, and how much data you download. They can't see which pages you read on that site, your login or your messages.1 A VPN hides the label too, from everyone between you and the VPN server.
| Who | Plain web (no padlock) | HTTPS, no VPN | HTTPS + VPN |
|---|---|---|---|
| Café wifi / local network | Site + contents | Which site, when | Only "scrambled data to a VPN server" |
| Your ISP | Site + contents | Which site, when | Only "scrambled data to a VPN server" |
| VPN company | (not in the path) | (not in the path) | Which site, when, and your real IP address |
| The website | Your IP address | Your IP address | The VPN server's IP address |
Based on EFF, Cloudflare and FTC guidance.193 (Anything you log in to, and any cookies, still tell the website who you are.)
Encryption is the mathematical process of making a message unreadable to everyone except someone who has the key. Undoing it is called decryption.710
In the player we use a toy version: shift every letter along the alphabet by a secret number. With key 3, MEET becomes PHHW. Someone with the key shifts the letters back; someone without it sees nonsense. A toy code like this is easy to crack by trying all 25 keys. Real VPNs use strong modern encryption with enormously long keys, for example a 256-bit key for the AES cipher, which has about 1077 possible values, far too many to try one by one.6
Networks send data in small chunks called packets, each with a label (header) and contents (payload). A tunnel works by encapsulation: the whole original packet, label and all, is put inside the contents of a new, outer packet. It's a packet inside a packet.10
In a VPN, the inner packet is encrypted, and the outer packet is addressed to the VPN server. Routers along the way only read the outer label, so the data crosses the ordinary internet while nobody outside can see in. That's why a VPN is called virtual (it's built in software on top of the public internet) and private (outsiders can't read what's inside).414 The rules for building the tunnel are called VPN protocols. Well-known ones include IPsec and OpenVPN.106
The tunnel stops at the VPN server. From there to the website, your data is protected only if the website uses HTTPS.9
Working from home. Companies and universities were using VPNs long before VPN apps were sold to the public. A work VPN lets staff connect to the organisation's private network from home or on the road as if they were in the building.62 For example, the University of Washington's VPN gives your device a university IP address so the campus network treats it as one of its own.12
Wifi you don't trust. On an open network where you don't know who runs it, a trustworthy VPN hides which sites you use from the network owner and anyone snooping on it.15
More private browsing. A VPN hides your browsing from your ISP and stops websites from seeing your real IP address. But the VPN company can see it instead.16
Because a VPN makes you appear to be somewhere else, it can change what a website shows you. Using it to get around a service's rules can break that service's terms, and many services block known VPN addresses.6 Schools, families and workplaces also set their own rules about VPNs on their networks and devices.
✗ "With a VPN I'm invisible online." Reality: it changes who can see your traffic, not whether anyone can. The VPN company sees it, and logins and cookies still identify you.1
✗ "Without a VPN, anyone on café wifi can read everything I do." Reality: mostly outdated. HTTPS already encrypts the contents on most sites; what leaks is which sites you visit.38
✗ "A VPN encrypts everything all the way to the website." Reality: only as far as the VPN server. After that, HTTPS does the protecting.9
✗ "A VPN is antivirus." Reality: it won't stop malware, scams or phishing.1
✗ "VPNs were invented for privacy apps." Reality: businesses used them first, so staff could reach the office network remotely.6