VPNs Won't Save You (But Here's What Might)

Every other YouTube ad is a VPN sponsor telling you that hackers are stealing your data at coffee shops and the only thing standing between you and identity theft is their app at 80% off for the next 11 minutes.

Most of that is nonsense. Here's what VPNs actually do, what they don't, and what you should use instead for the threats they can't touch.

What a VPN Actually Does

A VPN encrypts your traffic between your device and the VPN server, then sends it out to the internet from the server's IP address instead of yours. That's it. Two things:

1. Your ISP can't see what you're doing (they see encrypted traffic to the VPN server)
2. Websites see the VPN server's IP instead of yours

Both of those are genuinely useful in specific situations. But they're a lot narrower than the marketing suggests.

The Coffee Shop Myth

"Hackers on public WiFi" was a legitimate concern in like 2012. Back then, a lot of web traffic was unencrypted HTTP, and someone on the same network could intercept your login credentials with a tool like Firesheep.

In 2025, basically everything uses HTTPS. Your bank, your email, your social media — all encrypted in transit by default. A hacker on the same WiFi can see that you connected to gmail.com, but they can't read your emails or steal your password. The lock icon in your browser is doing the job the VPN companies claim only they can do.

Are there edge cases? Sure. Some IoT devices, some poorly configured apps, the occasional HTTP-only site. But "you need a VPN to use coffee shop WiFi safely" is roughly as outdated as "you need antivirus software to open email."

What VPNs Don't Protect Against

Here's where it gets important:

Browser Fingerprinting

Your canvas fingerprint, WebGL renderer, audio context signature, screen resolution, timezone, installed fonts — none of this goes through the VPN tunnel. It's all local to your browser. A VPN changes your IP address; it doesn't change your hardware.

I've tested this. Connect to a VPN, run the fingerprint scan. Disconnect, run it again. Every hardware-based identifier is identical. The only thing that changed was the IP address and maybe the timezone (if the VPN server is in a different region).

WebRTC Leaks

This is the ironic one. WebRTC — used for video calls and peer-to-peer connections — makes STUN requests that can bypass your VPN entirely and expose your real IP address.

const pc = new RTCPeerConnection({
  iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
})
pc.createDataChannel('')
pc.createOffer().then(offer => pc.setLocalDescription(offer))
pc.onicecandidate = (event) => {
  if (event.candidate) {
    // This might contain your REAL IP, not the VPN's
    console.log(event.candidate.candidate)
  }
}

Some VPNs and browsers block this. Many don't. If your VPN doesn't handle WebRTC, you're paying $10/month for privacy theater while your browser casually hands out your actual IP to anyone who asks.

DNS Leaks

Even if your traffic goes through the VPN, your DNS queries might not. If your system is configured to use your ISP's DNS servers (which is often the default), every domain you visit gets logged by your ISP regardless of the VPN.

Good VPNs force DNS through the tunnel. Bad ones don't. Most people never check.

Cookies and Login State

If you're logged into Google and browsing with a VPN, Google knows exactly who you are. The VPN changed your IP, not your session cookie. Same goes for every other service you're authenticated with.

This seems obvious when stated plainly, but a lot of people seem to think VPN = anonymous, even while logged into a dozen services that know their name.

Tracking Scripts

Third-party trackers (Google Analytics, Facebook Pixel, ad networks) identify you through cookies, fingerprinting, and cross-site tracking. None of that goes through the IP layer. A VPN is invisible to these techniques.

What Actually Helps

Different threats need different tools. Here's a more honest breakdown:

Against ISP Surveillance

A VPN actually works here. This is the legitimate use case. Your ISP can't inspect encrypted VPN traffic. If you don't want Comcast building a profile of every site you visit, a VPN handles that.

Alternatively: DNS-over-HTTPS (DoH) prevents your ISP from seeing your DNS queries, which is most of what they'd use. Firefox has it built in. It's free and doesn't require routing all your traffic through a third party.

Against Browser Fingerprinting

Firefox with privacy.resistFingerprinting — Lies about your timezone, screen size, fonts, and other fingerprintable properties. Breaks some sites, significantly improves privacy.

Brave — Randomizes canvas and audio fingerprints per-session. Good middle ground.

Tor Browser — The gold standard. All users look identical. But it's slow and some sites block it.

A VPN does nothing here.

Against Cross-Site Tracking

uBlock Origin — Blocks tracking scripts before they execute. This is probably the single most effective privacy tool for everyday browsing.

Firefox Enhanced Tracking Protection (on by default) — Blocks known third-party trackers.

Container tabs (Firefox Multi-Account Containers) — Isolate different sites into separate cookie jars. Google in one container can't see your Amazon cookies in another.

A VPN does nothing here either.

Against WebRTC Leaks

Disable WebRTC — Firefox: set media.peerconnection.enabled to false in about:config. Breaks video calls but plugs the leak.

uBlock Origin — Has a WebRTC leak prevention setting.

Browser extensions — WebRTC Leak Shield and similar. Varies in effectiveness.

Some VPNs handle this, many don't.

For Actual Anonymity

Tor Browser. Full stop. If your threat model requires real anonymity, Tor is the tool. VPNs require trusting the VPN provider (who can see all your traffic). Tor distributes trust across multiple relays so no single entity sees both who you are and what you're doing.

The VPN Trust Problem

Here's the part VPN companies don't like talking about: when you use a VPN, you're moving trust from your ISP to the VPN provider. Instead of your ISP seeing all your traffic, the VPN company sees all your traffic.

"No-logs policy" is a marketing claim, not a technical guarantee. Some VPN providers have been caught logging despite their policies. Others have been compelled by law enforcement to install monitoring. Unless the VPN has been through an independent audit (and even then), you're taking their word for it.

You're essentially asking: "Do I trust my ISP more or this VPN company more?" For most people, the VPN company is probably the better bet. But it's a trust decision, not a technical guarantee.

The Honest Recommendation

If you want better privacy, here's the actual priority order:

1. uBlock Origin — Install this first. Blocks more tracking than everything else combined.
2. Firefox — Better default privacy than Chrome. Enhanced Tracking Protection, container tabs, resistFingerprinting flag.
3. DNS-over-HTTPS — Free, built into Firefox, prevents ISP DNS snooping.
4. A reputable VPN — For the ISP visibility thing. Mullvad or IVPN if you want the least amount of trust required. They accept cash and don't require an email to sign up.
5. Tor Browser — When you actually need anonymity, not just privacy.

Notice that VPN is fourth on the list, not first. The stuff above it is free and covers more threat surface.

Check Your Own Setup

I built a tool that shows you exactly what your browser is leaking: benploni.com/aboutyou. Run it with your VPN on and off. Compare the results. You might be surprised how little changes.