VPN vs proxy: what does each one actually hide?
A VPN encrypts all of your device’s traffic and routes it through a server that assigns you a new IP address, while a proxy only redirects the traffic of one app or browser and usually leaves the rest of your connection unencrypted — the two solve overlapping but different problems, and neither hides everything.
What each one replaces in your connection
A VPN sits below your operating system: once connected, every app and every open connection — browser, email client, background updates — goes through the encrypted tunnel and exits from the VPN’s server with the VPN’s IP address. A proxy usually operates one layer up, configured inside a single browser or app; only that program’s traffic is redirected, other apps on the same device keep using your real connection untouched, and most proxy types (aside from the less common encrypted ones) don’t encrypt what passes through them at all — anyone on the network path between you and the proxy can potentially read it. Common proxy types include HTTP proxies, built for web traffic specifically, and SOCKS proxies, which handle any kind of connection an app throws at them — neither was originally designed with privacy as the primary goal, unlike a VPN.
What websites see when you use one
From a website’s point of view, both look the same at first glance: requests arriving from the VPN or proxy server’s IP address instead of yours, with that server’s ASN, location, and network type replacing your own in every lookup. Datacenter hosting, a different city or country, and an ISP that clearly isn’t a residential carrier — that’s the same shift our own VPN test checks for on the connection you’re using right now, since it is exactly what any site sees. Because many VPN users typically share the same handful of exit servers, a site may also notice that same address suddenly repeating across many different-looking visitors in a short window — a pattern residential traffic rarely produces.
What a VPN does not hide
A VPN replaces your IP address, not your identity. It does nothing to hide the accounts you log into — a bank, an email provider, or a social network still knows exactly who you are the moment you sign in, address or not. It also does little against browser and device fingerprinting, which combines screen size, fonts, timezone, and dozens of quieter signals into an identifier that follows you across a changed IP; see what your IP reveals for the fuller picture of what is and isn’t covered by hiding an address alone. Cookies you already accepted, and any site you were already logged into before connecting, stay exactly as identifying as before. Your own ISP still sees that you’re connected to a VPN server, even though it can’t see what’s inside the encrypted tunnel — connecting to a VPN isn’t invisible, just unreadable in transit.
How VPNs get detected, and honest criteria for choosing one
Sites detect VPNs mainly by checking whether an IP’s ASN belongs to a datacenter or hosting provider rather than a residential or mobile ISP — the same signal covered in our ASN guide — sometimes backed by shared-IP-address blocklists built from other users’ abuse on that same server. No provider fully evades this, since paying for servers means paying for datacenter IP space by definition. Rather than chasing a specific brand, the honest questions are: does it keep connection logs, where is it legally based, does it encrypt properly and leak nothing on reconnect, and does its speed hold up for what you actually do — streaming, gaming, or just staying off datacenter blocklists day to day. Free options are worth extra scrutiny, since running servers costs money and a “free” VPN needs to fund that somehow. Independent no-logs audits, when a provider actually commissions and publishes one, are a stronger signal than a policy page alone, since anyone can write a privacy policy that says whatever they like.