Do you really need a VPN?

The short answer

If you are at home, on your own broadband, doing ordinary things — banking, shopping, email, streaming — you almost certainly do not need a VPN. The protection that matters for those jobs is already there: the padlock in your browser. What a VPN adds is privacy from whoever runs the network you are using, which matters far more in a hotel than in your own living room.

Where a VPN does earn its money is away from home, on connections you do not control, and for people who genuinely need their browsing kept from the company providing it. That is a real list of people — it is just much shorter than the adverts suggest.

What a VPN actually is

A VPN — virtual private network — builds an encrypted tunnel from your device to a computer run by the VPN company, and sends everything you do through it. The National Cyber Security Centre describes VPNs as encrypted network connections that guarantee the security of “data in transit” across an untrusted network.

Here is the part worth understanding, because everything else follows from it: a VPN does not remove the need to trust somebody — it moves that trust. Without one, your broadband provider can see which sites you connect to. With one, it sees an encrypted connection to the VPN company — and the VPN company is now the one who could see where you go. You are choosing who to trust, which is exactly why a free app from a name you have never heard of is a bad trade.

Why the coffee-shop story has changed

The warning that sold VPNs for a decade — a stranger on café Wi-Fi reading your banking password — is largely history. Nearly all web traffic is encrypted now: Google reports that over 99% of public sites loaded in Chrome on Mac and Android use HTTPS, and 98% on Windows, and from October 2026 Chrome will ask permission before opening a public site that is not encrypted at all. Your connection to your bank is already private, VPN or no VPN.

What somebody running the network can still see is which sites you visit, and that is the gap a VPN closes. There is also the older, simpler risk: a hotspot named to look like the hotel’s. A VPN protects you there, though so does the plain habit of checking the network name and using your phone’s own data when in doubt.

When a VPN genuinely earns its place

• You work from other people’s networks — hotels, sites, cafés, a customer’s guest Wi-Fi, a van parked somewhere with signal.
• You travel, and want your own country’s services and your usual internet while you are away.
• You would rather your broadband provider did not have a list of the sites you visit — a legitimate preference, not a suspicious one.
• You are researching something sensitive — a health worry, a job move, leaving a relationship — on a connection somebody else can see.
• Your employer requires one to reach work systems. That is a company VPN, set up by their IT people; it is a different thing from a consumer subscription and you should not replace one with the other.

The disadvantages nobody selling one mentions

• It costs you speed. Your traffic goes the long way round. On a fast line you may not notice; on a slow one you will.
• Things start refusing you. Banks are the common one: a login from an unfamiliar country looks like fraud, and you get locked out or pestered for checks.
• Streaming is not a free pass. The big services actively block VPNs, and using one to reach another country’s catalogue breaks their terms. We will not promise you it works, because it often does not.
• It is one more thing to keep working. Another subscription, another app that updates, another thing to switch off when something breaks and you are working out why.
• You have swapped who sees your browsing, as above. A VPN is only as trustworthy as the company behind it.
• It does nothing about the biggest risks. Scam emails, a convincing phone call, a weak password, no backup — a VPN is silent on every one of them.

Free VPNs: what the research found

Running a VPN service costs real money. If nobody is charging you, the product is usually you — and the measurements bear that out.

Researchers from the University of Michigan, the University of New Mexico and IIT Delhi audited 281 of the most popular free Android VPN apps and presented the results in February 2026: 247 of them — 88% — had at least one security or privacy failing, 29 leaked traffic outside the tunnel they promised, and the apps involved had been installed over 2.4 billion times between them.

Separately, the University of Toronto’s Citizen Lab and Arizona State University found in “Hidden Links: Analyzing Secret Families of VPN Apps” that several hugely popular Android VPN apps, presented as unrelated products, were quietly run by the same people and shipped with hard-coded passwords that would let an attacker decrypt their users’ traffic — the precise opposite of what the app was installed to do.

If you decide you need a VPN, pay for it. If the choice is a free VPN or no VPN, no VPN is usually the safer answer.

A VPN is not antivirus — they do different jobs

It is an easy confusion to make. Antivirus watches what arrives on your computer and stops it running. A VPN encrypts where your traffic goes. Neither does the other’s job, and a VPN will not save you from clicking a scam link or downloading something nasty. If you are choosing protection, start with our plain-English guide to antivirus, not with a VPN.

What we supply, and why we are telling you this

We are a Malwarebytes partner, and the protection we set up and manage — Malwarebytes Premium with its Privacy VPN — includes a VPN. So we could have written the usual page telling everyone they need one.

We would rather tell you the truth: for most people at home, the antivirus half is what earns its keep, and the VPN is a bonus you will use when you travel or work from somewhere else. For people who are out and about — trades, carers, anyone working from a van, a site or a café — having both, set up properly and actually kept running, is worth it. If you want the detail on the VPN itself, it is on the Malwarebytes page.

If you do want one, here is how to choose

• Pay for it, from a company with a name to lose.
• Look for a no-logs policy that somebody independent has audited — the claim is easy, the audit is not.
• Check there is a kill switch, which cuts your connection if the VPN drops rather than quietly letting your traffic out in the open.
• Make sure it covers the devices you actually use, phone included, and that you can cancel without a fight.
• Turn it off when you do not need it. A VPN you fight with all day is a VPN you will end up disabling permanently.

Sources on this page: NCSC device security guidance; Google Security Blog, “HTTPS by default”, 28 October 2025; MVPNalyzer, NDSS, February 2026; Citizen Lab and Arizona State University, FOCI 2025. Checked 18 September 2026.

Print / Save as PDF