How VPNs change your public IP and the trust boundary
A VPN wraps traffic between your device and a VPN server. Websites then see the server’s address, while the local network sees an encrypted connection to the provider.
Trace what a VPN hides from websites and local networks, what the VPN provider can see, and where leaks occur.
The new trust boundary
Without a VPN, the access provider carries traffic toward each destination. With a VPN, it carries an encrypted tunnel and the VPN operator forwards the traffic. HTTPS still matters because it protects content beyond the VPN exit and authenticates the destination.
What remains visible
A destination can still recognize logins, cookies, browser characteristics, and behavior. The VPN sees connection metadata and may see destination information depending on protocol and encryption. An address swap is only one privacy layer.
Leaks and failure modes
DNS queries sent outside the tunnel, IPv6 paths not handled by the client, or a tunnel that drops without a kill switch can expose a different address than expected. Browser WebRTC behavior may reveal local interfaces, though modern browsers limit older leak patterns.
Verify the changed exit without calling it anonymity
A controlled before-and-after check can confirm the public route used by this browser. DNS, IPv6, split tunnels, accounts, and browser signals still need their own evidence.
- Run the VPN and intermediary IP check to compare the address and network reaching this server with a saved direct baseline.
- Inspect the observed exit address when a proxy, company gateway, or other intermediary may change the visible network.
- Understand browser fingerprint signals to evaluate what a destination can correlate beyond the public address.
A practical checklist
- Compare the visible address before and after connecting.
- Test DNS and IPv6 behavior as well as IPv4.
- Read retention and ownership disclosures instead of relying on a ‘no logs’ badge.
Questions readers ask next
Does a VPN make me anonymous?
No. Accounts, cookies, payment records, and browser signals can still identify or correlate activity.
Should I keep HTTPS with a VPN?
Yes. The VPN protects one segment; HTTPS protects the application connection to the site.
Sources and further reading
The key ideas and how they connect
A VPN wraps traffic to an exit server. The access provider sees the tunnel, while destinations see the VPN exit for traffic that actually uses it.
Client encrypts to the VPN
This protects the local path up to the operator’s server.
VPN forwards the request
The destination normally receives the VPN server’s public address.
Trust moves rather than vanishes
The VPN operator and destination still occupy different observation points.
A changed IP proves one route, not anonymity
Before connecting, the browser shows an ISP address. After connecting, the VPN IP address check shows the chosen exit network. That supports the tunnel path for this page. A signed-in account can still identify the visit, and another app may follow split-tunnel rules.
Core semantic relationships
| Subject | Relationship | Object |
|---|---|---|
| VPN client | encrypts traffic to | a VPN server |
| VPN server | forwards traffic toward | the destination |
| Destination | observes | the VPN exit address |