How a VPN changes the IP websites see
Without a VPN, Internet traffic generally travels from your device through your ISP to the website. The website receives the public IP used by your connection. With a VPN, traffic first travels through an encrypted connection to the VPN server. The website then receives the server's IP.
What a VPN can hide
- Your original public IP from websites.
- Your approximate ISP-based location from websites.
- The destination of encrypted traffic from a local network observer.
What it does not automatically hide
- Accounts you sign in to.
- Cookies and browser fingerprinting signals.
- GPS or device location permission.
- Information you submit to a website.
Who can see what when you use a VPN?
| Observer | Usually sees | Usually does not see from the IP alone |
|---|---|---|
| Website | VPN server IP, browser data, cookies and account activity | Your original ISP public IP when the tunnel covers that traffic |
| Internet provider or local network | A connection to a VPN server, timing and transferred data volume | The contents of properly encrypted traffic inside the tunnel |
| VPN provider | Your source IP and the traffic reaching its VPN endpoint | HTTPS page contents protected end-to-end from the browser to the website |
| Signed-in service | Your account identity and activity, even when the IP changes | A guarantee of your physical location based only on the VPN IP |
A VPN changes which network operator you trust. It reduces what the local network and ISP can learn about protected traffic, but the VPN operator runs the exit server. HTTPS remains important because it protects data between your browser and the destination website even after traffic leaves the VPN server.
How to check whether your VPN changed your IP
- Disconnect the VPN and open the My IP homepage.
- Note the public IPv4, IPv6, ISP and approximate location shown.
- Connect to the VPN and reload the page.
- Confirm that the public IP and network information changed.
- If an IPv6 address remains unchanged, review the VPN's IPv6 protection settings.
A changed address indicates that web traffic reaching the page is using the VPN server. It does not prove complete anonymity or test every possible privacy signal.
A stronger before-and-after test
- Close downloads and other apps that may reveal confusing background traffic.
- With the VPN disconnected, record the public IPv4, IPv6, ISP and country.
- Connect to one VPN location and open a new browser tab.
- Reload the My IP homepage and record the same four fields.
- Check the DNS resolver reported by a reputable DNS leak test.
- Repeat after changing VPN servers to confirm the result follows the selected exit.
The original public IPv4 should no longer appear in the website test. If your connection has IPv6, verify it separately: a VPN may replace it, tunnel it or disable it while connected. A result that shows no IPv6 is different from a result that exposes the original IPv6 address.
Can a VPN leak your original IP?
A configuration problem, disconnected tunnel or unsupported IPv6 traffic may allow traffic to use the normal connection. Some VPN applications include a kill switch that blocks Internet access if the tunnel drops. Keeping the VPN application and operating system updated also reduces compatibility problems.
Split tunneling is not always a leak
Split tunneling intentionally sends selected applications or destinations outside the VPN. This can improve speed or keep local printers available, but excluded traffic uses the normal network and may show the ISP address. Review the app list and routing rules before assuming the VPN has failed.
What a kill switch does
A kill switch attempts to block traffic if the encrypted tunnel drops. Test it only when interrupting the connection is safe: start with the VPN connected, disconnect the tunnel and confirm that Internet access stops until protection returns. Behavior can differ after sleep, Wi-Fi changes or switching between wired and wireless networks.
What is a DNS leak?
DNS translates domain names into network addresses. If DNS requests go to the ISP's resolver while the VPN is connected, the ISP may still observe the domain lookup requests. A trustworthy VPN should describe how it handles DNS and whether it uses its own resolvers inside the tunnel.
A resolver name alone does not always prove a leak. Some browsers use encrypted DNS, and a VPN may use a third-party resolver by design. The important questions are whether the request traveled outside the intended tunnel and whether the resolver belongs to your ISP when you expected the VPN to handle DNS.
Does WebRTC reveal your real IP?
WebRTC supports real-time browser communication. Modern browsers often limit exposure of local addresses, but VPN and browser configurations can vary. Keeping the browser current and checking both IPv4 and IPv6 after connecting provides a more useful test than relying on one address alone.
Mozilla also documents that WebRTC may expose a local address in some configurations. Local private addresses and the original public ISP address are different findings. See Mozilla's WebRTC connection guidance .
Does incognito mode hide your IP?
No. Private or incognito mode mainly prevents the browser from keeping some local history and session data after the window closes. Websites, network operators and Internet providers still receive the connection's public IP unless another service, such as a VPN, changes the route.
Can a VPN hide your physical location?
It changes the approximate location associated with the public IP, often to the VPN server's city or country. It cannot override GPS information, Wi-Fi-based location or an address saved in an account if a website has permission to use those signals. Learn more in our guide explaining why an IP location may appear wrong .
VPN versus proxy
A proxy usually routes traffic from one application or protocol, while a VPN commonly routes more of the device's network traffic through an encrypted tunnel. The exact protection depends on the service, application settings and operating system configuration.
How to evaluate a VPN without relying on slogans
- Confirm support for IPv4, IPv6 and DNS protection on your operating system.
- Check whether split tunneling and the kill switch are enabled by default or optional.
- Read the logging policy and identify the legal company operating the service.
- Prefer clear protocol documentation and independently reviewable applications or audits.
- Check how the provider handles account recovery, payments and abuse complaints.
- Avoid treating “no logs,” “military-grade” or “anonymous” as proof without verifiable details.
An audit or privacy policy is useful evidence, but neither guarantees future behavior. Choose according to your threat model: securing public Wi-Fi, changing an IP-based region, protecting work traffic and resisting targeted tracking are different goals.
Check your public IP before and after connecting
Use What Is My IP? to compare your current connection. You can also use the IP Address Lookup to inspect the approximate location and provider associated with the address shown by your VPN.