VPN Glossary: Terms and Features Explained

A VPN is an encrypted tunnel between your device and a server run by someone else. Everything you send goes through that tunnel, so your internet provider and the networks you use can no longer read it or see which sites you visit. To the wider internet, your traffic appears to come from the VPN server's IP address, not your own.

People use a VPN for three broad reasons: privacy (hiding activity from an ISP or public Wi-Fi), access (reaching sites blocked in their country or region), and security (protecting data on untrusted networks). A VPN is not anonymity: the provider running the server can still see your traffic, which is why who you trust matters, and why some people run their own.

Encryption scrambles your data so that only the intended recipient can read it. Modern VPNs use ciphers like AES-256 or ChaCha20, both considered unbreakable in practice with today's computing. This is what stops anyone between you and the server - your ISP, a hacker on the same Wi-Fi - from reading your traffic.

Strong encryption is table stakes: every serious provider offers it. The differences that actually matter are elsewhere - the protocol used, whether the provider keeps logs, and where it is based.

An IP address is the number that identifies your device on the internet, a bit like a return address on an envelope. It reveals your rough location and ties activity back to your ISP account. When you connect to a VPN, websites see the server's IP instead of yours, which is how a VPN changes your apparent location.

Related terms you will meet below: a dedicated IP is one only you use, and a static IP is one that never changes.

DNS is the internet's address book: it turns a name like example.com into the numeric IP address your device actually connects to. Every site you open triggers a DNS lookup, so whoever answers those lookups sees your entire browsing history by name.

A good VPN runs its own DNS inside the tunnel so your ISP never sees these lookups. When that fails, it is called a DNS leak - one of the most common ways a VPN quietly exposes you.

The "tunnel" is the encrypted connection a VPN builds between your device and its server. Your real traffic travels inside it, wrapped so outsiders see only that a connection exists, not what is in it. How that tunnel is built and disguised is decided by the protocol in use.

A kill switch cuts your internet the instant the VPN connection drops, so your real IP and traffic are never exposed during the gap. Without one, a brief reconnect - common when switching Wi-Fi or waking a laptop - can leak your identity for seconds or minutes without you noticing.

It is the single most important safety feature for anyone using a VPN for privacy. Look for an always-on or system-level kill switch rather than one that only works inside the app.

Split tunneling lets you choose which apps or sites go through the VPN and which use your normal connection. You might route your browser through the VPN while your banking app, a local printer, or a streaming service you only want at home-speed stay outside it.

It is handy for speed and for services that block or misbehave on VPN IPs, but remember that anything you exclude is not protected.

A Double VPN (also called MultiHop) routes your traffic through two servers instead of one, encrypting it twice and changing your IP twice. Even if one server were compromised, it would not see both who you are and what you are doing.

It adds real privacy for high-risk users at the cost of noticeable speed. Most people do not need it day to day. You can build the same idea yourself by chaining a self-hosted server with Tor.

Obfuscation disguises VPN traffic so that it does not look like a VPN. Networks that block VPNs - national firewalls, some schools and workplaces - use deep packet inspection to spot the tell-tale signature of a VPN handshake. Obfuscation strips or hides that signature so the connection blends in with ordinary encrypted traffic.

This is the feature that decides whether a VPN works at all in heavily censored countries. Self-hosted, the strongest options are VLESS + Reality and AmneziaWG.

Tor over VPN sends your traffic into the Tor anonymity network after it leaves the VPN server. The VPN hides your Tor use from your ISP, and Tor hides your destination from the VPN. It is a strong combination for anonymity, but slow, and overkill for everyday browsing.

Some VPNs include a built-in blocker that stops ads, trackers, and known malware domains at the DNS level, before they ever load. It speeds up pages and cuts tracking without a separate browser extension. It is a convenience feature, not a core privacy control - a dedicated blocker is usually more thorough.

A dedicated IP is a VPN address that only you use, instead of one shared with hundreds of other users. It reduces the chance of being blocked or shown constant CAPTCHAs (because no one else has "burned" the IP), and it is useful for remote access to a work network or a whitelisted service.

The trade-off: an IP tied to you alone is slightly less private than blending into a shared crowd.

A static IP stays the same every time you connect, but may still be shared among a small group of users. It is a middle ground between a fully dedicated IP and the usual rotating shared IPs - handy when a service expects your address not to change.

Smart DNS reroutes only the small part of your connection that reveals your region, so you can watch geo-locked streaming libraries without full VPN encryption. It is faster than a VPN and works on devices that cannot run VPN apps, like some smart TVs and consoles - but it does not encrypt your traffic or hide your IP, so it is for access, not privacy.

WireGuard is a modern VPN protocol built for speed and simplicity. Its tiny codebase makes it fast, efficient on battery, and easy to audit, which is why most providers now offer it (sometimes under a branded name like NordLynx). The trade-off is that plain WireGuard is easy for censors to fingerprint and block.

OpenVPN is the long-established, battle-tested protocol that powered most VPNs for over a decade. It is slower than WireGuard but extremely mature and flexible, and its ability to run over TCP port 443 makes it good at slipping through restrictive firewalls. Still a solid default where reliability matters most.

IKEv2 is a fast, stable protocol that is especially good on mobile: it reconnects almost instantly when you switch between Wi-Fi and mobile data, so it is a common default in phone VPN apps. It is well supported natively on iOS and Windows, though less flexible than WireGuard or OpenVPN for getting around blocks.

VLESS is a lightweight proxy protocol, and Reality is a technique that makes its traffic impersonate a real HTTPS website - down to borrowing a genuine site's TLS certificate on the fly. To a censor's inspection tools it looks like you are simply visiting a major website, which makes it one of the hardest things to block.

It is a self-hosted, censorship-first choice rather than something mainstream apps offer.

Shadowsocks is a lightweight encrypted proxy designed from the start to be hard for censors to detect. It turns your traffic into a stream of random-looking bytes with no obvious signature, which is why it has long been a go-to for getting past national firewalls. Jigsaw's Outline makes running your own especially easy.

AmneziaWG is an obfuscated version of WireGuard. It keeps WireGuard's speed but changes the tell-tale packet signatures and mixes in junk traffic, so deep packet inspection can no longer recognise it as a VPN. It is a strong middle ground: near-WireGuard performance with real resistance to blocking.

A no-logs (or zero-logs) policy is a provider's promise not to record what you do while connected - the sites you visit, your real IP, timestamps. It is the single most important privacy claim a VPN makes, because a provider that keeps no records has nothing to hand over if asked.

A promise is only as good as its proof. Look for a policy backed by an independent audit, RAM-only servers, and a privacy-friendly jurisdiction. Self-hosting flips the question entirely: you are the only one who could keep logs.

A VPN is bound by the laws of the country it is based in, which can force it to collect or share data. The "5/9/14 Eyes" refers to alliances of countries that share surveillance intelligence; providers headquartered outside them (for example in Switzerland or Panama) are often seen as a safer bet for privacy.

Jurisdiction matters most alongside a genuine no-logs policy - there is nothing to compel if nothing is stored.

RAM-only servers keep everything in volatile memory instead of on hard drives. Every reboot wipes them completely, so there is no long-term data to seize or leak. It is a strong architectural backing for a no-logs claim, now offered by several major providers.

An independent audit is when an outside security firm inspects a VPN's apps, infrastructure, or no-logs claim and publishes its findings. It is the closest thing to proof that a provider does what it says. Prefer VPNs that have been audited recently and repeatedly, not just once.

A DNS leak happens when your device sends its DNS lookups outside the VPN tunnel - usually to your ISP - even though the rest of your traffic is protected. The result is that your ISP still sees every site you visit by name, quietly defeating much of the point of the VPN.

Many VPNs only protect older IPv4 traffic. If your connection also has newer IPv6 and the VPN ignores it, your real IPv6 address can leak straight through the tunnel. Good VPNs either route IPv6 through the tunnel too or disable it while connected.

WebRTC is a browser feature for video calls that can reveal your real IP address to websites, even with a VPN on. It is a browser-level leak rather than a VPN fault, but it undermines your privacy all the same. You can block it with a browser setting or extension and confirm with a leak test.

DPI is a technique that networks and national firewalls use to look inside traffic and identify what it is - including whether it is a VPN - rather than just where it is going. It is the technology behind most modern VPN blocking. The counter to it is obfuscation: making VPN traffic look like something ordinary.

Geo-unblocking means using a VPN to reach content restricted to certain countries, such as a streaming library available elsewhere. Streaming services actively block known VPN IPs, so this becomes a cat-and-mouse game - which is why providers advertise how reliably they unblock specific platforms.

P2P support means a provider allows peer-to-peer file sharing on its servers, often on specific "P2P-optimised" locations. For this use a kill switch and a real no-logs policy matter most, since your IP is otherwise visible to every peer in the swarm.

This is how many devices you can use on one subscription at the same time - your phone, laptop, TV, a partner's devices. Numbers range from a handful to unlimited. When you self-host, the practical limit is simply your server's capacity, and you add devices by handing out more keys.

Two-factor authentication means an account asks for two different things before letting anyone in: something you know, usually the password, and something you have, such as a phone or a small key. A leaked or guessed password alone is then not enough, which is why 2FA stops the overwhelming majority of automated account takeovers.

Not all second factors are equal. A code from an authenticator app is stronger than an SMS code, and a security key or passkey is stronger than both, because it cannot be handed to a fake site. After leaks like the one that exposed 24 billion passwords, the password is best treated as public knowledge and the second factor as the actual lock.

TOTP stands for time-based one-time password: the six digits that an authenticator app shows and replaces every thirty seconds. The app and the service share one secret, set up once by scanning a QR code, and both compute the same number from that secret and the current time. No network connection is involved, so the code works in flight mode and does not depend on your phone number.

The weak point is that you type the code yourself, which means a convincing copy of a login page can ask for it and relay it within seconds. That is the gap closed by a security key.

An SMS code is a one-time number sent to your phone number. It is the most common second factor and the weakest one, because it protects the number rather than you. In a SIM swap, someone contacts your mobile operator with your name and personal details, reports a lost phone and asks for the number on a new card; from that moment the codes arrive to them.

Every leak of personal data makes that conversation easier, which is why an SMS code is a step to move away from as soon as an authenticator app is available. It still beats having no second factor at all.

A passkey replaces the password with a pair of cryptographic keys. The private half stays on your phone, computer or password manager and is unlocked by your fingerprint or face; the public half sits with the service. Signing in means your device proves it holds the private half, so there is no secret to type and none stored in a database that could leak.

Because the device checks the site's real address before answering, a passkey simply does not work on a lookalike domain, which removes phishing from the picture. The practical question is portability: check that you can reach your passkeys from a second device before you rely on them.

A security key is a small physical device, usually on a keyring, that confirms logins over USB or NFC. It uses the same standards as a passkey, and the important property is identical: the key verifies which site is asking before it answers, so it stays silent on a fake page no matter how convincing that page looks.

Practical advice from anyone who uses one: register two keys, not one, and keep the spare where you keep documents. Losing a single key with no backup registered is the most common way people lock themselves out.

Backup codes are a short list of one-time strings a service gives you when you switch on two-factor authentication. Each one works once and exists for the day your phone is lost, wiped or replaced. They are the official way back into your own account.

Keep them offline: printed or written down, stored with your documents. Saving them only inside the same password manager that holds the password means a single lost device or forgotten master password takes away both halves at once.

A password manager creates and remembers a different long password for every site, so that one leak stays one leak instead of unlocking your mailbox and bank as well. Modern managers also store TOTP codes and passkeys, and fill them in only on the site they belong to, which quietly protects against phishing.

One trade-off is worth knowing: keeping the password and the second factor in the same vault means one master password protects both. For your most important accounts, keep the two in different places.

Phishing is the attempt to make you hand over credentials yourself, usually through a copy of a login page reached from a message, an advert or a search result. Modern phishing pages forward whatever you type to the real service immediately, so a password and even a one-time code can be used within seconds of being entered.

That is why the only factor that reliably resists it is the one you do not type: a security key or a passkey checks the address of the site itself and refuses to answer a stranger.