Each entry explains what a term means, why it matters, and - where it applies - which providers in our VPN catalog offer it. Skim the six categories below, use the quick links, or jump straight to a term.
Core concepts
VPN (Virtual Private Network)
A VPN is an encrypted tunnel between your device and a server run by someone else. Everything you send goes through that tunnel, so your internet provider and the networks you use can no longer read it or see which sites you visit. To the wider internet, your traffic appears to come from the VPN server's IP address, not your own.
People use a VPN for three broad reasons: privacy (hiding activity from an ISP or public Wi-Fi), access (reaching sites blocked in their country or region), and security (protecting data on untrusted networks). A VPN is not anonymity: the provider running the server can still see your traffic, which is why who you trust matters, and why some people run their own.
Encryption (AES, ChaCha20)
Encryption scrambles your data so that only the intended recipient can read it. Modern VPNs use ciphers like AES-256 or ChaCha20, both considered unbreakable in practice with today's computing. This is what stops anyone between you and the server - your ISP, a hacker on the same Wi-Fi - from reading your traffic.
Strong encryption is table stakes: every serious provider offers it. The differences that actually matter are elsewhere - the protocol used, whether the provider keeps logs, and where it is based.
IP address
An IP address is the number that identifies your device on the internet, a bit like a return address on an envelope. It reveals your rough location and ties activity back to your ISP account. When you connect to a VPN, websites see the server's IP instead of yours, which is how a VPN changes your apparent location.
Related terms you will meet below: a dedicated IP is one only you use, and a static IP is one that never changes.
DNS (Domain Name System)
DNS is the internet's address book: it turns a name like example.com into the numeric IP address your device actually connects to. Every site you open triggers a DNS lookup, so whoever answers those lookups sees your entire browsing history by name.
A good VPN runs its own DNS inside the tunnel so your ISP never sees these lookups. When that fails, it is called a DNS leak - one of the most common ways a VPN quietly exposes you.
Tunnel
The "tunnel" is the encrypted connection a VPN builds between your device and its server. Your real traffic travels inside it, wrapped so outsiders see only that a connection exists, not what is in it. How that tunnel is built and disguised is decided by the protocol in use.
VPN features
Kill switch
A kill switch cuts your internet the instant the VPN connection drops, so your real IP and traffic are never exposed during the gap. Without one, a brief reconnect - common when switching Wi-Fi or waking a laptop - can leak your identity for seconds or minutes without you noticing.
It is the single most important safety feature for anyone using a VPN for privacy. Look for an always-on or system-level kill switch rather than one that only works inside the app.
Split tunneling
Split tunneling lets you choose which apps or sites go through the VPN and which use your normal connection. You might route your browser through the VPN while your banking app, a local printer, or a streaming service you only want at home-speed stay outside it.
It is handy for speed and for services that block or misbehave on VPN IPs, but remember that anything you exclude is not protected.
Double VPN / MultiHop
A Double VPN (also called MultiHop) routes your traffic through two servers instead of one, encrypting it twice and changing your IP twice. Even if one server were compromised, it would not see both who you are and what you are doing.
It adds real privacy for high-risk users at the cost of noticeable speed. Most people do not need it day to day. You can build the same idea yourself by chaining a self-hosted server with Tor.
Obfuscation (stealth)
Obfuscation disguises VPN traffic so that it does not look like a VPN. Networks that block VPNs - national firewalls, some schools and workplaces - use deep packet inspection to spot the tell-tale signature of a VPN handshake. Obfuscation strips or hides that signature so the connection blends in with ordinary encrypted traffic.
This is the feature that decides whether a VPN works at all in heavily censored countries. Self-hosted, the strongest options are VLESS + Reality and AmneziaWG.
Tor over VPN
Tor over VPN sends your traffic into the Tor anonymity network after it leaves the VPN server. The VPN hides your Tor use from your ISP, and Tor hides your destination from the VPN. It is a strong combination for anonymity, but slow, and overkill for everyday browsing.
Ad and tracker blocker
Some VPNs include a built-in blocker that stops ads, trackers, and known malware domains at the DNS level, before they ever load. It speeds up pages and cuts tracking without a separate browser extension. It is a convenience feature, not a core privacy control - a dedicated blocker is usually more thorough.
Dedicated IP
A dedicated IP is a VPN address that only you use, instead of one shared with hundreds of other users. It reduces the chance of being blocked or shown constant CAPTCHAs (because no one else has "burned" the IP), and it is useful for remote access to a work network or a whitelisted service.
The trade-off: an IP tied to you alone is slightly less private than blending into a shared crowd.
Static IP
A static IP stays the same every time you connect, but may still be shared among a small group of users. It is a middle ground between a fully dedicated IP and the usual rotating shared IPs - handy when a service expects your address not to change.
Smart DNS
Smart DNS reroutes only the small part of your connection that reveals your region, so you can watch geo-locked streaming libraries without full VPN encryption. It is faster than a VPN and works on devices that cannot run VPN apps, like some smart TVs and consoles - but it does not encrypt your traffic or hide your IP, so it is for access, not privacy.
Protocols
WireGuard
WireGuard is a modern VPN protocol built for speed and simplicity. Its tiny codebase makes it fast, efficient on battery, and easy to audit, which is why most providers now offer it (sometimes under a branded name like NordLynx). The trade-off is that plain WireGuard is easy for censors to fingerprint and block.
OpenVPN
OpenVPN is the long-established, battle-tested protocol that powered most VPNs for over a decade. It is slower than WireGuard but extremely mature and flexible, and its ability to run over TCP port 443 makes it good at slipping through restrictive firewalls. Still a solid default where reliability matters most.
IKEv2 / IPsec
IKEv2 is a fast, stable protocol that is especially good on mobile: it reconnects almost instantly when you switch between Wi-Fi and mobile data, so it is a common default in phone VPN apps. It is well supported natively on iOS and Windows, though less flexible than WireGuard or OpenVPN for getting around blocks.
VLESS + Reality
VLESS is a lightweight proxy protocol, and Reality is a technique that makes its traffic impersonate a real HTTPS website - down to borrowing a genuine site's TLS certificate on the fly. To a censor's inspection tools it looks like you are simply visiting a major website, which makes it one of the hardest things to block.
It is a self-hosted, censorship-first choice rather than something mainstream apps offer.
Shadowsocks
Shadowsocks is a lightweight encrypted proxy designed from the start to be hard for censors to detect. It turns your traffic into a stream of random-looking bytes with no obvious signature, which is why it has long been a go-to for getting past national firewalls. Jigsaw's Outline makes running your own especially easy.
AmneziaWG
AmneziaWG is an obfuscated version of WireGuard. It keeps WireGuard's speed but changes the tell-tale packet signatures and mixes in junk traffic, so deep packet inspection can no longer recognise it as a VPN. It is a strong middle ground: near-WireGuard performance with real resistance to blocking.
Privacy and logs
No-logs policy
A no-logs (or zero-logs) policy is a provider's promise not to record what you do while connected - the sites you visit, your real IP, timestamps. It is the single most important privacy claim a VPN makes, because a provider that keeps no records has nothing to hand over if asked.
A promise is only as good as its proof. Look for a policy backed by an independent audit, RAM-only servers, and a privacy-friendly jurisdiction. Self-hosting flips the question entirely: you are the only one who could keep logs.
Jurisdiction (5/9/14 Eyes)
A VPN is bound by the laws of the country it is based in, which can force it to collect or share data. The "5/9/14 Eyes" refers to alliances of countries that share surveillance intelligence; providers headquartered outside them (for example in Switzerland or Panama) are often seen as a safer bet for privacy.
Jurisdiction matters most alongside a genuine no-logs policy - there is nothing to compel if nothing is stored.
RAM-only (diskless) servers
RAM-only servers keep everything in volatile memory instead of on hard drives. Every reboot wipes them completely, so there is no long-term data to seize or leak. It is a strong architectural backing for a no-logs claim, now offered by several major providers.
Independent audit
An independent audit is when an outside security firm inspects a VPN's apps, infrastructure, or no-logs claim and publishes its findings. It is the closest thing to proof that a provider does what it says. Prefer VPNs that have been audited recently and repeatedly, not just once.
Leaks and censorship
DNS leak
A DNS leak happens when your device sends its DNS lookups outside the VPN tunnel - usually to your ISP - even though the rest of your traffic is protected. The result is that your ISP still sees every site you visit by name, quietly defeating much of the point of the VPN.
IPv6 leak
Many VPNs only protect older IPv4 traffic. If your connection also has newer IPv6 and the VPN ignores it, your real IPv6 address can leak straight through the tunnel. Good VPNs either route IPv6 through the tunnel too or disable it while connected.
WebRTC leak
WebRTC is a browser feature for video calls that can reveal your real IP address to websites, even with a VPN on. It is a browser-level leak rather than a VPN fault, but it undermines your privacy all the same. You can block it with a browser setting or extension and confirm with a leak test.
DPI (Deep Packet Inspection)
DPI is a technique that networks and national firewalls use to look inside traffic and identify what it is - including whether it is a VPN - rather than just where it is going. It is the technology behind most modern VPN blocking. The counter to it is obfuscation: making VPN traffic look like something ordinary.
Access and extras
Geo-unblocking (streaming)
Geo-unblocking means using a VPN to reach content restricted to certain countries, such as a streaming library available elsewhere. Streaming services actively block known VPN IPs, so this becomes a cat-and-mouse game - which is why providers advertise how reliably they unblock specific platforms.
P2P / torrenting
P2P support means a provider allows peer-to-peer file sharing on its servers, often on specific "P2P-optimised" locations. For this use a kill switch and a real no-logs policy matter most, since your IP is otherwise visible to every peer in the swarm.
Simultaneous connections
This is how many devices you can use on one subscription at the same time - your phone, laptop, TV, a partner's devices. Numbers range from a handful to unlimited. When you self-host, the practical limit is simply your server's capacity, and you add devices by handing out more keys.
