What Is a VPN? How It Actually Works, From PPTP to WireGuard

A VPN is often described as software that “makes you anonymous online.” That’s not quite what it does, and the gap between the marketing description and the actual mechanism matters — because the actual mechanism only solves part of the privacy problem, and knowing which part is the difference between picking a VPN that protects what you think it protects and one that doesn’t.

The Mechanism

A VPN creates an encrypted tunnel between your device and a server operated by the VPN provider. Instead of your internet traffic going directly to each website or service you connect to, it first travels through this encrypted tunnel to the VPN server, which then forwards it onward. Two things happen as a result: your internet provider (and anyone else watching your local network) can see that you’re connected to a VPN server, but not what you’re doing inside that encrypted tunnel — and the websites and services you visit see the VPN server’s IP address, not your own.

That’s the entire mechanism. It’s a genuinely useful one — it hides your browsing from your local network operator, masks your IP address from the sites you visit, and protects your traffic on untrusted networks like public Wi-Fi. What it does not do is make you anonymous in any absolute sense: the VPN provider itself sits in the middle of that tunnel and can, in principle, see what you’re doing unless it has a real policy and technical architecture that prevents it from keeping a record. That single fact — what the provider does with what it can technically see — is the entire subject of the “no-logs” claims covered throughout this site, and it’s a separate question from which encryption protocol is in use.

Where It Came From

The VPN didn’t start as a privacy tool. It started as a way for companies to avoid paying for long-distance leased phone lines.

1996: a Microsoft-led consortium invents PPTP. In March 1996, Microsoft, Ascend Communications, 3Com, Copper Mountain Networks, ECI Telematics, and U.S. Robotics formed the “PPTP Forum” and submitted a draft to the IETF that June. The goal was narrow and corporate: let an employee dial into the internet through any local ISP, then tunnel through to the company network, instead of dialing a long-distance number directly into a corporate modem bank or paying for a dedicated leased line. The formal specification, RFC 2637, wasn’t published until July 1999 — three years after the initial announcement.

1998: PPTP gets broken, publicly, by name. Cryptographer Bruce Schneier and researcher Mudge published “Cryptanalysis of Microsoft’s Point-to-Point Tunneling Protocol (PPTP)” at the ACM Conference on Communications and Computer Security in November 1998, documenting real breaks in PPTP’s MS-CHAP authentication and RC4-based encryption. Microsoft patched some of the issues with MS-CHAPv2 — Schneier and Mudge broke that too, in a follow-up paper the next year.

1999: IPsec arrives as a general-purpose alternative. The IETF published RFC 2401, the core IPsec architecture, in November 1998, authored by Stephen Kent and Randall Atkinson. IPsec wasn’t built explicitly as PPTP’s replacement — it developed in parallel as a broader IP-layer security standard — but it became the default “more serious” tunneling option through the 2000s, usually paired with L2TP.

2001: a solo developer builds OpenVPN out of necessity. James Yonan released the first version of OpenVPN in May 2001, built on the OpenSSL library. By most accounts, he wrote it while traveling through Central Asia and needing a secure way to reach his work network over internet connections he didn’t trust — a solo, open-source alternative to the proprietary corporate protocols that had defined the category so far. OpenVPN became the de facto standard for over a decade, valued for being auditable — anyone could read the source code — rather than needing to trust a vendor’s word.

2012: PPTP dies for real. At DEF CON 20, security researchers Moxie Marlinspike and David Hulton released a tool called ChapCrack, demonstrating a 100% success rate at breaking MS-CHAPv2 by reducing its security to a single DES key. Microsoft’s own security advisory, published that August, confirmed it directly: “the security of MS-CHAPv2 can be reduced to the strength of a single DES encryption,” and recommended migrating to L2TP/IPsec, IKEv2, or SSTP. Sixteen years after its creation, PPTP’s own inventor was telling people to stop using it.

2015-2020: WireGuard rebuilds the whole idea from scratch. Developer Jason A. Donenfeld began work on WireGuard around 2015, presenting the design at the Network and Distributed System Security Symposium in early 2017. His whitepaper’s central argument wasn’t just about speed — it was about complexity as a security liability. He quoted an earlier, blunt assessment of IPsec from cryptographers Niels Ferguson and Bruce Schneier: “IPsec was great disappointment to us… Our main criticism of IPsec is its complexity.” WireGuard’s own paper states it “can be simply implemented for Linux in less than 4,000 lines of code, making it easily audited and verified” — a small enough codebase that it can plausibly be read end to end, unlike the sprawling implementations that came before it. The paper’s own benchmark table backed up the speed claim too: 1,011 Mbps for WireGuard against 258 Mbps for OpenVPN and 825-881 Mbps for IPsec, tested on the same hardware. Linux kernel maintainers agreed with the assessment: WireGuard merged directly into the mainline Linux kernel in version 5.6, released March 2020 — an unusually fast path from a solo researcher’s design to a component of the world’s most widely deployed operating system kernel.

Why Consumer VPNs Exist at All

For most of this history, VPNs were something IT departments set up for employees — not something an individual signed up for and paid $5 a month to use. That shifted gradually through the late 2000s and early 2010s as companies like NordVPN (founded 2012) and others began marketing the same tunneling technology directly to individual consumers, reframing it around personal privacy and public Wi-Fi security rather than corporate remote access.

One event accelerated that shift more than any other: Edward Snowden’s 2013 disclosures about NSA surveillance programs. Then-Director of National Intelligence James Clapper said in April 2016 that the Snowden leaks had sped up commercial adoption of encryption technology by roughly seven years, based on an internal NSA estimate — a claim from a government official citing non-public methodology, not an independently verifiable figure, but a notable one regardless. Consumer VPN adoption tracked the same curve: a corporate remote-access tool from the 1990s became something ordinary people bought specifically because they no longer trusted that their internet activity was private by default.

Why “It’s Encrypted” Isn’t the Whole Story

Here’s the part most basic VPN explainers skip, and it’s the part that actually matters once you’re choosing a provider: the protocol only secures the tunnel between your device and the VPN server. It says nothing about what the VPN server operator does with your traffic once it arrives there, who’s legally allowed to demand that data, or whether anyone’s ever independently checked.

Every VPN reviewed on this site uses a modern protocol — WireGuard, OpenVPN, or both — so protocol choice mostly isn’t what separates them anymore. What actually varies, based on this site’s own research across 14 providers, is everything downstream of the encrypted tunnel:

Whether anyone verified the no-logs claim, and how. A VPN can encrypt your traffic perfectly and still keep a record of which server you connected to and when — that’s a policy decision, not a protocol limitation. ProtonVPN has five consecutive years of fully public third-party audits confirming its no-logs policy; other providers reviewed on this site have gone years without any independent audit at all, relying purely on a marketing claim.

Jurisdiction — who can legally compel disclosure. Mullvad is incorporated in Sweden; PIA in the United States, a founding Five Eyes intelligence-sharing member. The encryption tunnel looks identical from the outside — what differs is which government can serve a legal order to the company operating it, and what, if anything, that company would actually have to hand over.

Whether the no-logs claim has ever been tested by someone hostile to it. A commissioned audit is a company paying a firm to check its own work. Several providers on this site have gone further — PIA’s no-logs claim held up under two real US court subpoenas, and Mullvad’s did the same when Swedish police searched its office in 2023 looking for customer data that turned out not to exist.

None of that shows up in a sentence like “uses AES-256 encryption” — nearly every VPN on the market can say that truthfully, including some that have gone on to fail real-world privacy tests. The protocol is table stakes. What actually separates a trustworthy VPN from a marketing claim is everything this article’s history section spent 30 years building toward and everything downstream of it that a protocol alone can’t guarantee.