Does a VPN protect you from hackers? What it covers

A VPN protects you from one kind of hacker: someone on the same network as you, like a stranger on café Wi-Fi or whoever runs the router, who wants to watch or tamper with your traffic. It does not protect you from phishing, malware, weak or reused passwords, or a company you use getting breached, which is how most accounts actually get taken over.

So a VPN is a lock on the road between you and the internet. Most break-ins come through the front door instead.

What a VPN actually does

NIST's glossary describes a VPN as a virtual network built on top of existing networks that can provide "a secure communications mechanism" for data passing between them. In plain words, your device opens an encrypted tunnel to the VPN server, and everything goes through that tunnel before it reaches the open internet.

The EFF's guide to choosing a VPN spells out the two results. Your traffic appears to come from the VPN, which masks your IP address. And it hides your outgoing traffic from your internet provider and from "the local network owner (like a coffee shop or hotel)".

Everything a VPN can do against hackers follows from those two facts. If an attack depends on reading your traffic on the local network or knowing your real IP address, a VPN gets in the way. If it does not, the VPN does nothing.

Attacks a VPN helps with

Snooping on shared Wi-Fi. On a network you do not control, other people on it, or the person running it, may be able to see which sites you connect to. With a VPN, they see an encrypted connection to one server and nothing else.

A fake or tampered hotspot. If a network turns out to be run by someone hostile, the VPN keeps your traffic sealed until it reaches the VPN server. The EFF suggests a VPN for exactly this case: a public network you do not trust, where you are not sure who runs the Wi-Fi.

Your IP address being used against you. Sites, game servers and people you talk to see the VPN's address instead of yours. For the full picture of who sees your address, see our post on whether a VPN hides your IP address.

Your internet provider seeing every site you visit. That is privacy rather than hacking, but it is the same mechanism.

One honest caveat from the EFF: the old advice to always use a VPN on public Wi-Fi "isn't as necessary for everyone anymore because the majority of web traffic is now encrypted using HTTPS." HTTPS already protects the contents of what you send. What it leaves visible is metadata, such as the domain names you visit, and a VPN hides that from the local network. Our post on hotel Wi-Fi goes deeper into what is actually risky on a shared network today.

Attacks a VPN does not stop

The EFF puts it bluntly: VPN ads "assert that a VPN is the only tool you need to stop cyber criminals, malware, government surveillance, and online tracking," and "these advertisements vastly oversell the benefits of VPNs."

Here is why, attack by attack.

Attack	Does a VPN change it?	What does
Someone watching traffic on shared Wi-Fi	Yes, they see only an encrypted tunnel	VPN, plus HTTPS
Phishing email, text or fake login page	No	Spotting the signs, MFA
Malware you download or open	No	Updates, care with attachments
Guessed or reused password	No	Long unique passwords, MFA
A company you use gets breached	No	Unique passwords, changing the leaked one

Phishing

CISA describes phishing as criminals trying "to get us to open harmful links, emails or attachments that could request our personal information or infect our devices." A phishing email arrives in your inbox the same way with or without a VPN. If you type your password into a fake login page, the VPN carries it there, encrypted, just as it would to the real site.

NIST's digital identity guidelines, SP 800-63B, say it in four words: "Passwords are not phishing-resistant." The defense is recognizing the message. CISA's signs include urgent or emotional language, requests for personal or financial information, untrusted shortened links and slightly wrong addresses. It also warns that with AI, some phishing now has perfect grammar and spelling. Our guide on how to spot a phishing email walks through the checks, and if you already clicked, see what to do if you clicked a phishing link.

Malware and viruses

A VPN does not scan files or decide what runs on your device. If you open an infected attachment or install a bad app, the VPN just delivers it. The EFF even warns that a VPN app itself may "distribute malware", so a free app from an unknown company can make things worse. Our post on whether free VPNs are safe covers that risk.

CISA's main advice on this front is to update software: many updates are created to fix security risks, so install them as soon as possible, turn on automatic updates, and pay special attention to web browsers and antivirus software.

Weak and reused passwords

If someone guesses your password or uses one leaked elsewhere, they log in as you. From the service's point of view, that is a normal sign-in, and your VPN is not involved at all.

CISA's strong passwords page asks for passwords that are long (at least 16 characters), random and unique, kept in a password manager. NIST's guidelines go further for services: a password that is the only factor must be at least 15 characters. Our guide on creating a strong password has the practical version.

Data breaches

When a company you use is breached, your data leaks from its servers, not from your connection. A VPN on your device cannot reach that. CISA's own example is a woman whose bank was emptied because her password "was a part of a company breach that was posted online" and she had used it on her email too.

NIST tells services to check new passwords against a blocklist that includes "passwords obtained from previous breach corpuses", and to force a change when there is evidence a password has been compromised. You can do the same check for yourself: see has my email been in a data breach.

What actually keeps hackers out

The EFF's list of steps that matter more than a VPN for most people: strong passwords, two-factor authentication, HTTPS-only mode in your browser, device encryption, software updates, encrypted DNS and tracker blocking. Pulled together with CISA's advice, the order looks like this:

Turn on multifactor authentication, starting with email, banking and social media. CISA's MFA page says that even if someone steals your password, "they won't be able to meet the second step requirement".
Use a password manager and give every account a long, unique password.
Turn on automatic updates for your operating system, browser and apps.
Slow down on links and attachments. If a message might be real, contact the company through its own website rather than the link.
Use a VPN on networks you do not trust, and if you want your browsing hidden from your internet provider.

A VPN is a useful layer. It is just not the first one.

Gotchas

The VPN company sees what the Wi-Fi owner used to see. The EFF notes that a VPN can protect metadata from someone on a local network, "but the VPN provider itself would see it all." Pick a provider whose logging policy you can live with.
An outdated VPN is a weak spot too. CISA reports that the Volt Typhoon group has been exploiting vulnerabilities in public-facing devices "including, routers, VPNs, and firewalls." Keep the VPN app updated like any other software.
A VPN that is off protects nothing. Check that it is actually connected; our post on how to tell if your VPN is working shows how.

Frequently asked questions

Does a VPN protect you from hackers on public Wi-Fi?

It protects you from people on that network watching or tampering with your traffic, which is the main public Wi-Fi risk. It does not stop a fake login page or a malicious download you open while connected.

Does a VPN protect you from viruses and malware?

No. A VPN encrypts your connection, it does not inspect files or apps. Software updates and care with attachments and downloads are what CISA recommends.

Can you still get hacked with a VPN?

Yes. Phishing, reused passwords, malware and breaches at companies you use all work the same with a VPN on. A VPN only covers the network path between your device and the VPN server.

Does a VPN stop someone from hacking my phone?

Only attacks that come through a hostile network. Most phone account takeovers start with a phished password or a bad app, which a VPN does not touch. Updates and MFA matter more.

Is a VPN worth it for security?

It is worth it if you often use networks you do not control, or you want your browsing hidden from your internet provider. Turn on MFA and get your passwords in order first.

A VPN for the network part

If the network part is what you need, Secria VPN is post-quantum on every connection and runs on RAM-only servers. No activity logs: we do not record browsing, DNS queries or traffic contents. It costs $7.99 a month on its own, or comes with Secria Mail in Secria Pro at $9.99 a month, with the VPN on 5 devices. See pricing.