What a VPN is actually for

Every VPN advert makes the same promise, and it is the one thing a VPN does not do. You do not become anonymous. You move who gets to watch you.

That is still worth buying. It is just worth buying for a smaller set of reasons than the marketing implies, and it helps to know which ones.

The trust boundary, moved

Without a VPN, the network you are attached to sees the shape of your traffic: which hosts you connect to, when, and how much. TLS hides the contents and increasingly hides the hostname too, but the destination IP is still there, and so is the timing. That network is the café, the hotel, the airport, the office, your ISP.

With a VPN, that network sees one encrypted tunnel to one endpoint, and nothing about where it goes after that. The watching does not stop. It moves to the VPN provider, who now occupies exactly the position your ISP used to.

So the honest question is never "should I use a VPN." It is "do I trust this provider more than I trust the network I am on right now?" On hotel wifi in a country you do not live in, the answer is usually yes. On your own home connection it depends entirely on what your ISP is required to log and hand over.

What it does not fix

This is where most of the money gets wasted.

• Anything you log into. A VPN does nothing about the fact that you signed into your account. The service knows who you are because you told it.
• Browser fingerprinting. Your fonts, canvas, screen size, and extension set identify the browser regardless of where the packets came from.
• Cookies and the ad graph. Same answer, different layer of the stack.
• Malware. A tunnel carries a payload as happily as anything else.
• "Military-grade encryption". This phrase means AES, which is also what your bank's website already uses without charging you monthly.

A VPN is a network-layer tool. Everything above is an application-layer problem, and the fix for those is a separate browser profile, fewer logins, and a content blocker.

When it is genuinely worth it

• Networks you do not control and cannot vouch for — conference, hotel, café, airport, a client's guest wifi.
• An ISP with logging obligations you are not comfortable with, or a habit of injecting into unencrypted traffic.
• Reaching a service that is geographically fenced, which is most people's real reason and there is nothing wrong with saying so.
• Work where the fact of the connection is the sensitive part, not the contents.

How to pick one

Ignore the server count. It is a vanity number. What actually matters:

1. Jurisdiction. Where the company is registered decides who can compel it to hand over what.
2. What they log, in specifics. "We do not log" is a slogan. Look for what is retained and for how long, and for someone independent having checked.
3. A working kill switch. If the tunnel drops and your traffic quietly continues in the clear, you have bought a false sense of safety, which is worse than none.
4. Whether you will actually leave it on. A VPN you disable because it makes everything slow protects you exactly zero percent of the time.

The short version

Buy it for untrusted networks. Do not buy it expecting to disappear. And be clear-eyed that you are choosing a company to watch your traffic instead of your ISP — which is a real decision, not a magic trick.