Are VPNs Still Worth It? Rethinking the Question

Why this question is even being asked again

For most of the last decade, the pitch for a VPN was built on a fairly simple story: the internet is full of unencrypted traffic, public Wi-Fi is a hacker's playground, and a VPN is the seatbelt that fixes both problems in one subscription. That story sold a lot of VPN subscriptions, and parts of it were always true. But the internet a VPN operates on top of in 2026 is not the internet that story was written about. Browsers now ship connection security indicators by default, the overwhelming majority of web traffic is encrypted in transit whether or not a VPN is involved, and some browsers even bundle a basic VPN or proxy feature directly into the product. Coffee-shop Wi-Fi is not the free-for-all it once was. Against that backdrop, "are VPNs worth it" is a fair question to ask honestly, rather than a question a site selling VPN subscriptions should wave away.

This guide is an attempt to answer it honestly. It won't tell you a VPN is essential for everyone, because it isn't. It also won't tell you VPNs are obsolete, because for a specific, common set of concerns they still do something real that the rest of your security stack does not. The goal here is to help you work out which category you're in.

What changed: the case for "VPNs are less necessary now"

The strongest version of the skeptical argument rests on three real, verifiable shifts in how the web works.

HTTPS became the default, not the exception

A decade ago, a meaningful share of websites still served plain HTTP, meaning the actual content of a page — including anything you typed into a form — could be read or altered by anyone positioned between you and the site, including someone else on the same public Wi-Fi network. That was the scenario "don't use public Wi-Fi without a VPN" warnings were built around, and it was a legitimate warning at the time. Today, browsers actively flag non-HTTPS sites as "not secure," and the vast majority of everyday browsing — banking, email, shopping, social media — happens over encrypted connections by default, VPN or no VPN. That doesn't make a VPN redundant, but it does remove the single scariest justification for one: the idea that without a VPN, someone on your coffee-shop Wi-Fi can read your passwords in plain text as you type them. For HTTPS sites, they generally can't.

Browsers are absorbing some VPN-adjacent features

Several mainstream browsers now offer some form of built-in traffic proxying, tracker blocking, or "secure browsing" mode, either free or bundled with a paid tier. These aren't full VPNs in the traditional sense — most only proxy browser traffic rather than your whole device, and coverage and server choice are usually far more limited than a dedicated VPN app — but they chip away at the argument that a VPN is the only way to get any IP-masking benefit at all. For someone whose only use case is "hide my browser traffic from casual snooping while I'm on hotel Wi-Fi," a browser-level feature may now cover a meaningful slice of what a VPN used to be the only tool for.

Public Wi-Fi security has genuinely improved

Modern Wi-Fi security standards (like WPA3 on newer routers and access points) make some of the older local-network snooping attacks harder to pull off than they were when "VPN for public Wi-Fi" became a standard piece of advice. Combined with wider HTTPS adoption, the specific nightmare scenario of a stranger at the next table silently harvesting your login credentials over open Wi-Fi is less common than it used to be — not eliminated, but less common, and less severe when it does happen because the credentials themselves are usually encrypted in transit anyway.

Mobile operating systems added their own privacy layers

Phones account for the majority of everyday browsing time for a lot of people, and mobile operating systems have added their own privacy controls in the same window that VPN skepticism grew: app-level tracking permission prompts, private DNS options built into system settings, and more granular controls over which apps can see location or network state. None of this is a VPN, and none of it hides your IP address or your ISP's visibility into which domains you're reaching. But it does mean a phone in 2026 ships with more privacy tooling turned on by default than one did a decade ago, which is part of why the case for "you absolutely need a VPN or you have zero privacy" feels overstated to a lot of people now — some of the gap it used to fill has been partly closed from other directions.

Taken together, these shifts are the honest core of "VPNs are less necessary now," and none of them are made up. A review site that pretends the web of 2026 is exactly as dangerous as the web of 2015 isn't being straight with you.

What a VPN still does that nothing else replaces

None of the changes above eliminate what a VPN actually does at a technical level: it routes your traffic through the provider's server and encrypts the link between your device and that server, so anyone watching the network your device is directly connected to sees only that you're talking to a VPN server, not which sites you're visiting or what you're sending. HTTPS protects the content of your traffic from a network eavesdropper. A VPN additionally protects the destination and pattern of your traffic from your network operator specifically — a distinction that matters more than it might first sound.

Your ISP can still see where you go, even over HTTPS

HTTPS encrypts the content of a connection, but under most everyday setups your internet service provider can still see the domains you connect to and roughly how much data you send and receive, because that information is visible at the network level even when the page content itself is encrypted. In plenty of jurisdictions, ISPs are legally permitted — or in some cases required — to retain logs of this browsing metadata, and some sell aggregated or de-identified versions of it to advertisers. A VPN moves that visibility away from your ISP and onto the VPN provider instead, which is only a genuine improvement if you trust the VPN provider's no-logs claims more than you trust your ISP's — a real caveat, but not one that erases the underlying point: without a VPN, your ISP has a fairly complete picture of your browsing habits by domain, and with a reputable VPN it generally doesn't.

Network operators beyond your home ISP still matter too

The same logic applies to hotel, airport, university, and workplace networks — any network operator sitting between you and the internet can typically observe which domains you're reaching, even if it can't read the encrypted content of the page. On a corporate or school network, that visibility is often paired with active filtering or monitoring policies you may not fully control or agree with. A VPN routes around that specific network's visibility, which is a distinct benefit from "protecting your passwords," and one that HTTPS alone doesn't provide.

IP-based tracking and geolocation

Your IP address is used well beyond the "is this connection encrypted" question — it's a routine signal for approximate geolocation, for advertising and analytics networks building a profile of your device across sites, and for services that adjust pricing, content, or availability by region. HTTPS does nothing to hide your IP address from the site you're connecting to; it only protects the content of the exchange. A VPN masks your real IP from every site you visit, replacing it with the VPN server's IP, which is a benefit that browser security indicators and encrypted connections don't touch at all.

Regional access and consistency while traveling

Plenty of everyday services — from a bank's app to a work tool to a streaming subscription you already pay for at home — behave differently, or refuse to work at all, when they detect you're connecting from an unexpected country. This isn't a security use case in the traditional sense, but it's one of the most common practical reasons people actually reach for a VPN, and none of the "the web got more secure" arguments above change it, because it was never about encryption in the first place — it's about what your apparent location communicates to a server.

A meaningful floor against passive network-level attacks

Even with HTTPS and better Wi-Fi standards, unencrypted DNS lookups, weak or misconfigured public networks, and rogue or spoofed access points still exist in the wild. A VPN doesn't make you invulnerable to a sufficiently motivated, well-resourced attacker, but as a baseline layer against the more common, lower-effort forms of local network snooping and interception, it still adds a real margin of safety — it just isn't the dramatic, only-line-of-defense role it was once marketed as.

So who is a VPN actually worth it for, in 2026?

Instead of a blanket yes or no, it's more useful to sort this by the situations where the value is real and situations where it's marginal or absent. Here's a working breakdown.

People who frequently use networks they don't control

If you regularly work from cafes, co-working spaces, hotels, airports, or client offices, a VPN gives you a consistent layer of protection against whatever that specific network operator can see or is logging, regardless of how well- or poorly-secured that network happens to be. This is arguably the single strongest, least-debatable use case that has survived every change described above.

People who care about their ISP not building a browsing profile of them

If the idea of your home internet provider logging, retaining, or monetizing a record of every domain you connect to bothers you — regardless of whether the content of those connections is encrypted — a VPN is one of the few practical tools that actually addresses it, by moving that visibility to a provider whose business model is (for a reputable one) built around not doing the same thing.

People who travel and need consistent access to accounts and tools

Frequent travelers who've had a bank, a work VPN alternative, or another service balk at an unfamiliar country's IP address get a genuinely practical benefit from a VPN that has nothing to do with the encryption arguments above.

People in restrictive network or regulatory environments

Where local network policy, employer policy, or national-level restrictions limit access to services, a VPN can be part of how people route around those restrictions — though the legal and practical picture varies enormously by country, and it's worth reading location-specific guidance rather than assuming the answer is the same everywhere. See our guide on reading a VPN's no-logs claims critically before relying on one in a higher-stakes situation.

People whose main worry is "will someone steal my password on this Wi-Fi"

This is the group for whom a VPN has genuinely become less critical than it once was. If your entire threat model is password interception over public Wi-Fi and you're only ever visiting mainstream HTTPS sites, a VPN adds a smaller increment of protection than it did a decade ago, because the content of that traffic is already encrypted with or without it. That doesn't mean a VPN is useless to this group — the IP-masking and metadata benefits above still apply — but the single scariest justification for owning one no longer applies as sharply as it used to.

People expecting anonymity or immunity from all tracking

A VPN was never designed to make you anonymous, and it still doesn't. Sites you log into know who you are regardless of your IP address. Browser and device fingerprinting, cookies, and account-linked tracking all operate independently of whether you're using a VPN, and a VPN does nothing to stop them. If your goal is genuinely comprehensive anonymity, a VPN is one small piece of a much larger practice involving browser choice, tracker blocking, and account hygiene — not a single tool that solves it.

Does a VPN still matter if my browser already has one?

Browser-integrated VPN or proxy features are a genuinely useful addition for casual, low-stakes browsing, and for many people they cover a real slice of what a dedicated VPN used to be the only option for. But they typically come with meaningful limits worth knowing before you treat one as a full replacement: coverage is usually restricted to traffic inside that specific browser, not your whole device, so apps, background services, and other browsers on the same device aren't protected. Server location choice tends to be far more limited than a dedicated VPN's network. And the underlying privacy commitments and business model of a browser vendor are a different thing to evaluate than a VPN-specific provider's no-logs policy — "included with your browser" isn't automatically more or less trustworthy than "dedicated VPN app," it's just a different set of claims to check.

In practice, a lot of people end up using both: a browser-level feature as a convenient default for casual browsing, and a dedicated, device-wide VPN when they need broader coverage — every app on the device, not just the browser — or a wider choice of server locations, or protection on networks they specifically don't trust.

How does a VPN compare to Tor, private DNS, and tracker blockers?

Part of what makes "are VPNs worth it" hard to answer in one sentence is that a VPN is often mentally lumped in with a handful of other privacy tools that actually solve different problems. Knowing where the boundaries are helps clarify what a VPN is and isn't contributing.

VPN vs. Tor

Tor routes your traffic through multiple independently operated relays rather than a single provider's server, which is a meaningfully stronger anonymity model than a VPN's "trust one company" arrangement — no single relay operator in a Tor circuit can see both who you are and what you're visiting. The tradeoff is speed: Tor is typically much slower than a VPN because of the multi-hop routing, and a meaningful number of mainstream sites treat Tor exit-node traffic with extra suspicion, throwing up additional verification steps or blocking it outright. For most everyday browsing, people choose a VPN over Tor precisely because it trades some of that anonymity strength for speed and compatibility. For situations where anonymity genuinely matters more than convenience, Tor is the stronger tool, not a VPN — no reputable VPN review should claim otherwise.

VPN vs. private/encrypted DNS

DNS is the system that translates a domain name into an IP address, and it's a separate channel from the HTTPS connection itself — historically, DNS queries were often sent unencrypted even when the resulting connection was HTTPS, letting a network operator see which domains you looked up even without seeing page content. Encrypted DNS options (like DNS-over-HTTPS, now built into most modern browsers and operating systems) close that specific gap without needing a VPN at all. This is a real, useful improvement, but it's narrower than what a VPN does: encrypted DNS hides your lookups from a local eavesdropper, but your ISP or network operator can often still infer which sites you're visiting from the destination IP addresses of your traffic itself, something a VPN additionally obscures by routing that traffic through its own server.

VPN vs. tracker and ad blockers

Tracker blockers address a different layer entirely: they prevent tracking scripts and third-party cookies embedded in pages from following you across sites, regardless of your IP address. A VPN does nothing to stop this kind of tracking, because it operates independently of your network-level identity — a tracker script can build a profile of "this browser, with this fingerprint, visited these sites" whether or not a VPN is masking the underlying IP address. If cross-site tracking is your specific concern, a tracker blocker addresses it far more directly than a VPN does.

None of these tools fully substitute for each other. A VPN, encrypted DNS, and a tracker blocker each close a different gap, and using more than one together is common and reasonable — the mistake is expecting any single one of them, VPN included, to cover all three.

Common myths about VPNs worth retiring

A lot of the fatigue behind "are VPNs even worth it anymore" comes from years of overclaiming in VPN marketing itself. Retiring a few specific myths makes the honest remaining case easier to see clearly.

"A VPN makes you completely anonymous"

Covered above, but worth repeating as its own myth: a VPN changes what your network-level identity looks like to outside observers, not who you are once you're logged into a service, and not what a fingerprinting script can infer about your browser and device.

"Free VPNs are basically the same as paid ones"

Running and maintaining a global server network costs real money, and a free VPN has to fund that somehow — common models include selling aggregated usage data, serving ads, or offering a deliberately degraded free tier designed to push you toward a paid plan. None of that is automatically disqualifying, but "free" is not a synonym for "no cost to you" in the privacy tradeoff sense, and it's worth reading a free provider's actual policy with more scrutiny, not less, precisely because the usual incentive alignment — you pay them, they don't need another revenue stream from your data — isn't there.

"A VPN will make my connection faster"

Routing traffic through an additional server generally adds some overhead compared to a direct connection, all else equal. There are narrow scenarios where a VPN can incidentally help — for instance if your ISP is throttling certain types of traffic and a VPN connection isn't identifiable as that traffic type — but "VPNs make browsing faster" as a general claim isn't something this site will assert, because it isn't reliably true.

"A VPN protects me from malware and phishing"

A VPN encrypts and reroutes your connection; it doesn't inspect the content of downloads or scan links for malicious intent unless it specifically bundles a separate security feature that does that (some providers offer this as an add-on, distinct from the core VPN function). Treating a VPN subscription as your malware or phishing protection is a mismatch between the tool and the threat.

"If a provider says 'no-logs,' that settles it"

A policy statement is a claim, not a proof. See our dedicated guide on what a credible no-logs claim actually needs to include for how to read one critically instead of taking the word "no-logs" on a homepage at face value.

How can I tell if my VPN is actually doing anything?

Because a VPN's main effects are invisible during normal use, it's worth knowing how to actually confirm it's working rather than assuming a green "connected" icon means everything behind it is functioning correctly.

Check whether your visible IP address actually changes

The most basic check: look up what your public IP address is with the VPN off, then again with it connected. If the second address doesn't match the VPN server's expected location, or matches your real IP at all, something is misconfigured.

Check for DNS leaks

A DNS leak happens when your device sends DNS lookups outside the encrypted VPN tunnel, to your regular ISP-provided DNS resolver, even while the rest of your traffic is routed through the VPN — which can reveal which domains you're visiting to your ISP despite the VPN otherwise being active. Our separate guide on how DNS leaks happen and how to test for them walks through this in more detail than fits here.

Confirm the kill switch actually cuts traffic

A kill switch is meant to block all internet traffic if the VPN connection drops unexpectedly, so your device doesn't silently fall back to sending traffic unprotected. Not every app implements this reliably, and it's worth testing manually — disconnect the underlying network briefly while connected and confirm nothing leaks through — rather than assuming a settings toggle labeled "kill switch" is doing what it says.

Understand what a VPN can't confirm for you

These checks confirm the mechanics are working — your IP is masked, DNS isn't leaking, the kill switch engages. None of them confirm whether the provider is actually honoring its no-logs policy on its own servers, which is fundamentally a matter of trust and, where available, independent audit — not something you can verify yourself from your own device.

What a VPN genuinely cannot do (worth repeating clearly)

Part of answering "is it still worth it" honestly means being just as clear about the limits as the benefits. A VPN does not:

• Make you anonymous. The VPN provider itself can typically see your real IP and connection metadata, even if it says it doesn't retain that data — you're trusting a policy, not achieving true anonymity.
• Stop a site from recognizing you once you're logged in. If you sign into an account, that site knows who you are regardless of your IP address or which VPN server you're using.
• Defeat browser and device fingerprinting. Fingerprinting techniques rely on characteristics of your browser and device configuration, not your IP address, and a VPN doesn't change either.
• Replace basic account security. A VPN does nothing for a reused password, a phished login page, or an account without two-factor authentication enabled.
• Guarantee the provider itself is trustworthy. A "no-logs" claim is a policy statement, not a law of physics — see our separate guide on what a no-logs claim actually needs to demonstrate before taking one at face value.

None of this is an argument against using a VPN. It's an argument against expecting one to do more than it actually does — which is exactly the kind of overclaiming that makes the "are VPNs worth it" question worth asking in the first place.

A simple way to decide for yourself

Rather than taking anyone's general verdict, including this one, it's worth running your own situation through a short set of questions:

1. How often are you on networks you don't control or trust?

Frequent public Wi-Fi, hotel, or client-office use tips the value clearly toward "worth it." Almost exclusively home Wi-Fi on a network you manage tips it the other way, though the ISP-visibility argument below still applies.

2. Do you care whether your ISP logs which domains you visit?

If the answer is genuinely "no, I don't mind," a chunk of the case for a VPN weakens for you specifically. If the answer is "yes, that bothers me," a VPN is one of the few tools that directly addresses it.

3. Do you travel, or need consistent access to region-specific accounts?

If yes, this alone is often enough to justify a subscription regardless of how the encryption arguments shake out, because it's solving a different problem entirely.

4. What exactly are you expecting a VPN to protect you from?

If the honest answer is "someone reading my Netflix password over café Wi-Fi," the marginal benefit today is smaller than it used to be, because HTTPS already covers most of that specific risk. If the honest answer is "my ISP or network operator building a record of what I do online, or being blocked from things I'm entitled to use because of my location," the case is much stronger and largely unaffected by anything HTTPS does.

Answering these four questions for yourself gets you a far more useful verdict than any generic "yes, everyone needs a VPN" or "no, VPNs are obsolete" headline, because the honest answer genuinely depends on what you're doing online and who you don't want to see it.

Is a VPN worth it specifically for streaming, gaming, or torrenting?

These three come up constantly in "is a VPN worth it" searches because they're often the actual, specific reason someone starts looking in the first place, separate from the broader privacy discussion above.

Streaming

Streaming services generally license content on a region-by-region basis and use IP address as one of their signals for enforcing that licensing, which is why a catalog can look different depending on where you're connecting from. A VPN can change your apparent location, but streaming providers actively work to detect and block VPN traffic, and that detection changes constantly — meaning a server that works today isn't guaranteed to keep working, and this site won't claim any specific provider reliably unblocks any specific service, because that claim would be stale the moment it was published. Our guide on the ongoing streaming VPN detection arms race covers why this cat-and-mouse dynamic exists and why consistency, not any single test, is the honest way to judge it.

Gaming

For gaming, a VPN's main practical draws are routing around network-level restrictions or unwanted attention on your real IP address in situations like peer-to-peer connections. It is not a reliable tool for reducing latency — adding a routing hop through a VPN server more often adds latency than removes it, with rare exceptions where a VPN route happens to be more direct than your ISP's default path. Anyone recommending a VPN primarily as a way to lower ping should be treated with skepticism.

Torrenting

On torrent networks, your IP address is visible to other peers in the swarm by the protocol's basic design, which is different from ordinary web browsing where your IP is only visible to the site and network operators in the path. A VPN masks that IP from other peers as well. Whether torrenting a given piece of content is legal depends entirely on what it is and where you are, and a VPN changes none of that legal picture — it only changes who can see your IP address while you do it. Our separate guide on VPNs and torrenting goes into this distinction in more depth.

If you decide a VPN is worth it, what actually matters when picking one

Assuming the answer for your situation lands on "yes," the next question is what to actually look for, and it's a shorter list than most marketing pages suggest. A stated no-logs policy is the starting point, not the finish line — read what it actually claims to exclude, and treat an independent audit of that claim, when one exists and is verifiable, as a meaningfully stronger signal than the claim alone. Beyond that, platform support for the devices you actually use, server locations that cover where you actually need them, and straightforward apps you'll actually keep turned on matter more day to day than marketing superlatives. A VPN you find annoying enough to disable defeats its own purpose regardless of how strong its underlying technology is.

We maintain individual reviews for the providers on this site, including NordVPN, Proton VPN, PureVPN, and FastestVPN, each covering what the provider itself publicly states about its policies, platform support, and jurisdiction, so you can compare claims rather than take any single review's word for it.

The honest bottom line

The internet did get meaningfully safer by default over the last decade — that part of the skeptical case is true, and pretending otherwise to sell subscriptions would be dishonest. But "safer by default" is not the same as "private by default." HTTPS protects what you send; it does very little to hide where you're sending it from, or to stop the network you're connected to from building a record of your activity by domain. That gap is exactly where a VPN's remaining value lives, alongside the more mundane but very real benefit of consistent access while traveling. Whether that gap matters enough to you to pay for a subscription is a genuinely personal call, not a universal one — which is why the honest answer to "are VPNs still worth it" is "it depends on what you're trying to protect against," not a blanket yes or no.