How to Choose a VPN: Work Out Who You Are Hiding From First

Choosing a VPN gets much simpler once you answer the question most comparison pages skip: which particular party do you not want seeing your traffic or your address? A tunnel does not remove the point at which your traffic becomes visible to somebody — it relocates that point and hands the seat to an operator you picked. Name the party you are moving the view away from and most of the criteria people argue about stop applying, usually leaving three or four questions that actually decide the matter.

What follows is a sequence, not a shortlist. No service is named or ranked here, and the reason is stated plainly further down.

A tunnel changes the vantage point, it does not remove it

Before you connect, the view is split up. The network your device is attached to, and the provider carrying your line, can see which addresses you exchange packets with and, for most connections, the hostname you asked for. Whoever runs your resolver sees the names you looked up. Every service you reach sees the address your traffic arrives from.

Turn a tunnel on and none of those observers cease to exist — their views move and consolidate. The operator of the exit you connected through now holds, in one place, roughly the combined picture that used to be divided between your local network, your access provider and your resolver. The destination services, meanwhile, see an address belonging to that operator rather than one belonging to you.

The purchase is therefore not invisibility. It is a decision about which single organisation occupies that seat, and how much of the old view each previous occupant keeps. The address substitution on its own achieves less than most people assume, and keeping that clear at the start prevents most of the disappointment that follows.

Name the observer before comparing anything

Write down, in one line, who the tunnel is for. Four answers cover nearly everyone, and each one discards a different two-thirds of the usual comparison table.

The network you are physically attached to. A café, a shared flat, a venue, an employer’s guest network, a landlord’s router. This is the most common honest answer and the easiest to satisfy.

Your access provider. The company that sells you the line, plus anyone it is obliged or inclined to pass records to.

The services you connect to. You would rather a site recorded an address that is not associated with your household.

A well-resourced party specifically interested in you. Rare, and worth separating from the first three, because the honest answer changes completely.

What each answer eliminates

If the observer is the local network, the decision is mostly about the client software rather than the company behind it. Does the application carry everything, including name lookups, or does it leave some traffic with the network you are trying to avoid? What does it do in the seconds after the tunnel drops? Location counts, cipher branding and feature lists have nothing to do with this job, and you can settle it in an evening on your own machine.

If the observer is your access provider, you have swapped a problem you did not choose for one you did. The operator now sees what the provider used to. That collapses the whole decision into a question about a company: who it is on paper, where it is established, what it says it retains, and whether anything independent supports the claim. Technical specifications barely enter into it.

If the observer is the destination service, what matters is the properties of the exit address rather than the strength of the encryption. Whether that address is shared with many other customers or reserved for you changes how services treat you, and both arrangements have costs — see shared vs dedicated VPN IP addresses.

If the observer is a determined, well-funded party, a consumer subscription is the wrong instrument and no amount of comparing will make it the right one. What identifies people in that situation is normally their accounts, their devices and their habits, none of which a tunnel touches.

The order the remaining questions go in

With the observer named, work through these in sequence and stop as soon as something disqualifies a candidate.

1. Write down what must keep working. Banking, an employer’s systems, a game, a device that cannot run an app at all. This list removes candidates faster than any other single step.
2. Decide which failure you cannot accept. A tunnel that quietly releases traffic when it drops is a different risk from one that blocks everything until it recovers. Pick the behaviour you want before looking at who offers it.
3. Establish who the operator is. A registered company, a named place of establishment, a policy written as a list rather than as reassurance. If you cannot work out who would receive a legal demand, you have not identified the party you are trusting.
4. Check the mechanics you can check yourself. Name resolution, address-family handling and reconnection behaviour are all observable from your own device without anyone’s permission.
5. Test inside a period you can walk away from. Commit to a long term only after a short one has told you something.

Why this page hands you no name

A recommendation worth acting on would require us to have run these services for months across several networks, with the method published so you could argue with it. We have not done that work, so any ordered list here would be a repackaging of other people’s marketing with our name on top — which is exactly the material that cost this category its credibility. A ranking from a site that has tested nothing does worse than fail to help: it borrows authority it never earned, and it points every reader at the same answer regardless of which of the four observers they were worried about in the first place.

Criteria and sequence are what a site like this can offer honestly, and they keep working after any particular service has changed hands.

Where each branch continues

• If you are still unsure what you are buying, the word “best” is doing too much work: what “best VPN service” actually means separates the incompatible jobs hiding inside that query.
• If your observer is your access provider or the operator itself, the trust questions are laid out observer by observer in judging a VPN on privacy.
• If price is the binding constraint, what a cheap VPN is economising on explains which corners get cut and what that costs you.