VPN Encyclopedia
VPN terms, explained simply
No protocol manual and no marketing language. Open any term to see what it means, why it matters, and what providers often leave unexplained.
36 terms
+VPN tunnelStart hereThe encrypted connection between your device and a VPN server.
Why it matters
It stops the network carrying your traffic, such as your internet provider or public Wi-Fi, from directly reading what travels inside that connection.
How to understand it
Your VPN app encrypts traffic before sending it to a VPN server. The server then forwards it to the destination, which normally sees the server’s public IP address instead of yours. Protection between the VPN server and the destination still depends on technologies such as HTTPS.
What to watch for
A tunnel does not hide cookies, account logins, browser fingerprinting, or information you provide yourself.
+VPN serverStart hereThe remote system your VPN app connects to before reaching the wider internet.
Why it matters
Its location, capacity, ownership, and network quality can affect speed, latency, reliability, and which public IP address websites see.
How to understand it
The server receives encrypted traffic from your device, removes the VPN layer, and forwards the traffic to its destination. Responses return through the same path. A provider may operate physical servers, virtual servers, rented infrastructure, colocated hardware, or a mixture of these models.
What to watch for
A large server count does not automatically mean better performance. Capacity, routing, congestion, and how the fleet is managed matter more than the headline number alone.
+VPN protocolStart hereThe set of rules used to create, secure, and maintain a VPN connection.
Why it matters
The protocol can influence connection speed, stability, battery use, resistance to blocking, and how quickly a VPN reconnects after a network change.
How to understand it
WireGuard, OpenVPN, and IKEv2/IPsec are common examples. Some providers also build proprietary protocols. A protocol name alone does not prove that a service is secure: the app, configuration, key handling, and surrounding infrastructure also matter.
What to watch for
Claims such as “best protocol” are incomplete without a platform and use case. A protocol that reconnects well on mobile may not offer the same configurability as another option on desktop.
+EncryptionStart hereA process that turns readable data into a form that cannot be understood without the correct key.
Why it matters
Inside a VPN tunnel, encryption prevents the local network and internet provider from directly reading the traffic carried between your device and the VPN server.
How to understand it
Encryption is only one part of VPN security. Authentication, key exchange, protocol design, software implementation, and secure server operation are also required. Modern VPN services commonly use established cryptographic algorithms rather than inventing their own.
What to watch for
“Military-grade encryption” is marketing language, not a complete technical explanation. Look for the actual protocol, implementation, and independent security review where available.
+Public IP addressStart hereThe internet-facing address used to send traffic to and from your connection.
Why it matters
Websites can use it to identify the network you are connecting from and estimate a broad geographic location. A VPN normally replaces your usual public IP with the VPN server’s IP.
How to understand it
An IP address is not the same as a precise home address or a person’s identity, but it can become identifying when combined with account activity, cookies, timestamps, or provider records. Many VPN users share the same server IP.
What to watch for
Changing your IP does not remove browser cookies, fingerprinting, signed-in accounts, or other identifiers.
+Kill switchLeaks & connection safetyA safeguard that blocks internet traffic if the protected VPN connection unexpectedly stops.
Why it matters
Without it, your device may silently return to its normal connection and expose your public IP while the VPN reconnects.
How to understand it
A standard kill switch usually reacts to an unexpected tunnel failure. A stricter always-on or lockdown mode can block internet access whenever the VPN is not connected, including after a restart or deliberate disconnect. Exact behaviour varies by app and operating system.
What to watch for
Check whether it is enabled by default, which platforms support it, and how it interacts with split tunneling and local-network access.
+Always-on VPNLeaks & connection safetyA mode designed to keep the VPN active or block connections that do not use it.
Why it matters
It reduces the chance of traffic leaving through the normal connection before the VPN starts, after a restart, or between reconnection attempts.
How to understand it
The operating system or VPN app can automatically start the tunnel and prevent non-VPN traffic. Providers may call stricter versions Permanent Kill Switch, Advanced Kill Switch, Lockdown Mode, or similar names.
What to watch for
Always-on behaviour is platform-specific. It can interfere with captive portals, local devices, excluded apps, or another service that also uses the operating system’s VPN interface.
+DNS leakLeaks & connection safetyA DNS request leaves outside the intended VPN path and reaches another DNS resolver.
Why it matters
DNS translates domain names into network addresses. If those requests bypass the VPN, another network operator may see which domains your device is trying to reach even when the rest of the connection uses the tunnel.
How to understand it
A VPN can route DNS requests through its own or a selected resolver inside the tunnel. Leaks may result from operating-system behaviour, browser settings, custom DNS configuration, split tunneling, or an incomplete VPN implementation.
What to watch for
A provider saying it offers private DNS is not the same as demonstrating that every supported platform prevents DNS requests from escaping.
+IP and IPv6 leakLeaks & connection safetyTraffic exposes an address belonging to your normal connection instead of only the VPN server’s address.
Why it matters
This can reveal the network you are using and defeat the main purpose of hiding your usual public IP.
How to understand it
IPv4 and IPv6 are different versions of the Internet Protocol. A VPN that handles IPv4 correctly but ignores an available IPv6 connection can leave part of the traffic outside the tunnel. Some apps tunnel IPv6, while others block it to prevent leakage.
What to watch for
“Leak protection” should specify which traffic and platforms are covered. DNS, IPv4, IPv6, and browser-originated leaks are related but not identical tests.
+Split tunnelingLeaks & connection safetyA feature that sends selected traffic through the VPN while allowing other traffic to use the normal connection.
Why it matters
It can keep local services, banking apps, video calls, or location-sensitive websites working without disconnecting the VPN completely.
How to understand it
Implementations differ. Some let you include or exclude applications, websites, IP addresses, or network ranges. Support can vary between Windows, macOS, Linux, Android, iOS, routers, and browser extensions.
What to watch for
Traffic intentionally excluded from the tunnel uses your normal connection. Check how exclusions interact with the kill switch, DNS handling, and local-network access.
+WireGuardProtocols & routingA modern VPN protocol designed around a relatively small codebase and current cryptographic primitives.
Why it matters
It is commonly chosen for fast connection setup, good performance, and efficient operation across desktop and mobile devices.
How to understand it
Providers can use standard WireGuard, modify how addresses and keys are assigned, or build a branded protocol around it. The presence of WireGuard does not make every provider’s implementation identical.
What to watch for
Check whether WireGuard is built into the provider’s native apps or only available through manual configuration, and whether all supported platforms receive it.
+OpenVPNProtocols & routingA mature open-source VPN protocol used across many operating systems and network configurations.
Why it matters
Its broad compatibility and configurable transport options can make it useful on older devices, routers, and networks where another protocol is blocked or unsupported.
How to understand it
OpenVPN commonly operates over UDP for performance or TCP when compatibility matters more. Security depends on configuration as well as the protocol itself, so the name alone does not describe the cipher choices or server setup.
What to watch for
TCP can help a connection pass through some restrictive networks, but running tunneled TCP traffic inside TCP can also create performance problems.
+IKEv2/IPsecProtocols & routingA widely supported combination used to create and secure VPN connections.
Why it matters
It can reconnect quickly when a device moves between Wi-Fi and mobile data, which makes it useful on phones and other frequently changing networks.
How to understand it
IKEv2 handles negotiation and authentication, while IPsec protects the traffic. Support is built into many operating systems, allowing either native-app use or manual VPN profiles.
What to watch for
Built-in operating-system support does not guarantee that every provider offers the same features, privacy controls, or kill-switch behaviour through manual profiles.
+VPN obfuscationProtocols & routingA technique intended to make VPN traffic less obvious to systems trying to identify or block it.
Why it matters
It may help on restrictive networks that permit ordinary web traffic but interfere with recognisable VPN connections.
How to understand it
Obfuscation can wrap, disguise, or change the visible pattern of VPN traffic. Different implementations resist different kinds of detection, and some work only with a particular protocol or server group.
What to watch for
“Stealth,” “camouflage,” and “obfuscated servers” are product labels, not a shared technical standard. Availability does not guarantee operation against every censorship system.
+Multi-hop VPNProtocols & routingA route that passes VPN traffic through more than one server before it reaches the destination.
Why it matters
It separates the server that receives your original connection from the server whose public IP is shown to the destination.
How to understand it
Some providers offer fixed server pairs, while others allow entry and exit locations to be selected. Multi-hop changes the trust and routing model but does not remove the need to trust the provider operating the route.
What to watch for
The additional server normally increases distance, latency, and processing. A proxy hop added after a VPN is not necessarily the same architecture as two complete VPN tunnels.
+Port forwardingProtocols & routingA way to allow selected incoming connections to reach a device or application through the VPN server.
Why it matters
It can improve connectivity for self-hosted services and some peer-to-peer applications when unsolicited incoming traffic would otherwise be blocked.
How to understand it
A provider may assign a fixed port, a temporary port, or no incoming port at all. Support can depend on the selected server, protocol, app, plan, or whether a dedicated IP is used.
What to watch for
Opening an incoming path increases exposure. The application listening on that port still needs secure configuration and updates.
+No-logs policyPrivacy & trustA provider’s statement about which user and connection data it does not retain.
Why it matters
A VPN server can technically observe information that passes through it. Retention rules determine what remains available after a session ends.
How to understand it
“No logs” rarely means that no data of any kind exists. Account information, payment records, aggregate diagnostics, abuse controls, and short-lived operational data may be treated separately from browsing activity or source IP logs.
What to watch for
Read the definitions and exceptions. A short marketing claim is weaker evidence than a detailed policy, a relevant independent audit, or a documented real-world legal test.
+No-logs auditPrivacy & trustAn independent review of whether a VPN’s systems and practices match its logging claims within a defined scope.
Why it matters
It provides evidence beyond the provider’s own privacy policy, but only for the systems, period, and questions actually examined.
How to understand it
A useful report identifies the auditing firm, date, tested environment, limitations, and conclusion. An app-security audit, penetration test, or financial audit does not become a no-logs audit simply because it involves the same company.
What to watch for
An audit is a snapshot, not permanent proof. Check whether the report or a meaningful public summary is available and whether the provider has changed ownership or infrastructure since the review.
+VPN jurisdictionPrivacy & trustThe legal environment governing the VPN company, contract, or part of its operation.
Why it matters
Local law can affect disclosure orders, retention obligations, corporate reporting, and how authorities request information.
How to understand it
A service can involve several relevant locations: incorporation, headquarters, contract law, parent company, payment processor, employees, and servers. Naming one country does not explain the whole legal structure.
What to watch for
Being outside a named intelligence-sharing alliance does not by itself prove privacy. Logging practices, available data, ownership, and response to valid legal orders still matter.
+Open-source VPN appsPrivacy & trustVPN client software whose source code is publicly available under an open-source licence.
Why it matters
Researchers and users can inspect how the published client is designed and identify implementation problems that would be harder to examine in closed software.
How to understand it
Open sourcing an app does not automatically verify the provider’s servers, production build, account systems, or logging practices. Independent audits and reproducible builds can provide additional evidence.
What to watch for
Check which apps and components are actually public, whether the repositories are maintained, and whether security reports cover the current code.
+Transparency reportPrivacy & trustA provider’s published record of legal requests, government demands, or other actions affecting user data.
Why it matters
It shows what kinds of requests the company receives and, when enough detail is provided, what information it was able or required to disclose.
How to understand it
Reports may list request categories, countries, outcomes, data produced, or the number of affected accounts. Formats and reporting periods vary, so totals from different providers are not automatically comparable.
What to watch for
A page that only says “we received requests but had nothing to provide” is less informative than dated, regularly updated figures with defined categories.
+Warrant canaryPrivacy & trustA regularly renewed statement that certain secret legal demands have not been received.
Why it matters
The idea is that removing or failing to update the statement may signal a change when the provider is legally prevented from announcing a request directly.
How to understand it
The usefulness and legal effect of a canary depend on jurisdiction and circumstances. It does not reveal ordinary requests, prove a no-logs system, or replace a detailed transparency report.
What to watch for
Check whether the statement is dated, signed, archived, and updated on a clear schedule. A permanently undated badge provides little signal.
+Anonymous or private paymentPrivacy & trustA payment method designed to reduce the personal information attached to a VPN purchase.
Why it matters
It can separate the VPN account from a conventional card or bank record, depending on the method and the information required during signup.
How to understand it
Cash can reduce digital payment records. Cryptocurrency is not automatically anonymous because public ledgers, exchanges, email addresses, and account activity may still connect a payment to a person.
What to watch for
Payment privacy does not make VPN traffic anonymous by itself. Check whether an email, name, billing address, or existing account is still required.
+Incident disclosurePrivacy & trustA provider’s public explanation of a security, privacy, or service incident.
Why it matters
A useful disclosure shows how quickly the provider detected the problem, limited damage, informed users, and changed its systems afterward.
How to understand it
Good incident communication normally includes a timeline, affected systems, known impact, remediation, and follow-up. Publishing an external postmortem can be more informative than simply stating that the issue was resolved.
What to watch for
The absence of a public incident history does not prove that no incident occurred. It may also reflect limited disclosure practices.
+Server fleetServers & infrastructureThe collection of VPN servers and locations made available by a provider.
Why it matters
Fleet design affects available locations, capacity, routing choices, congestion, resilience, and how far traffic travels before reaching a VPN server.
How to understand it
A fleet may combine owned, colocated, rented, physical, virtual, and specialised servers. Country count and server count describe coverage, but not necessarily capacity or operational control.
What to watch for
Server numbers change frequently and are counted differently. Treat an unexplained headline total as a snapshot rather than a permanent measure of quality.
+Physical vs virtual serverServers & infrastructureA physical server is hardware in a location; a virtual server is a software-defined server running on shared or dedicated hardware.
Why it matters
The distinction affects deployment flexibility and can affect where the underlying hardware and traffic processing actually reside.
How to understand it
A virtual VPN location may present an IP associated with one country while the physical hardware operates from another. Virtualisation itself is not automatically insecure; configuration, isolation, host control, and honest location disclosure matter.
What to watch for
“Servers in a country” can refer to the IP location rather than the physical machine. Look for a published virtual-location policy or server list.
+Colocated vs rented serverServers & infrastructureColocation usually means provider-controlled hardware placed in a third-party data centre; rented infrastructure belongs to another operator.
Why it matters
The model changes who selects, owns, and maintains the physical server, although the data centre and upstream network still remain part of the operational chain.
How to understand it
Providers can harden rented servers and can mismanage owned hardware, so ownership alone does not establish security. Documented deployment, access controls, encryption, monitoring, and independent review matter more.
What to watch for
Marketing sometimes uses “owned network” to describe only part of a mixed fleet. Check whether the claim covers hardware, network links, data centres, or merely server management.
+RAM-only serverServers & infrastructureA server designed to run without storing its active operating state on a conventional persistent system disk.
Why it matters
Restarting the server clears volatile memory, which can reduce the amount of operational data left on the machine after shutdown or seizure.
How to understand it
Implementations vary. Some boot from a trusted remote image or read-only medium, while others use encrypted disks alongside memory-based operation. The architecture must be described and verified before “RAM-only” can be treated as more than a label.
What to watch for
RAM-only operation does not prevent logging to another system and does not prove a no-logs policy. Network, management, and account systems must be considered separately.
+Streaming-optimized serverServers & infrastructureA server or location a provider designates for use with particular streaming platforms or regions.
Why it matters
The provider may monitor whether those IP addresses currently reach named services and direct users toward locations with better results.
How to understand it
The label can describe active maintenance, a separate server pool, a location recommendation, or only a marketing category. Streaming access changes when platforms block IP ranges or alter regional checks.
What to watch for
No provider can permanently guarantee access to every streaming service. Look for named platforms, regional instructions, current support information, and a clear response when an IP is blocked.
+Native VPN appApps & plansAn application the VPN provider supplies for a specific operating system or device platform.
Why it matters
A native app normally handles server selection, protocol setup, updates, reconnection, leak protection, and account access without manual configuration.
How to understand it
Feature coverage can differ between Windows, macOS, Linux, Android, iOS, TVs, and other devices even when the provider lists all of them as supported.
What to watch for
A setup guide for a third-party client is not the same as a maintained native app. Check which features are present on each platform rather than assuming parity.
+VPN browser extensionApps & plansA browser add-on that controls or provides a protected connection for browser activity.
Why it matters
It can offer quick location switching, website exclusions, or protection without opening the full desktop app.
How to understand it
Some extensions act as proxies for browser traffic only. Others remotely control the provider’s full-device VPN app. These two designs protect different traffic and require different permissions.
What to watch for
Check whether only browser tabs are covered, whether DNS and WebRTC are handled, and whether a paid desktop account or installed app is required.
+VPN router supportApps & plansThe ability to run a VPN connection on a router rather than configuring every connected device separately.
Why it matters
It can cover TVs, consoles, smart devices, and other hardware that cannot run the provider’s VPN app.
How to understand it
Support may mean manual OpenVPN or WireGuard configuration, compatible third-party firmware, a dedicated router app, or a preconfigured router. Features and switching convenience vary greatly between these approaches.
What to watch for
All devices may share one VPN location, and the router can become a performance bottleneck. Kill switch, split tunneling, and local-network behaviour also depend on the router setup.
+Simultaneous connectionsApps & plansThe number of devices or active VPN sessions one account may use at the same time.
Why it matters
The limit matters for households, teams, and people using a phone, computer, tablet, and television together.
How to understand it
Providers count connections differently. A router may count as one connection while covering several devices, and browser extensions may or may not count separately from native apps.
What to watch for
“Unlimited devices” does not guarantee unlimited speed or server capacity. Account-sharing and household-use rules can still apply.
+Free VPN tierApps & plansAn ongoing version of a VPN service that can be used without paying for a subscription.
Why it matters
It allows testing and basic use, but may limit locations, speed, data, devices, protocols, streaming access, or advanced features.
How to understand it
A permanent free tier is different from a time-limited trial or a paid plan covered by a refund policy. Sustainable free services still need a funding model, such as paid subscribers supporting the free users.
What to watch for
Check the current limits, privacy policy, advertising model, account requirements, and whether the free app belongs to the same audited infrastructure as the paid service.
+Pricing transparencyApps & plansHow clearly a VPN explains the real cost, billing period, renewal price, taxes, and optional extras before purchase.
Why it matters
A low advertised monthly equivalent can require a long upfront payment and can renew later at a different price.
How to understand it
Useful pricing information separates the amount charged today from the monthly equivalent, states the subscription length, identifies the renewal amount or pricing rule, and explains whether add-ons are included.
What to watch for
Look beyond the largest number on the page. Compare total upfront cost, renewal terms, monthly-plan availability, currency conversion, and cancellation requirements.
+Refund policyApps & plansThe rules determining whether and how a VPN purchase can be refunded.
Why it matters
A “money-back guarantee” may make testing less risky, but eligibility can depend on timing, payment method, store, prior refunds, or how the subscription was purchased.
How to understand it
Purchases made through Apple, Google, a reseller, cryptocurrency, cash, or a gift card may follow different processes from purchases made directly on the provider’s website.
What to watch for
Check the deadline, exclusions, automatic-renewal treatment, refund frequency limits, and who actually processes the payment before subscribing.
Understand the term. Then check the provider.
The same feature name can describe different behaviour across apps and operating systems. Softplorer comparisons show the implementation and the trade-off, not just a checkmark.
Compare VPNs© 2026 Softplorer