Twelve VPN claims that are wrong

Almost every misconception here comes from the same root: treating a network tool as a general privacy product. Sorting them out makes the actual value of the thing clearer rather than smaller.

"A VPN makes you anonymous"

It removes one identifier from one observer. Accounts, cookies and browser fingerprinting identify you independently, and none is affected.

Accurate version: it stops your network operator seeing where you go, and stops sites seeing your address.

"Nobody can see anything I do"

Your provider can see everything your network operator used to. The trust moved rather than disappearing, which is why what the provider retains is the question that survives.

"My ISP cannot tell I am using a VPN"

It can. Server addresses are published and belong to hosting ranges. Hiding the existence of a tunnel is a much harder problem than hiding its contents, and no ordinary consumer VPN attempts it.

"It protects me from hackers"

Against a network-position attacker on a shared network, yes. Against phishing, malware, weak passwords or a compromised device, no. Those are the ways people actually lose accounts.

"It changes my streaming region"

It changes your apparent location. Your account's region comes from billing details stored against the account, and services read that field.

"Free VPNs are all dangerous"

The funding model is what matters. A free tier funded by paying subscribers is a normal software business. One funded by selling your bandwidth as an exit node is genuinely dangerous. Read the sharing clause in the privacy policy.

"Paid VPNs are safe by definition"

Payment funds the service; it does not verify the claims. A paid provider with a vague policy and no audit is offering less evidence than a free one with a specific policy.

"No-logs means nothing is recorded"

Nothing that could exist does. Accounts exist, payments exist, and abuse handling needs something. A meaningful claim states which categories, why, and for how long.

"A VPN slows you down by half"

Ten to thirty percent on a nearby server. Larger losses point at distance, congestion, MTU or a device whose CPU is the bottleneck — all diagnosable.

"Incognito mode does the same thing"

Private browsing clears local storage when the window closes. It changes nothing about what the network sees, and nothing about your address. Entirely different mechanism, entirely different effect.

"I have nothing to hide"

Not a myth about the technology, and worth answering anyway. The material at stake is a timestamped list of every site you open, which describes health, finances, employment, relationships and beliefs. Whether that should be compiled by a commercial party is a reasonable thing to have a view about, in either direction.

"A VPN protects everything on my device"

An app does; a browser extension protects one browser. WebRTC can also contradict a working tunnel by reporting addresses the browser knows about directly, which is why the WebRTC leak test exists.

The accurate summary

A VPN encrypts traffic between your device and a server you chose, so the network you are on cannot see your destinations and the sites you reach cannot see your address. That is the whole claim, it is genuinely useful, and it is smaller than the marketing.

Verify the part that is checkable with what is my IP, and read what your provider records in its privacy policy — those two things tell you more than any list of features.

"Tor is just a slower VPN"

Different structure, not a different speed. A VPN has one party who knows both who you are and where you are going. Tor is built so no single relay knows both, which is a stronger property and the reason it is slow.

Neither replaces the other. Tor is the tool when the concern is that a provider could be compelled or compromised; a VPN is the tool when the concern is the network you are sitting on.

"The more server locations, the better the provider"

Location counts are a marketing number. Several of the entries in a long list are frequently virtual — addresses registered in one country announced from hardware in another — and a provider with twenty well-provisioned locations will outperform one with a hundred thin ones.

What matters is whether there is a well-connected server near you, and the way to find out is to measure latency rather than to count flags.

"Military-grade encryption"

Not a technical term. It usually means AES-256, which is a public standard used by every bank, every browser and every messaging app. The phrase describes nothing that distinguishes one provider from another, and its presence on a marketing page is mildly informative about the marketing.

Why these persist

Because the accurate description is narrower and harder to sell, and because several of them were true once. Streaming region changes worked years ago; the coffee-shop session hijacking that "protects you from hackers" refers to was a real attack before the web encrypted itself.

The claims outlived the conditions that made them true, which is how folklore usually works.