How to set up a VPN on your phone and PC

A VPN routes your internet traffic through an encrypted tunnel to a server run by whoever provides the VPN. On a shared or public network, that stops the people around you from reading what you send. What it doesn’t do is make you invisible. This guide covers what a VPN really protects, how to pick one you can trust, and exactly how to switch it on in Windows 11 and on an Android phone, both with a provider’s app and with the client built into the operating system.

What a VPN actually does, and what it doesn’t#

Think of a VPN as a sealed pipe between your device and one server. Anyone on the same Wi-Fi, or your internet provider, can see that you connected to the VPN, but not which sites you visited or what you typed. Websites see the VPN server’s address instead of yours. That is genuinely useful on networks you don’t control.

It is not anonymity, and it is not a security cure-all. Your traffic still has to leave the VPN server to reach the wider internet, so the provider now sits where your ISP used to: it can see where you go. You can still be identified by the accounts you log into, by cookies, and by browser fingerprinting. A VPN doesn’t scan for malware or warn you about a fake login page, and it does nothing about a weak password.

It also matters less than it once did on public Wi-Fi. As the FTC points out, most sites now encrypt their traffic, so connecting through public Wi-Fi is usually safe as long as you see a lock icon and https in the address bar. A VPN adds a layer on top of that; it does not replace the site’s own encryption.

Situation	Does a VPN help?
Using public or shared Wi-Fi at an airport, cafe, or hotel	Yes. It encrypts your traffic so others on the network can’t read it.
Hiding your browsing from your internet provider	Yes. Your ISP sees only the VPN connection, not the sites.
Reaching a work network or a region-locked service	Often. These are common, legitimate uses.
Staying anonymous online	No. The provider can see your traffic, and accounts, cookies, and fingerprinting still identify you.
Blocking malware, scams, or phishing pages	No. A VPN doesn’t inspect content or catch fake login pages.
Protecting a site login that already uses HTTPS	Little. The site’s own encryption already covers that data.

The “free VPN” trap, and how to choose one#

Using a VPN means trusting the provider with everything your internet company could previously see. That trust is the whole decision, which is why “free” is the word to be careful about. The FTC advises that when shopping for a VPN app you research the company, review the permissions it asks for, confirm that it actually encrypts your data, and check whether it shares information with third parties. Its review of free VPN apps found some that didn’t encrypt at all, requested unexpected privileges, and passed user data to others, the opposite of what a VPN is for.

No single product is right for everyone, so judge on criteria rather than a brand name: a plain-language privacy policy about what is logged, a business model you can actually see (you pay, or you are the product), independent security audits, and app permissions that match what the app needs to do. If a service is free and vague about how it makes money, assume your data is the payment.

Turn on a VPN in Windows 11#

Most paid providers give you an app, and that is the easy path: install it, sign in, and click Connect. The app fills in the server details for you.

If you would rather use the client built into Windows, or your provider hands you server settings instead of an app, Microsoft’s own steps are short. Open Settings and go to Network & internet > VPN > Add VPN. Set the VPN provider to “Windows (built-in),” give the connection a name you’ll recognize, then enter the server address, the VPN type, and the sign-in info your provider supplied (the address looks something like vpn.example.com). Select Save. To connect, click the network icon on the taskbar, or return to that Settings page and choose Connect.

Turn on a VPN on Android#

The exact wording shifts between phone makers, but the path is consistent. With a provider’s app, you install it from Google Play, sign in, and tap to connect; Google notes that the app itself opens to make the connection.

For the built-in client, open Settings and go to Network & internet > VPN. If you don’t see it, search “VPN” in Settings. Add a profile, enter the server address and VPN type your provider gives you, then your username and password, and tap Connect. One caveat: the “Always-on VPN” option, which keeps the tunnel active in the background, isn’t available in every setup, and the fully built-in client is limited to certain newer phones. On many devices the provider’s app is the practical choice.

Platform	Provider app	Built-in client
Windows 11	Install the app, sign in, click Connect.	Settings > Network & internet > VPN > Add VPN; set provider to “Windows (built-in)”; enter server address, VPN type, and sign-in info; Save, then Connect.
Android	Install from Google Play, sign in, tap Connect (the app opens).	Settings > Network & internet > VPN; add a profile with your provider’s server details; enter username and password; tap Connect.

The honest limits#

A VPN is worth turning on when you’re on Wi-Fi you don’t control. CISA’s advice is simple: if a VPN is available, use it any time you’re on a public wireless network, start the session right after you connect, and keep the app updated.

Treat it as one layer, not a shield. It won’t stop you from entering your password on a fake page, so it helps to know how to spot a phishing email. It won’t rescue a password that has already leaked, which is why two-factor authentication does more for most people than any VPN. And it does nothing about the scam calls and texts hitting your phone, which is a separate habit covered in our guide to stopping spam texts and robocalls on Android. Turn the VPN on where it earns its keep, and let the rest of your security handle the jobs a VPN was never built for.