A VPN builds a private network on top of a public internet connection. Encryption is what makes it private, and it is the part almost nobody looks at when choosing a provider.
What VPN encryption is
Encryption converts information into a code so that nobody without the key can read it. In a VPN, that means encoding everything transmitted over the tunnel to protect its confidentiality and integrity.
Two kinds of encryption
Symmetric encryption uses the same key to encrypt and decrypt. It is fast, but both sides need that key, so you need a safe way to get it to them. Asymmetric encryption uses a pair instead: a public key to encrypt and a private key to decrypt. It is much slower, so in practice a VPN uses public-key cryptography only to authenticate the endpoints and agree keys for the session, then does the bulk encryption symmetrically.
Protocols you will run into
- IKEv2/IPsec (Internet Protocol Security with its key-exchange protocol), the classic enterprise pairing.
- WireGuard®, simple and fast, and now the default in most modern deployments.
- OpenVPN, open source and built on TLS, the same family that secures ordinary web traffic.
- Avoid PPTP entirely, and treat bare L2TP as unencrypted; if L2TP appears at all it must be paired with IPsec.
What happens when you connect
Your device contacts the VPN server and the two negotiate a secure connection. They exchange keys, usually with asymmetric encryption, to set up the channel. After that, traffic between your device and the server is encrypted symmetrically, which is why the connection is fast enough to use. Intercepting it at that point gets you ciphertext and nothing readable.
What it protects you from
Be precise about what a VPN adds. HTTPS already protects passwords and card details in transit for almost all of the web. What your ISP and the local network still see without a VPN is metadata: destination addresses, timing, traffic volume, and often domain names through plaintext DNS or the TLS SNI field. A VPN hides that from the local path and shifts the visibility, and the trust, to the VPN provider. It also means the data that arrives is the data that was sent, not something modified on the way through.