crackthe.netDeutsch

Level 3 · How it works3 min readUpdated October 17, 2026

VPN tunnel and encryption: what is protected and what is not

Which part of your connection a VPN encrypts, what HTTPS protects on top of that, and what the VPN provider and the networks behind its servers can still see.

Illustration: a padlock icon in a rounded tile, with the title What VPN encryption protects

Key points

  • A VPN encrypts the path between your device and the VPN server. After the server, your traffic travels on without the VPN’s encryption.
  • Most websites add their own encryption, HTTPS, from your browser all the way to the website. A VPN does not replace it.
  • The VPN provider can see which sites you connect to, but not the content of HTTPS pages.

Two layers of encryption

A VPN app wraps your traffic in an encrypted connection to the VPN server. This is called VPN tunneling, and the connection is the tunnel. Websites that use HTTPS add a second layer inside it:

  1. Your device
  2. Wi-Fi and internet providersee only the tunnel
  3. VPN serversees which sites you open
  4. WebsiteHTTPS still protects the content
encrypted by the VPN not encrypted by the VPN
The VPN's encryption covers your device to the VPN server. HTTPS covers your browser to the website, through the whole trip.

Who sees what

WhoWithout VPN, with HTTPSWith VPN and HTTPS
Wi-Fi operatorwhich sites you openonly that you use a VPN
Your internet providerwhich sites you openonly that you use a VPN
VPN provider–which sites you open, not the page content
Network operator of the VPN server–the server’s traffic, not your HTTPS content
The websiteyour IP addressthe VPN server’s address

“Which sites you open” means the names of the sites, for example from address lookups (DNS) and the start of each encrypted connection. The pages you read, the forms you send, and your passwords stay inside HTTPS.

Who runs the servers

VPN providers usually rent servers in data centers. The company that runs the network behind a server can see the server’s traffic, just as your internet provider sees yours. This archive records which network carries each published server: the 13 providers’ servers sit in 131 networks, and 43 of these networks carry servers of more than one provider.

Share of each provider's locations in networks that other providers use too
Mullvad98 %
AirVPN95 %
IVPN95 %
OVPN94 %
Private Internet Access93 %
hide.me86 %
AzireVPN74 %
Windscribe74 %
NordVPN73 %
Surfshark53 %

Only for providers whose list names server addresses.

More in The networks behind VPN servers.

What encryption does not hide

  • Your accounts. If you log in, the site knows it is you.
  • The amount and timing of traffic. Encryption hides content, not the fact that data flows.
  • Your device’s own data. Apps can still send data about you to their makers.

Check the address, not the lock icon. The padlock in the browser means HTTPS. To see whether the VPN is active, use the IP check.

Next step

Encryption only helps if all traffic goes through the tunnel. Read DNS and WebRTC leaks.

The figures in this guide come from the archive and change with every data update. As of October 17, 2026.

Check it with the archive's data

Read next: DNS and WebRTC leaks: when your real address slips outAll guides