Anyone who works from a coffee shop, a library, or a hotel lobby has probably been told to use a VPN. Search for one, and the results mix in proxy services described in almost identical language: hide your location, protect your privacy, browse securely. The terms get used interchangeably, and they should not be.
The distinction is not academic. Choosing the wrong one for the situation means believing you are protected when you are not, which is worse than knowing you are exposed.
What a proxy does
A proxy sits between one application and the internet. Traffic from that application is routed through the proxy’s server, so the site at the other end sees the proxy’s address rather than yours.
That is the whole of it. A proxy changes where your traffic appears to come from. It does not, in most configurations, encrypt anything, and it usually applies to a single browser or app rather than the whole device. Everything outside that application continues to travel exactly as before.
What a VPN does
A VPN operates at the device level and builds an encrypted tunnel for all traffic leaving it. Your browser, your email client, your banking app and every background service travel inside that tunnel.
The practical consequence on a shared network is significant. Whoever operates that network sees a single encrypted connection to one destination rather than a detailed list of every service your device contacted and when.
The same claims, two different scopes of protection.
Why the difference matters most in public
At home, on a network you configured, the gap between the two options is largely theoretical. In public, it becomes concrete, because the thing you are protecting against is the network itself and whoever else is on it.
A proxy protecting your browser does nothing for the app checking your email in the background. It also does not conceal the pattern of your activity from the network operator, because the traffic is not encrypted by the proxy. If the reason for using anything at all is a network you do not control, a browser-level tool addresses the wrong layer.
A fuller side-by-side comparison of the two approaches is worth reading before choosing, and this explainer on what is a vpn vs proxy is covers where each one genuinely fits. The short version is that a proxy is a routing tool and a VPN is a privacy tool, and they are not substitutes.
The free service question
Both categories have a large free tier, and the economics deserve a moment’s thought. Operating servers and bandwidth costs money. A service charging nothing is generating revenue in some other way, and the available options are limited: advertising injected into pages, logging and selling browsing records, or reselling connection capacity.
This applies to free proxies more acutely than to reputable free VPN tiers, because a proxy operator handling unencrypted traffic can read all of it. The service positioned as protecting your privacy is, in that arrangement, the party with the clearest view of your activity.
What to actually do before connecting
- Set up before you leave: install and sign in on a network you trust. Captive portals frequently block app stores.
- Turn off automatic joining: phones reconnect to networks with familiar names without asking, including ones that merely look familiar.
- Give portals the minimum: a room number and surname is normal. A request to sign in with an email or social account is not.
- Connect the tunnel after the portal: the portal has to clear first, so do that, then connect, then do anything sensitive.
Public network guidance from the Cybersecurity and Infrastructure Security Agency makes a point worth keeping in mind: the central problem with an open network is not usually dramatic interception, but how little the user knows about who runs the connection and what it records.
What neither tool does
It is worth being clear about the limits, because both categories get marketed as general-purpose protection and neither is. A tunnel protects traffic while it moves. It does nothing about an account with a reused password, a phishing email that persuades you to type your credentials into a convincing page, or software on the device that has not been updated in a year.
Nor does either tool make you anonymous. The services you sign into still know who you are, because you logged in. Changing the route your traffic takes does not change what you tell the destination once you arrive.
Treating a VPN as one layer among several is the accurate mental model. Treating it as a substitute for the others is how people end up worse off, because the sense of protection removes the motivation to fix the actual gaps.
Proportionate, not paranoid
Most public networks are ordinary networks run by businesses with no interest in their customers’ traffic. The reasonable position is simply that a connection you did not configure deserves different handling from one you did.
Understanding which tool addresses which layer is most of the work. After that it is one application, installed once, and four settings that never need revisiting.
