The definitive VPN guide
On this page
A VPN sends your traffic through an encrypted tunnel to a server run by the VPN company. The network you are on cannot read it, and websites see that server’s address and location instead of yours.
It does not make you anonymous, and it does not stop malware. This guide covers what a VPN does and cannot hide, the Australian rules, and the jargon you will meet choosing one.
What is a VPN?
A VPN, or virtual private network, is that tunnel plus the server at the far end: your traffic reaches the internet from the VPN company’s server, not your own connection.
Two things change when you switch it on. Your internet provider, and whoever runs your Wi-Fi, can see you are connected to a VPN but not which sites you visit. Those sites see the VPN server’s IP address and location instead of yours.
So a VPN is a privacy tool, not an invisibility cloak. Sites you log in to still know who you are. What it does well is keep your activity from the network you are on, and let you choose where you appear to be.
How does a VPN work?
Your device and the VPN server agree on encryption keys, then everything between them travels scrambled. Anyone watching in between, such as a café’s Wi-Fi or your NBN provider, sees unreadable data going to one server.
The VPN server unwraps your traffic and sends it on to the site you asked for. The site replies to the VPN server, which wraps the reply and sends it back to you. The cost is a little speed: your data takes a longer route and gets encrypted on the way.
The VPN company now sits where your internet provider used to, and can see where your traffic goes. That is why its privacy policy, and whether anyone has audited it, matters more than any feature list.
Encryption
Encryption turns your data into something only the holder of the right key can read. The two ciphers you will see most are AES-256 and ChaCha20.
AES-256 is the standard banks and governments use, and what OpenVPN and IKEv2 connections usually run on. ChaCha20 is WireGuard’s; it is just as strong and faster on phones without special hardware. If a VPN uses either, the encryption is not the weak point.
Which VPN protocol should you use?
Use WireGuard, or the provider’s own version of it, unless something blocks it. A protocol is the set of rules your device and the VPN server follow to build the tunnel. The app picks one for you, but most let you change it.
WireGuard
WireGuard is the newest major protocol and now the default or a recommended option in most major VPN apps. It is fast, light on battery and built on a small open-source codebase that is easier to audit than older designs. Several providers run their own versions: NordVPN calls its one NordLynx.
OpenVPN
OpenVPN is the long-standing workhorse: secure, open source and supported almost everywhere. Security researchers have picked over its public code for two decades. It is slower than WireGuard, but the best fallback when WireGuard is blocked, as on some hotel and office networks.
IKEv2/IPsec
IKEv2, paired with IPsec for encryption, is built into iPhones, Macs and Windows. It reconnects quickly when your phone switches between Wi-Fi and mobile data, so it suits phones on the move.
L2TP/IPsec
L2TP (Layer 2 Tunneling Protocol) grew out of PPTP and Cisco’s L2F in the late 1990s. It has no encryption of its own, so it is always paired with IPsec. It works, but it is slower than WireGuard and easier to block. Use it only if nothing newer is on offer.
PPTP
PPTP (Point-to-Point Tunneling Protocol) is obsolete and insecure. Its MS-CHAPv2 login, which also sets its encryption keys, was publicly broken in 2012, and Apple removed it from iPhones and Macs in 2016. Do not use it, and treat a VPN that still pushes it as a warning sign.
What a VPN is good for
A VPN earns its keep in six situations, through the encryption, the changed location or both.
Public Wi-Fi
On café, airport or hotel Wi-Fi, a VPN stops the network owner, and anyone else on it, seeing which sites you visit. Most sites now use HTTPS, which already encrypts what you send, so the risk is lower than a decade ago.
A VPN still covers the gaps: the site names your device looks up, apps that do not encrypt properly, and fake hotspots set up to look like the real one.
Watching your usual streaming services from overseas
ABC iview, SBS On Demand, Stan and Kayo are licensed for Australia and will not play from overseas. A VPN server in Australia makes you appear to be at home again.
Results differ by provider and change over time, because streaming services block VPN servers. Their terms of use can forbid it too.
A VPN’s own ad blocker can get in the way. On 21 October 2026 SBS On Demand would not play through Proton VPN until we switched off NetShield, its ad and tracker blocker.
Our best VPN for Netflix in Australia guide covers which providers suit streaming.
Blocked sites on school or work networks
A VPN tunnel goes around school and workplace site blocks, because the network cannot see where your traffic is heading. It can see that you are using a VPN, though, and its rules can forbid that.
Censorship abroad
Some countries block Google, Facebook, WhatsApp or news sites. A VPN gets around those blocks, but governments that censor heavily also hunt for VPN traffic. You need a provider with obfuscation (see the glossary), and you should check the local law before you travel.
Keeping your activity from your internet provider
Without a VPN, your internet provider sees every site you connect to. With one, it sees only that you are connected to a VPN server, and how much data you use.
Australia’s data retention law makes providers keep customers’ metadata for two years: your account details, the IP address you were given, when and how long you were connected, and how much data you used. It excludes your browsing history, so a VPN changes what your provider sees as it happens, not what it keeps.
Comparing prices by country
Some shops, airlines and software makers show different prices in different countries, and switching your VPN location lets you compare them. A saving is not guaranteed, and paying in a foreign currency can add card fees, so check the final total.
What a VPN cannot hide
A VPN protects the link between your device and the VPN server, and swaps your IP address. Everything else about you online stays as visible as before.
- Accounts you log in to. Google, Facebook and your bank still know it is you.
- Cookies and browser fingerprints. Ad networks track your browser, not just your IP address. A privacy-focused browser such as Firefox or Brave, or a tracker-blocking extension, deals with this; a VPN does not.
- Your payment. The VPN company knows who paid. If that matters, check which payment methods a provider takes before you sign up.
- Traffic after it leaves the VPN. Between the VPN server and a site without HTTPS, your data travels unencrypted. Look for the padlock.
- The VPN company itself. It can see where your traffic goes, which is why its logging policy is the next question.
What does “no logs” mean?
A no-logs VPN says it does not record which sites you visit, what you download or which IP address you connected from. It still needs some things to run the service: your email address, your payment, and which server you are on while connected.
“No logs” is the provider’s own claim until someone checks it. The stronger evidence is an independent audit by a named firm, or a court case or police request where the provider had nothing to hand over. Read the privacy policy too: a VPN that keeps your browsing history defeats its own purpose.
VPNs in Australia
- They are legal. Using a VPN is lawful in Australia, and what you do while connected is covered by the usual laws. See are VPNs legal in Australia?
- Metadata retention. Australian internet providers must keep customers’ metadata for two years. What that record covers, and what a VPN changes, is above.
- Site blocking. Under the Copyright Act, rights holders can ask the Federal Court to order providers to block overseas piracy sites. See is torrenting illegal in Australia?
- Local servers. Distance costs speed, so a server in your own city matters. Providers cover different Australian cities, so check the list for yours before you buy.
- Pricing. Some providers bill in Australian dollars and some in US dollars, which changes what you pay. Our cheapest VPNs in Australia list converts everything to AUD daily.
How to choose a VPN
- Decide what it is for. Public Wi-Fi, streaming, torrenting and travel each favour different providers. Start with do I need a VPN?
- Check the renewal price, not just the introductory one.
- Look for an independent audit of the no-logs policy.
- Count your devices. Limits differ between plans; each review’s product box shows the current number.
- Use the refund period. Among the VPNs we track that list one, it runs 7 to 45 days, so try it properly while you can still get your money back.
Our best VPN for Australia comparison has our latest prices, each with the date it was checked. Each review covers the provider’s plans, privacy record and features, and shows the date of every result in it.
We test on a Melbourne home connection:
- First round (August 2021 to March 2022): 10 VPNs.
- Current round (from October 2026): so far Surfshark, NordVPN, Proton VPN, PrivadoVPN, PureVPN, Intego VPN, AdGuard VPN and Mysterium VPN.
- Not yet tested: hide.me, IVPN, Mozilla VPN and Mullvad VPN, and their reviews say so.
The table shows where each VPN stands, and the testing methodology page explains how we test.
| VPN | First round | Latest test | What we have tested |
|---|---|---|---|
 Surfshark | August 2021 | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting; August 2021: local speed, overseas speed, streaming and torrenting |
 NordVPN | August 2021 | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting; August 2021: local speed, overseas speed, streaming and torrenting |
 Proton VPN | March 2022 | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting; March 2022: local speed, overseas speed, streaming and torrenting |
 PrivadoVPN | – | October 2026 | October 2026: local speed, overseas speed, streaming, leaks and kill switch settings (drop test not run) |
 PureVPN | – | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting |
 Intego VPN | – | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting |
 CyberGhost | August 2021 | – | August 2021: local speed, overseas speed, streaming and torrenting |
 IPVanish | August 2021 | – | August 2021: local speed, overseas speed, streaming, leaks and torrenting |
 PrivateVPN | August 2021 | – | August 2021: local speed, overseas speed, streaming and torrenting |
 ExpressVPN | August 2021 | – | August 2021: local speed, overseas speed, streaming, leaks and torrenting |
 Windscribe | late 2021 | – | late 2021: local speed, overseas speed, streaming and torrenting |
 hide.me | – | – | Not tested by us yet |
 IVPN | – | – | Not tested by us yet |
 Mozilla VPN | – | – | Not tested by us yet |
 Mullvad VPN | – | – | Not tested by us yet |
 Astrill VPN | March 2022 | – | March 2022: local speed, overseas speed, streaming and torrenting |
 AdGuard VPN | – | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting |
 Mysterium VPN | – | October 2026 | October 2026: local speed, overseas speed, streaming, leaks, kill switch settings (drop test not run) and torrenting |
 Private Internet Access | late 2021 | – | late 2021: local speed, overseas speed, streaming and torrenting |
Our own tests from a Melbourne home connection: the first round in 2021 and 2022, and retests from October 2026.
Tested on an account Surfshark gave us free of charge (16–25 Oct 2026). Tested on an account NordVPN gave us free of charge (14–25 Oct 2026). Tested on an account Proton VPN gave us free of charge (17–21 Oct 2026). Tested on an account PrivadoVPN gave us free of charge (29 Oct 2026). Tested on an account PureVPN gave us free of charge (21 Oct 2026). Tested on an account Intego VPN gave us free of charge (22 Oct 2026). Tested on an account AdGuard VPN gave us free of charge (24 Oct 2026). Tested on an account Mysterium VPN gave us free of charge (24 Oct 2026).
Once your VPN is installed, the VPN test guide shows how to check it is working.
Glossary of VPN terms
The terms you will meet in VPN apps, reviews and sales pages, in plain English.
AES-256
The encryption standard used by most VPN connections that are not WireGuard, and by banks and governments. It became a US standard in 2001 and has held up since. If a VPN uses neither AES-256 nor ChaCha20, look elsewhere.
BitTorrent and P2P
BitTorrent is a peer-to-peer (P2P) way of sharing files: you download small pieces from many people at once, and share pieces back. The method is legal, and plenty of legitimate software and public-domain media travels this way.
Everyone in a swarm can see everyone else’s IP address, which is how rights holders identify people sharing pirated films. A VPN replaces your address with the server’s. It does not make infringement legal, and not every VPN allows P2P on every server.
Browser extension
A small add-on for Chrome, Firefox or another browser. These VPNs list a Chrome extension: Surfshark, NordVPN, Proton VPN, PureVPN, CyberGhost, IPVanish, ExpressVPN, Windscribe and hide.me. Most extensions protect only that browser’s traffic, not your other apps.
Install them only from the browser’s own store and from publishers you recognise: a malicious one can read everything you browse. Our free VPN Chrome extension guide covers the trade-offs.
Cookies
Small files a website saves in your browser to remember you: your login, your cart, your settings. Session cookies vanish when you close the browser; persistent ones stay until they expire or you delete them.
Advertisers use third-party cookies to follow you across sites, which a VPN does not stop. Every major browser lets you clear cookies in its privacy settings.
Copyright notices (DMCA)
A DMCA notice comes from the United States: under its Digital Millennium Copyright Act, rights holders send notices to whoever owns an IP address that shared their content. With a VPN, the notice goes to the VPN company, and each handles them differently.
Australia has no equivalent: an industry “three strikes” code was shelved in 2016 before it started. Instead, rights holders can ask the Federal Court to make an internet provider reveal who had an IP address.
In the Dallas Buyers Club case the court ordered iiNet to hand over customer details in 2015, but the film’s owners never got them and dropped the case. Under the Copyright Act they can also have piracy sites blocked. Our guides on torrenting and whether VPNs are legal in Australia explain both.
Connection logs
Records a VPN keeps about connections rather than content: when you connected, for how long, and how much data you used. Many providers keep a little of this, briefly, to fix faults and limit device numbers.
Short-lived, aggregated logs do little harm. Logs of your real IP address with timestamps are another matter, because they can tie VPN activity back to you. The privacy policy should say which kind it keeps.
Dark web and deep web
The deep web is everything search engines do not index, such as your email inbox and online banking. The dark web is a small part of it, reachable only through networks like Tor, with addresses ending in .onion.
Using Tor is legal in Australia, and journalists and people under censorship rely on it. Much of the dark web, though, is markets and forums best left alone.
Dedicated IP address
An IP address only you use, usually a paid add-on. Streaming services and banks trust it more, and you see fewer CAPTCHAs. The catch is privacy: an address only you use can be tied back to you.
Deep packet inspection (DPI)
A way of reading internet traffic as it passes, to identify what kind it is. DPI looks inside the small packets your data travels in. Censoring governments, some workplaces and some providers use it to spot and block VPN connections. Obfuscation is the counter.
DNS
The Domain Name System turns web addresses like bestvpn.com.au into the numerical IP addresses computers use. Your internet provider normally does these lookups, so it sees every site you look up. A VPN should send your lookups through its own servers instead.
DNS hijacking
An attack that tampers with DNS lookups to send you to a fake site, often a copy of your bank’s login page. A VPN that handles DNS through its own servers makes this much harder on a hostile network.
DNS leak
When your device sends DNS lookups outside the VPN tunnel, your internet provider can see which sites you visit even with the VPN on. Good VPN apps block this. Check yours with a free online leak test; our VPN test guide shows how.
Geo-restrictions
Limits that show or hide content depending on your IP address’s country. Netflix’s catalogue differs by country, and ABC iview and SBS On Demand work only from Australia. A VPN changes your apparent country; a proxy can too, but without encryption.
HTTP and HTTPS
HTTP is how your browser asks a website for pages. HTTPS is the same thing encrypted, so nobody between you and the site can read or alter it. Look for the padlock in the address bar, and never type passwords or card numbers into a site without it.
IP address
The numerical address your internet provider gives your connection. Every site you visit sees it, and it reveals your provider and rough location, usually your city. Your router gives each device at home its own local address, which only your home network sees.
Our guide to the risks of someone knowing your IP address explains what it gives away.
IP leak and IPv6
An IP leak is traffic that bypasses the VPN and reveals your real address. The usual culprit is IPv6, the newer address format that many VPNs do not fully route through their tunnel. If your connection has IPv6, choose a VPN that blocks or tunnels it, and run a leak test after installing.
Kill switch
A setting that cuts your internet if the VPN drops, so nothing goes out unprotected while it reconnects. Turn it on if you torrent or use public Wi-Fi.
Multi-hop (double VPN)
Routing your traffic through two VPN servers instead of one, usually in different countries. It makes your traffic harder to trace, but the extra distance slows it down. Most people do not need it.
Obfuscation
Disguising VPN traffic as ordinary encrypted web traffic. You need it where networks or governments block VPNs, such as some hotel and office networks or heavily censored countries. Not every provider has it, and it can be slower.
Proxy
A server that forwards your traffic so sites see its IP address instead of yours. Unlike a VPN, a typical proxy encrypts nothing, so your provider and anyone on your network still see what you do. Fine for a quick location change, not for privacy.
Shared IP address
Most VPNs put many customers on the same server address. That makes one person’s activity hard to single out, which is good for privacy, but sites that see heavy traffic from one address throw up more CAPTCHAs.
Simultaneous connections
How many devices one account can connect at once. Plans range from a handful to unlimited; each review’s product box shows the current number.
Smart DNS
A service that changes only your DNS lookups so streaming services think you are in another country. With no encryption it is faster, and it works on smart TVs and consoles that cannot run a VPN app. It does nothing for privacy.
Split tunnelling
A feature that lets you choose which apps or sites use the VPN and which use your normal connection. Handy when your bank or a local streaming service refuses VPN traffic but you want everything else protected.
Static IP address
An address you get every time you connect, rather than a new one each session. It usually costs extra and has the dedicated IP’s trade-off: fewer blocks and CAPTCHAs, less privacy, and you are tied to one location.
Throttling
When an internet provider deliberately slows certain traffic, such as streaming or torrenting, to ease congestion. A VPN hides what kind of traffic it is, so it cannot be singled out. It will not help if your whole connection is slow.
VPN client
The VPN company’s app for your phone, computer or TV. It manages your account, picks the protocol and connects you to a server.
VPN tunnel
The encrypted connection between your device and the VPN server. Anything inside it is unreadable to the networks it crosses, until it leaves the VPN server for the open internet.