Use a VPN without assuming it makes everything private

Decide whose view you want to change

A VPN can move your internet traffic into an encrypted tunnel between your computer and a VPN server. That changes which network operator handles the onward connection. It does not remove your identity from a shopping account, undo a location permission or make an unsafe download trustworthy.

This guide uses the Proton VPN desktop app on a personally managed Windows 11 computer. It assumes you already have an account and the official app installed. The named product provides a concrete example, not a provider ranking. A workplace VPN has a different purpose and administrator; leave required organizational controls in place.

Write one sentence before changing anything: “I want ordinary browsing to travel through this VPN, and I want to know what happens when I disconnect.” That gives you something observable to check. “Make everything private” does not.

The destination still knows what you tell it

For traffic actually carried inside the tunnel, the local network and internet provider see the connection to the VPN, including timing and volume, rather than the same direct destination connections. You transfer trust to the VPN operator. HTTPS still matters: it encrypts website content between the browser and website, including across the VPN’s onward route. The VPN does not ordinarily decrypt that HTTPS content.

A website can still associate activity with your signed-in account, cookies or browser fingerprint. Device location access is separate from the public IP address. EFF’s VPN guidance explains these limits and why public Wi-Fi does not automatically make modern HTTPS browsing exposed.

Choose a provider only after reading its privacy policy and considering what evidence supports its claims. An independent audit has a scope and date; it is not a permanent guarantee. If the concern is account access, start with account security. If the concern is a malicious file, changing its network route does not solve that problem.

Connect, then make a small, repeatable observation

Do the first rehearsal on a connection you control, with no sensitive activity underway. Save work before changing routes: an active call or transfer may be interrupted. Privately record the app’s current settings so you can restore them.

1. Open Proton VPN and sign in. On Home, select Connect. Wait for the connected state, rather than treating a button press as completion.
2. The documented connected Home screen turns green and shows the server location and connection information. Note the server and time. If it remains disconnected or shows an error, stop here; do not describe the session as protected.
3. Open a fresh page on a familiar HTTPS website. Request another page rather than relying on an already displayed tab. Confirm that browsing actually works while the app says it is connected.

These controls and outcomes follow Proton’s Windows app instructions. Free-plan server choice differs from paid plans; this rehearsal does not require selecting a particular country.

For a limited routing comparison, you can record the public IP reported by the same trusted IP-check page before connecting and after connecting. Make the disconnected observation only when ordinary direct access is acceptable. Compare the address, not just a country flag. Avoid sending that record to strangers or including it in a public help request.

A different reported address supports only this finding: that page request used a different outward address. It does not test every app, every address family, DNS handling or every interruption. If the result is unchanged, check the app’s state and the split-tunneling setting below before repeating. Do not keep refreshing until one result looks reassuring.

Choose what “disconnected” should mean

In Proton VPN, select Kill switch in the right sidebar, turn its toggle on, select the mode, then click Apply. Proton documents two different behaviors: Standard blocks internet traffic after an accidental tunnel loss, but allows it after you deliberately disconnect. Advanced allows internet access only through Proton VPN and remains active after a restart.

Choose Standard if you deliberately want ordinary access after pressing Disconnect. Choose Advanced if you prefer losing connectivity to continuing outside the tunnel. Record the choice and the recovery path before relying on it. A setting that surprises you during a deadline is harder to handle carefully.

For a harmless rehearsal of Advanced mode, first connect, then deliberately disconnect in the app. Try a fresh request to the same public HTTPS site. The expected result is no internet access. Reconnect and repeat the request; browsing should return. This checks the deliberate-disconnect behavior you selected, not every possible failure condition.

If you selected Standard, deliberately disconnecting is not an accidental-drop test. Successful browsing afterward is consistent with its design. Do not claim to have tested crash recovery or leak prevention by pressing Disconnect.

To restore direct internet access intentionally, open the same Kill switch control, turn it off and click Apply. Close sensitive activity first and recognize that subsequent traffic can use your normal connection. Rebooting alone is not the recovery plan for Advanced mode.

Check whether an app was left outside

Open the Split tunneling shortcut on Home, also available through Settings. If you do not need exceptions, leave split tunneling off. If it was already configured, record its mode and entries before changing it.

Proton’s Windows split-tunneling guide distinguishes Exclude mode, which sends listed apps or addresses outside the tunnel, from Include mode, which sends only the specified ones through it. Saved changes use Apply when disconnected or Reconnect when connected.

Imagine, hypothetically, that you excluded your browser to make one troublesome website work. You have also changed the route for other browsing in that app. A green VPN Home screen does not cancel that exception. Prefer investigating the particular failure before creating a broad bypass. On Windows, Proton supports combining split tunneling with its kill switch; that compatibility does not mean intentionally excluded traffic becomes tunneled.

Recover one variable at a time

If the tunnel connects but one site fails, try another harmless HTTPS site. If that works, record the failing site and error; a site may reject a shared VPN address. Try reconnecting to another available server before changing security settings. Never bypass a certificate warning to make the comparison work.

If nothing loads, check for Advanced kill switch with no active tunnel. Reconnect first. If you intentionally need direct access, use the recovery control above. On accommodation Wi-Fi, a required network sign-in may need to be completed before connecting the VPN; do that without unrelated sensitive browsing, then reconnect and verify the connected state again.

Keep a short private record: selected mode, exceptions, observed address change if checked, and whether fresh browsing returned after reconnecting. Repeat the relevant check after changing settings. Describe the outcome narrowly: “this request used the VPN route” is useful evidence. It is no reason to relax account security, grant location access casually or assume an existing login has become anonymous.