AES (Advanced Encryption Standard)
A symmetric block cipher adopted by the U.S. government in 2001 and used by virtually every modern VPN to encrypt traffic. Most commonly seen as AES-256.
Anonymous VPN
A VPN service designed to make user activity untraceable to the individual subscriber, typically through anonymous payment methods and a strict no-logs architecture.
Anti-DPI
Techniques used by VPNs to disguise their traffic so Deep Packet Inspection systems cannot identify and block it.
Asymmetric Encryption
A cryptographic system using a pair of mathematically linked keys — one public, one private — to encrypt and decrypt data without sharing a secret in advance.
Authentication
The process of verifying that a user, device, or server is who or what it claims to be before granting access.
Authorization
The process of determining what an authenticated user is permitted to do — which servers, features, and bandwidth they can access.
Bandwidth
The maximum amount of data that can be transmitted over a network connection per second, usually measured in megabits per second (Mbps).
BitTorrent
A peer-to-peer file-transfer protocol commonly associated with VPN use, both because ISPs throttle it and because users wish to hide their IP from other peers.
Browser Fingerprinting
A tracking technique that identifies a unique browser based on a combination of seemingly innocuous characteristics, even when cookies and IP addresses are blocked.
BYOD (Bring Your Own Device)
A workplace policy allowing employees to use personal devices for work, dramatically complicating VPN security and accelerating the shift toward Zero Trust models.
Certificate Authority (CA)
A trusted third-party organization that issues and signs digital certificates, allowing clients to verify they are talking to the legitimate server.
ChaCha20
A modern stream cipher designed by Daniel J. Bernstein, used in WireGuard and TLS as a fast alternative to AES, especially on devices without hardware AES acceleration.
Cipher
An algorithm for performing encryption and decryption — the mathematical procedure that turns readable plaintext into unreadable ciphertext and back.
Cipher Suite
A bundle of cryptographic algorithms — key exchange, authentication, bulk cipher, and message authentication — that together secure a single TLS or VPN session.
Client
The software running on a user's device that initiates and maintains the VPN connection to the server.
Cloud VPN
A VPN whose server-side runs in cloud infrastructure rather than on-premises hardware, delivering secure access as a managed service.
Cookie
A small piece of data stored in a browser by a website, used to remember sessions and identity — and a key reason a VPN alone cannot make you anonymous.
Cryptocurrency
Digital currency secured by cryptography rather than a central bank — widely accepted by privacy-focused VPN providers as a way for users to subscribe without revealing identity.
Cryptography
The mathematical discipline of securing communication and data against adversaries — the foundation on which every VPN is built.
Internet Censorship
State-level blocking, throttling, or filtering of internet content — the global phenomenon driving VPN adoption among users seeking access to information and services.
Data Retention
The practice — often legally mandated — of storing user activity data for a defined period, the chief antagonist of any no-logs VPN policy.
DDoS Attack
A Distributed Denial of Service attack — flooding a target with traffic from many sources to overwhelm its capacity. A VPN can hide your real IP and prevent you from being targeted.
Decentralized VPN (dVPN)
A peer-to-peer VPN model where bandwidth is supplied by independent node operators rather than a single corporate provider, often coordinated through blockchain incentives.
Dedicated IP
A VPN feature that assigns a single user their own static IP address, rather than sharing one with hundreds of other users.
Deep Packet Inspection (DPI)
Network analysis that examines packet contents and metadata to filter, throttle, or block specific traffic — including VPN traffic.
Diffie-Hellman
A key-exchange method that allows two parties to derive a shared secret over an open channel without ever transmitting the secret — the cornerstone of modern VPN handshakes.
DMCA
The U.S. Digital Millennium Copyright Act, the legal regime behind takedown notices that target VPN providers when subscribers are accused of copyright infringement.
DNS (Domain Name System)
The internet's address book — translating human-readable domain names like google.com into the numerical IP addresses computers use to route traffic.
DNS Leak
A misconfiguration where DNS queries bypass the VPN tunnel and travel directly to the local ISP's resolver, revealing your browsing destinations.
DNS over HTTPS (DoH)
An evolution of DNS that wraps queries inside ordinary HTTPS requests, hiding them from ISPs and on-path observers.
DNS over TLS (DoT)
An encrypted DNS protocol that runs DNS queries inside a TLS connection on dedicated port 853, primarily used at the operating system level.
Double VPN (Multi-hop)
A configuration that routes traffic through two VPN servers in sequence, encrypting it twice and adding an extra layer of indirection between user and destination.
Dynamic IP
An IP address that may change over time, typically reassigned by an ISP from a pool. Most residential connections and most VPN exit IPs are dynamic.
Eavesdropping
Passive interception of network traffic by a third party — the textbook attack a VPN is designed to defeat.
ECC (Elliptic Curve Cryptography)
A modern family of asymmetric cryptography based on elliptic curves, offering equivalent security to RSA at much smaller key sizes.
Encryption
The process of converting readable data into ciphertext that can only be returned to its original form by someone holding the correct key.
End-to-End Encryption (E2EE)
A model in which data is encrypted on the sender's device and decrypted only on the recipient's device, with no intermediary — including the service provider — able to read it.
Endpoint
Any device that initiates or terminates a VPN connection — the laptop, phone, server, router, or gateway at either end of the tunnel.
Exit Node
The final server in a chain of relays — VPN, Tor, or multi-hop — through which traffic emerges onto the open internet, taking on that server's public IP.
Firewall
A network security system that monitors traffic and applies rules to allow or block connections — the gatekeeper that VPNs are sometimes used to bypass.
Five Eyes
The intelligence-sharing alliance of the United States, United Kingdom, Canada, Australia, and New Zealand — a frequent point of concern when choosing a VPN provider's jurisdiction.
Fourteen Eyes
An extended intelligence-sharing alliance built around Five Eyes plus nine additional European nations, often invoked when evaluating VPN jurisdiction risk.
Geo-blocking
The practice of restricting access to online content based on the user's geographic location, typically inferred from their IP address — and a primary reason consumers buy VPNs.
Geo-spoofing
Deliberately making your apparent location appear different from your real one, typically by routing traffic through a VPN server in another country.
Great Firewall (of China)
China's national internet censorship system — the world's most sophisticated and aggressive deployment of DPI, IP blocking, DNS poisoning, and active probing against VPN traffic.
Handshake
The initial exchange between a VPN client and server in which they authenticate each other, agree on cryptographic parameters, and derive a session key.
Hash Function
A one-way mathematical function that compresses arbitrary input into a fixed-size output, used in VPNs for integrity checks, key derivation, and authentication.
HTTPS
The secure version of HTTP — web traffic encrypted with TLS — providing confidentiality and integrity between browser and website, complementary to but distinct from a VPN.
IKEv2
Internet Key Exchange version 2 — the protocol that establishes IPSec tunnels, widely used because of its strong native mobile-device support and rapid reconnection.
Incognito Mode
A browser feature that disables local history and cookie persistence — frequently misunderstood as providing online anonymity, which it does not.
IP Address
The numerical identifier assigned to every device on a network, used to route traffic — and the single attribute a VPN most reliably hides.
IPSec
A suite of protocols that secures IP packets at the network layer through authentication and encryption — the foundation of many enterprise VPNs and mobile VPNs.
IPv4
The fourth version of the Internet Protocol, the addressing scheme that powered the internet's growth — running out of addresses but still dominant on most networks.
IPv6
The successor to IPv4, with a 128-bit address space large enough for trillions of trillions of devices — but a known cause of leaks in older VPN configurations.
IPv6 Leak
A failure mode where a VPN protects only IPv4 traffic while IPv6 traffic continues to flow outside the tunnel, exposing the user's real IPv6 address.
ISP (Internet Service Provider)
The company that connects your home or device to the internet — and one of the primary parties whose visibility into your activity a VPN is designed to limit.
Kerberos
An authentication protocol that uses a trusted third-party ticket-granting server to authenticate users without sending passwords across the network — common in enterprise VPN integrations.
Key Exchange
The cryptographic process by which two parties securely agree on a shared secret over an insecure network — the heart of every VPN handshake.
Kill Switch
A safety mechanism that blocks all network traffic if the VPN tunnel drops unexpectedly, preventing data from leaking onto the open internet.
L2TP/IPSec
Layer 2 Tunneling Protocol combined with IPSec — an older but widely supported VPN protocol, generally considered functional but not the modern best choice.
Latency
The delay between sending a request and receiving a response, measured in milliseconds — a key factor in VPN choice for gaming, video calls, and any real-time application.
Logs
Records that a VPN provider may keep about user activity — connection times, IP addresses, bandwidth used — and the central topic of every VPN privacy policy.
VPN Leak
Any situation in which traffic, addresses, or identifying information escape the encrypted tunnel and become visible on the open network.
Man-in-the-Middle (MITM)
An attack in which an adversary secretly relays and possibly alters communication between two parties who believe they are talking directly — the active counterpart to passive eavesdropping.
Metadata
Information about a communication rather than its content — who, when, how long, how much — often as revealing as the content itself, and only partly hidden by a VPN.
Multi-hop VPN
A VPN configuration that routes traffic through two or more servers in sequence, splitting trust across multiple jurisdictions or providers — sometimes called Double VPN.
NAT (Network Address Translation)
The technique that lets many devices share a single public IP address — fundamental to how the internet runs out of IPv4 addresses, and a significant complication for VPNs and P2P.
Net Neutrality
The principle that ISPs should treat all internet traffic equally, regardless of source, destination, or content — the policy debate that drives much of the consumer interest in VPNs.
No-Logs Policy
A VPN provider's commitment not to record user activity — the central privacy promise of every modern consumer VPN, and the one most often tested by audits and subpoenas.
Obfuscated Servers
VPN servers configured with obfuscation enabled, allowing users in restrictive networks to connect when ordinary VPN traffic is blocked.
Obfuscation
Disguising VPN traffic to look like ordinary internet traffic, defeating networks and governments that block recognizable VPN protocols.
OpenVPN
A mature, open-source VPN protocol that uses TLS for key exchange and runs over UDP or TCP, the de-facto standard for VPNs throughout the 2010s.
Peer-to-Peer (P2P)
A networking model where every participant is both client and server, enabling direct file sharing, decentralized communications, and many of the use cases that drive VPN adoption.
Perfect Forward Secrecy (PFS)
A property of secure protocols ensuring that a future compromise of long-term keys cannot decrypt past recorded sessions, because each session uses a fresh ephemeral key.
Ping
A diagnostic tool that measures round-trip latency to a network host — and a useful metric for choosing the closest, fastest VPN server.
Port
A numbered communication endpoint on a device, used along with the IP address to direct incoming traffic to the right application.
Port Forwarding
A VPN feature that opens a specific public port on the VPN server and routes incoming traffic on it back to the user, enabling P2P seeding and inbound connections.
Post-Quantum Cryptography
Cryptographic algorithms designed to resist attack by future large-scale quantum computers, increasingly being added to VPN and TLS protocols as a defense against 'harvest now, decrypt later' threats.
PPTP (Point-to-Point Tunneling Protocol)
An obsolete VPN protocol from the late 1990s, fast and broadly compatible but cryptographically broken — listed here only because it still appears in legacy configurations.
Privacy
Control over one's personal information — what is shared, with whom, and under what conditions. The fundamental motivation behind nearly every consumer VPN.
Proxy
An intermediary server that forwards your requests to their destinations — similar to a VPN in some uses, but typically without encryption and operating at the application layer.
RAM-only Server
A VPN server that runs entirely from volatile memory with no writable disk, ensuring no user data can persist across reboots — a structural foundation for serious no-logs claims.
Remote Access VPN
A VPN configuration in which individual users connect from anywhere to a centralized network — the workhorse of corporate work-from-home setups.
Residential IP
An IP address assigned by a consumer ISP to a home subscriber — far less likely to be blocked by streaming and anti-fraud systems than a data center IP.
Router
A device that forwards data packets between networks — and, when configured with VPN client software, the simplest way to protect every device in a household at once.
RSA
The first widely deployed asymmetric encryption algorithm, named after its inventors Rivest, Shamir, and Adleman — still used in VPN certificates but increasingly displaced by elliptic curves.
SASE (Secure Access Service Edge)
A cloud-native architecture that combines networking and security functions — including VPN-like remote access — into a unified service delivered from the network edge.
Server
The remote endpoint of a VPN connection — the machine that accepts your encrypted traffic, decrypts it, and forwards it to the public internet.
Shadowsocks
An encrypted SOCKS5 proxy designed in China specifically to bypass the Great Firewall — strictly speaking not a VPN, but widely used as one.
Shared IP
The default VPN configuration where many users connect through and exit from the same IP address — a privacy feature, since any single user's activity is mixed with everyone else's.
Single Sign-On (SSO)
An authentication scheme that lets users log in once with a central identity provider and access many applications without re-authenticating — a common front end to enterprise VPNs.
Site-to-Site VPN
A VPN configuration that joins two whole networks together with a permanent encrypted link, typically used to connect branch offices or corporate networks to cloud environments.
Smart DNS
A geo-spoofing technique that redirects only the DNS lookups associated with geo-blocked services, leaving the rest of traffic unencrypted and at full speed.
SOCKS5
A general-purpose proxy protocol that forwards arbitrary TCP and UDP traffic — sometimes offered by VPN providers as a lightweight alternative to a full tunnel.
Split Tunneling
A VPN feature that lets some traffic flow through the VPN tunnel while other traffic goes directly over the regular internet connection — useful for performance and accessing local resources.
SSL (Secure Sockets Layer)
The original protocol for secure web traffic, now obsolete and replaced by TLS — though the term 'SSL' persists colloquially in references to TLS-based products and SSL VPNs.
SSL VPN
A VPN that uses TLS (often referred to as SSL) as its transport layer, typically running over standard HTTPS port 443 to traverse restrictive firewalls.
Static IP
An IP address that does not change over time — the opposite of a dynamic IP — and a VPN feature for users who need a stable inbound endpoint or whitelist-friendly address.
Stealth VPN
A marketing term for VPN configurations using obfuscation to hide that a VPN is in use — used to bypass aggressive censorship or VPN-blocking firewalls.
Streaming
Watching video content over the internet — and one of the leading reasons individuals subscribe to consumer VPNs, to bypass geographic content restrictions.
Subnet
A subdivision of an IP network, defined by a network address and a subnet mask — the basic building block of how networks are organized and routed.
Symmetric Encryption
Encryption in which both parties use the same secret key to encrypt and decrypt — fast, simple, and used for the bulk of every VPN session's data.
TCP (Transmission Control Protocol)
A reliable, connection-oriented transport protocol that guarantees ordered delivery — a common but performance-suboptimal carrier for VPN traffic.
Throttling
Intentional reduction of bandwidth by an ISP — often targeting specific protocols or services — and one of the practical wins of using a VPN.
Throughput
The actual amount of data successfully delivered through a connection per unit of time — the practical performance metric, distinct from theoretical bandwidth.
TLS (Transport Layer Security)
The successor to SSL and the foundation of modern internet security — providing the encryption, authentication, and integrity that secure HTTPS, email, and many VPNs.
Tor
A free, open anonymity network that routes traffic through three volunteer-operated relays with layered encryption, providing stronger anonymity than any VPN can offer alone.
Tunneling
Encapsulating one network protocol inside another — the conceptual heart of every VPN, where original traffic is wrapped in encrypted packets for transit.
Two-Factor Authentication (2FA)
An authentication method requiring two distinct factors to log in — typically a password plus a code or physical token — strongly recommended for any VPN account.
VPN (Virtual Private Network)
An encrypted network connection between a device and a remote server, designed to provide privacy, security, and access to restricted resources over the public internet.
VPN Client
The software running on a user's device that initiates and maintains a VPN connection — the user-facing half of the VPN equation.
VPN Gateway
A device or service that terminates VPN connections at the edge of a network, accepting incoming tunnels and routing decrypted traffic to internal resources.
VPN Protocol
The set of rules and cryptographic methods that govern how a VPN client and server communicate — the fundamental design choice behind every VPN connection.
VPN Server
The remote machine that accepts VPN connections, decrypts incoming traffic, and forwards it onward to the public internet — the destination half of every VPN tunnel.
VPN Tunnel
The encrypted channel between a VPN client and server through which all protected traffic flows — the actual mechanism that makes a VPN private.
Warrant Canary
A periodically updated public statement asserting that a service has not received any secret legal demands — its disappearance signals that something has changed.
WebRTC Leak
A browser-level leak in which the WebRTC API exposes the user's real local and public IP addresses to JavaScript on web pages — even while a VPN is active.
WireGuard
A modern VPN protocol designed for simplicity, speed, and strong cryptography — increasingly the default choice for new VPN deployments.