What a VPN actually does
A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a VPN server. All traffic between you and that server is encrypted, so an observer on your local network (such as a public Wi-Fi access point) cannot read it.
From the VPN server, your traffic is forwarded to the websites you visit. Those websites therefore see the VPN server’s IP address rather than your own — which is why a VPN appears to change your location.
What a VPN protects
A VPN protects your traffic between your device and the VPN server: it hides your traffic from your local network, encrypts it, and prevents your ISP from seeing exactly which sites you visit.
What a VPN does NOT protect
A VPN does not make you anonymous to the VPN provider itself, does not protect you from malware, phishing, or sites that collect your data, and does not hide your identity from sites you log into. DNS leaks, IPv6 leaks and WebRTC leaks can also silently expose your real address if the VPN is misconfigured.
VPN vs proxy
Both a VPN and a proxy forward your traffic through another server, changing the IP address websites see. A VPN also encrypts the tunnel and usually applies to all applications; a proxy typically forwards only specific traffic (like HTTP) and does not encrypt it.