1. Your PC encrypts
Windows creates a virtual network adapter for the VPN. Traffic routed to it is encrypted before it leaves your computer.
What is a VPN on Windows?
A clear explanation of how a virtual private network works on a Windows PC, what the built-in client supports, and what a VPN can and cannot do.
How it works
From your PC to the web, through a tunnel
2. The network carries it
Your Wi-Fi and internet provider pass the encrypted packets along. They can see the VPN server's address and how much data flows — not the content.
3. The server decrypts
The VPN server decrypts the traffic and sends it on to its destination. Replies come back the same way, through the tunnel.
4. Websites respond
Sites and services see the VPN server's IP address. Pages served over HTTPS stay encrypted end-to-end as usual.
Built-in client
VPN types you can choose in Windows Settings
When you add a VPN with the provider set to “Windows (built-in)”, the VPN type list offers the options below. Use the type your server supports.
| VPN type | How it works | Good to know | Recommendation |
|---|---|---|---|
| IKEv2 | IPsec-based, uses UDP ports 500 and 4500. | Reconnects quickly when you switch networks (for example from Wi-Fi to mobile hotspot). | Recommended |
| SSTP | Tunnels over TLS on TCP port 443, like HTTPS. | Passes through most firewalls and hotel networks that block other VPN traffic. | Recommended |
| L2TP/IPsec certificate or pre-shared key | L2TP tunnel protected by IPsec. | Widely supported by routers. Microsoft has announced that L2TP is deprecated in future Windows releases. | Acceptable |
| PPTP | Legacy protocol with MS-CHAPv2 sign-in. | Its security is considered broken, and Microsoft has deprecated it. | Avoid |
| Automatic | Windows tries the available types in turn. | Handy when you are unsure, but choosing the exact type is faster and more predictable. | If unsure |
What about WireGuard or OpenVPN? These popular protocols are not part of the built-in Windows client. They work on Windows through a separate client app supplied by the VPN service or project you use.
Windows versions
Which Windows should you use?
The VPN client works the same way on both versions, but the menus are named slightly differently. The setup guide covers both.
Windows 11 Recommended
Receives current security updates. VPN settings live under Settings › Network & internet › VPN, and a VPN button can be added to Quick Settings.
Windows 10
Microsoft ended support for Windows 10 on 14 October 2025. The built-in VPN still works under Settings › Network & Internet › VPN, but an up-to-date, supported system is safer.
Myths vs facts
What a VPN does — and doesn't do
“A VPN makes me anonymous.”
Fact: It hides your IP address from sites, but accounts you sign in to, cookies and browser fingerprinting can still identify you. The VPN operator can also see your connection.
“A VPN protects me from viruses.”
Fact: A VPN does not block malware or phishing. Keep Windows Security turned on and Windows Update current.
“HTTPS makes a VPN pointless.”
Fact: HTTPS protects page content, but the network can still see which sites you connect to. A VPN hides that from the local network and your provider.
“A VPN always makes the internet faster.”
Fact: Encryption and the extra trip to the server usually add some delay. A nearby, well-run server keeps the slowdown small.
Glossary
Terms you will see in Settings
Server name or address
Where the VPN server lives, either as a host name or an IP address. Supplied by whoever runs the server.
Pre-shared key
A shared secret used by L2TP/IPsec. It must match the server exactly, including upper and lower case.
Certificate
A digital credential that proves identity. It is more secure than a pre-shared key and is often used in organisations.
Type of sign-in info
How you prove who you are: user name and password, smart card, one-time password, or certificate.
Split tunnelling
Sends only some traffic (for example, office resources) through the VPN while the rest uses your normal connection.
DNS
The system that turns names into IP addresses. A well-configured VPN sends DNS requests through the tunnel too.
Understand it? Set it up.
Go to the step-by-step guide for Windows 11 and Windows 10.