How Is Your Connection Encrypted?

What VPN Encryption Actually Protects

VPN encryption wraps your traffic in a cipher so that anyone between you and the VPN server - your ISP, the operator of a public Wi-Fi network, anyone monitoring the link - sees only unintelligible data. They can tell that you are connected to a VPN and how much data you are moving, but not to which sites or what they contain.

What it does not do is protect you past the VPN server. From that point onward your traffic re-enters the ordinary internet, protected only by whatever HTTPS the destination site provides. This is why the transport-layer checks on this page matter alongside the tunnel: a strong VPN cipher and a weak TLS configuration still leave you exposed, just to a different observer.

In practice the cipher is rarely the weak link. Every protocol in the reference table above except PPTP uses encryption that no realistic adversary can break directly. Attacks target implementation flaws, leaked keys, compromised endpoints and traffic metadata - not the mathematics. Choosing AES-256 over AES-128 changes almost nothing about your actual risk.

How to Read Your Results

The checks above read the encryption of your current browser session with this site, as negotiated - nothing on this page is assumed. Here is what each one is telling you.

• TLS version: TLS 1.3 is current and removes the legacy cipher suites that made earlier versions attackable. TLS 1.2 remains acceptable when configured well. An older version on a current browser suggests something on the path is downgrading the connection - for example software that intercepts HTTPS, which some free VPN apps do.
• Key exchange: forward secrecy means a key stolen later cannot decrypt a recording of this session. A post-quantum hybrid (such as X25519 with ML-KEM) also protects recordings against future quantum computers.
• Site name in the handshake: the name of the site you open usually travels in plain text at the start of the connection. Encrypted Client Hello hides it, but few sites and browsers use it yet. Without a VPN your ISP can read it; with one, only the networks after the VPN server can.
• Mixed content: flags encrypted pages that pull scripts or images over plain HTTP. A single mixed script is enough to compromise the whole page, since it can rewrite anything on it.
• The grade: A for TLS 1.3 with forward secrecy, B for TLS 1.2 with it, C for anything older, F without HTTPS or with mixed content. When the connection could not be read, there is no grade.

Choosing a VPN Protocol

The reference table above lists what is available; this is how to choose between them.

• For most people: WireGuard. It is fast, its codebase is small enough to be audited properly, and ChaCha20-Poly1305 performs well on devices without AES hardware acceleration.
• For maximum compatibility: OpenVPN with AES-256-GCM. Slower, but it works everywhere and has two decades of scrutiny behind it.
• For restrictive networks: obfuscated transports such as VLESS with XTLS-Reality, Trojan or Shadowsocks-2022, which are designed to be indistinguishable from ordinary HTTPS traffic.
• On mobile: IKEv2/IPSec handles network switching between Wi-Fi and cellular more gracefully than most alternatives.
• Never: PPTP. Its encryption has been broken for over a decade and it offers no meaningful protection at all.

Whichever you choose, confirm the tunnel is not leaking around the encryption - a perfectly encrypted connection with a DNS leak still hands your browsing history to your ISP. Our IP leak test checks all five channels at once.

🧰 Related Security Tools

The tests run in your browser. Where one needs to know whose network an address is on, our server looks it up and keeps no address. Nothing is stored unless you choose to share the result.

📚 Read next

The longer version: what this test is looking for, and what to do with the answer.