The encrypted reference for the language of private networks.

Adequacy decision: a European Commission ruling that a non-EU country protects personal data to a GDPR-equivalent standard, so data can flow there freely.

A symmetric block cipher adopted by the U.S. government in 2001 and used by virtually every modern VPN to encrypt traffic. Most commonly seen as AES-256.

AES-GCM is the AES cipher run in Galois/Counter Mode, which encrypts data and authenticates it in one fast step.

Always-on VPN is an operating system setting that starts the VPN automatically, keeps it connected and can block all traffic while the tunnel is down.

A VPN service designed to make user activity untraceable to the individual subscriber, typically through anonymous payment methods and a strict no-logs architecture.

Techniques used by VPNs to disguise their traffic so Deep Packet Inspection systems cannot identify and block it.

An ASN is a unique number that identifies a network, such as an ISP, hosting company or VPN provider, in the internet's routing system.

A cryptographic system using a pair of mathematically linked keys — one public, one private — to encrypt and decrypt data without sharing a secret in advance.

The process of verifying that a user, device, or server is who or what it claims to be before granting access.

The process of determining what an authenticated user is permitted to do — which servers, features, and bandwidth they can access.

The maximum amount of data that can be transmitted over a network connection per second, usually measured in megabits per second (Mbps).

A peer-to-peer file-transfer protocol commonly associated with VPN use, both because ISPs throttle it and because users wish to hide their IP from other peers.

A tracking technique that identifies a unique browser based on a combination of seemingly innocuous characteristics, even when cookies and IP addresses are blocked.

A workplace policy allowing employees to use personal devices for work, dramatically complicating VPN security and accelerating the shift toward Zero Trust models.

A captive portal is the sign-in or terms page that hotels, airports and cafés show before letting you use their Wi-Fi.

A trusted third-party organization that issues and signs digital certificates, allowing clients to verify they are talking to the legitimate server.

Carrier-grade NAT (CGNAT) is when an ISP puts many customers behind one shared public IPv4 address, adding a second layer of translation after your router.

A modern stream cipher designed by Daniel J. Bernstein, used in WireGuard and TLS as a fast alternative to AES, especially on devices without hardware AES acceleration.

An algorithm for performing encryption and decryption — the mathematical procedure that turns readable plaintext into unreadable ciphertext and back.

A bundle of cryptographic algorithms — key exchange, authentication, bulk cipher, and message authentication — that together secure a single TLS or VPN session.

The software running on a user's device that initiates and maintains the VPN connection to the server.

A VPN whose server-side runs in cloud infrastructure rather than on-premises hardware, delivering secure access as a managed service.

EU content portability: the right under Regulation (EU) 2017/1128 to use paid online subscriptions while temporarily in another EU country.

A small piece of data stored in a browser by a website, used to remember sessions and identity — and a key reason a VPN alone cannot make you anonymous.

Digital currency secured by cryptography rather than a central bank — widely accepted by privacy-focused VPN providers as a way for users to subscribe without revealing identity.

The mathematical discipline of securing communication and data against adversaries — the foundation on which every VPN is built.

Curve25519 is an elliptic curve by Daniel J. Bernstein; X25519 is the key exchange built on it, used by WireGuard, TLS 1.3 and Signal.

State-level blocking, throttling, or filtering of internet content — the global phenomenon driving VPN adoption among users seeking access to information and services.

A data protection authority is the independent public regulator in each EU/EEA country that enforces the GDPR and handles privacy complaints.

The practice — often legally mandated — of storing user activity data for a defined period, the chief antagonist of any no-logs VPN policy.

A Distributed Denial of Service attack floods a target with traffic from many sources. A VPN hides your home IP, which makes you harder to target directly.

A peer-to-peer VPN model where bandwidth is supplied by independent node operators rather than a single corporate provider, often coordinated through blockchain incentives.

A VPN feature that assigns a single user their own static IP address, rather than sharing one with hundreds of other users.

Network analysis that examines packet contents and metadata to filter, throttle, or block specific traffic — including VPN traffic.

A key-exchange method that allows two parties to derive a shared secret over an open channel without ever transmitting the secret — the cornerstone of modern VPN handshakes.

The U.S. Digital Millennium Copyright Act, the legal regime behind takedown notices that target VPN providers when subscribers are accused of copyright infringement.

The internet's address book — translating human-readable domain names like google.com into the numerical IP addresses computers use to route traffic.

A misconfiguration where DNS queries bypass the VPN tunnel and travel directly to the local ISP's resolver, revealing your browsing destinations.

An evolution of DNS that wraps queries inside ordinary HTTPS requests, hiding them from ISPs and on-path observers.

An encrypted DNS protocol that runs DNS queries inside a TLS connection on dedicated port 853, primarily used at the operating system level.

DNSSEC adds digital signatures to DNS records so a resolver can verify that an answer really came from the domain owner and was not forged.

A configuration that routes traffic through two VPN servers in sequence, encrypting it twice and adding an extra layer of indirection between user and destination.

Dynamic IP: an IP address that can change because the ISP reassigns it from a pool. Most home and mobile connections use one; VPN exits are shared.

Passive interception of network traffic by a third party — the textbook attack a VPN is designed to defeat.

A modern family of asymmetric cryptography based on elliptic curves, offering equivalent security to RSA at much smaller key sizes.

Encrypted Client Hello (ECH) is a TLS extension that encrypts the first message of a connection, including the site name, hiding it from network observers.

The process of converting readable data into ciphertext that can only be returned to its original form by someone holding the correct key.

A model in which data is encrypted on the sender's device and decrypted only on the recipient's device, with no intermediary — including the service provider — able to read it.

Any device that initiates or terminates a VPN connection — the laptop, phone, server, router, or gateway at either end of the tunnel.

The ePrivacy Directive (2002/58/EC) is the EU law on confidentiality of electronic communications, best known as the source of cookie-consent rules.

The EU Geo-blocking Regulation (EU) 2018/302 bans unjustified discrimination against online shoppers based on nationality, residence or location in the EU.

The EU-US Data Privacy Framework, adopted by the European Commission on 10 July 2023, lets EU personal data flow to certified US companies.

An evil twin is a fake Wi-Fi hotspot set up with a name that mimics a real one, so nearby devices connect to the attacker instead.

The final server in a chain of relays — VPN, Tor, or multi-hop — through which traffic emerges onto the open internet, taking on that server's public IP.

A network security system that monitors traffic and applies rules to allow or block connections — the gatekeeper that VPNs are sometimes used to bypass.

The intelligence-sharing alliance of the United States, United Kingdom, Canada, Australia, and New Zealand — a frequent point of concern when choosing a VPN provider's jurisdiction.

An extended intelligence-sharing alliance built around Five Eyes plus nine additional European nations, often invoked when evaluating VPN jurisdiction risk.

The GDPR (General Data Protection Regulation) is the EU law, in force since 25 May 2018, on how organisations use personal data of people in the EU/EEA.

The practice of restricting access to online content based on the user's geographic location, typically inferred from their IP address — and a primary reason consumers buy VPNs.

Deliberately making your apparent location appear different from your real one, typically by routing traffic through a VPN server in another country.

China's national internet censorship system — the world's most sophisticated and aggressive deployment of DPI, IP blocking, DNS poisoning, and active probing against VPN traffic.

The initial exchange between a VPN client and server in which they authenticate each other, agree on cryptographic parameters, and derive a session key.

A one-way mathematical function that compresses arbitrary input into a fixed-size output, used in VPNs for integrity checks, key derivation, and authentication.

HMAC (hash-based message authentication code) combines a secret key with a hash like SHA-256 to prove data came from the key holder and wasn't altered.

The secure version of HTTP — web traffic encrypted with TLS — providing confidentiality and integrity between browser and website, complementary to but distinct from a VPN.

Internet Key Exchange version 2 — the protocol that establishes IPSec tunnels, widely used because of its strong native mobile-device support and rapid reconnection.

A browser feature that disables local history and cookie persistence — frequently misunderstood as providing online anonymity, which it does not.

The numerical identifier assigned to every device on a network, used to route traffic — and the single attribute a VPN most reliably hides.

IP geolocation is estimating a user's physical location from their IP address, using databases built from registry records, network data and user reports.

An IP leak is any situation where your real public IP address becomes visible to a website or peer even though you are connected to a VPN.

IP reputation is a score security and fraud systems give an IP address based on its history, such as spam, attacks or being a known VPN or data centre IP.

A suite of protocols that secures IP packets at the network layer through authentication and encryption — the foundation of many enterprise VPNs and mobile VPNs.

The fourth version of the Internet Protocol, the addressing scheme that powered the internet's growth — running out of addresses but still dominant on most networks.

The successor to IPv4, with a 128-bit address space large enough for trillions of trillions of devices — but a known cause of leaks in older VPN configurations.

A failure mode where a VPN protects only IPv4 traffic while IPv6 traffic continues to flow outside the tunnel, exposing the user's real IPv6 address.

The company that connects your home or device to the internet — and one of the primary parties whose visibility into your activity a VPN is designed to limit.

The country whose laws govern a VPN provider — a major factor in what data can be demanded from them and what they may be legally compelled to log.

An authentication protocol that uses a trusted third-party ticket-granting server to authenticate users without sending passwords across the network — common in enterprise VPN integrations.

The cryptographic process by which two parties securely agree on a shared secret over an insecure network — the heart of every VPN handshake.

A safety mechanism that blocks all network traffic if the VPN tunnel drops unexpectedly, preventing data from leaking onto the open internet.

Layer 2 Tunneling Protocol combined with IPSec — an older but widely supported VPN protocol, generally considered functional but not the modern best choice.

The delay between sending a request and receiving a response, measured in milliseconds — a key factor in VPN choice for gaming, video calls, and any real-time application.

Lawful interception is legally authorised monitoring of communications by telecom or internet providers for law enforcement or intelligence agencies.

Legitimate interest is a GDPR legal basis for using personal data without consent, if the organisation's interest isn't overridden by the person's rights.

Lightway is ExpressVPN's own VPN protocol, built on the wolfSSL library and designed for fast connections and quick reconnection on mobile devices.

Records that a VPN provider may keep about user activity — connection times, IP addresses, bandwidth used — and the central topic of every VPN privacy policy.

Any situation in which traffic, addresses, or identifying information escape the encrypted tunnel and become visible on the open network.

MAC address randomization gives your phone or laptop a different hardware address on each Wi-Fi network, so networks can't track it across locations.

An attack in which an adversary secretly relays and possibly alters communication between two parties who believe they are talking directly — the active counterpart to passive eavesdropping.

Information about a communication rather than its content — who, when, how long, how much — often as revealing as the content itself, and only partly hidden by a VPN.

ML-KEM is the post-quantum key-encapsulation standard NIST published in August 2024 as FIPS 203, based on the CRYSTALS-Kyber algorithm.

A VPN configuration that routes traffic through two or more servers in sequence, splitting trust across multiple jurisdictions or providers — sometimes called Double VPN.

The technique that lets many devices share a single public IP address — fundamental to how the internet runs out of IPv4 addresses, and a significant complication for VPNs and P2P.

The principle that ISPs should treat all internet traffic equally, regardless of source, destination, or content — the policy debate that drives much of the consumer interest in VPNs.

NIS2 is the EU cybersecurity directive (EU) 2022/2555 setting security and incident-reporting duties for essential and important organisations.

A no-logs audit is an independent review, usually by an accounting or security firm, of whether a VPN's systems match its claim not to log user activity.

A VPN provider's commitment not to record user activity — the central privacy promise of every modern consumer VPN, and the one most often tested by audits and subpoenas.

NordLynx is NordVPN's implementation of WireGuard, combined with a double NAT system so it doesn't have to store a fixed internal IP for each user.

VPN servers configured with obfuscation enabled, allowing users in restrictive networks to connect when ordinary VPN traffic is blocked.

Disguising VPN traffic to look like ordinary internet traffic, defeating networks and governments that block recognizable VPN protocols.

Oblivious DoH is an experimental protocol that sends encrypted DNS queries via a proxy, so no single server sees both who you are and what you looked up.

OpenConnect is an open-source VPN client (with the ocserv server) that speaks the TLS-based protocol used by Cisco AnyConnect and other enterprise VPNs.

A mature, open-source VPN protocol that uses TLS for key exchange and runs over UDP or TCP, the de-facto standard for VPNs throughout the 2010s.

A networking model where every participant is both client and server, enabling direct file sharing, decentralized communications, and many of the use cases that drive VPN adoption.

A property of secure protocols ensuring that a future compromise of long-term keys cannot decrypt past recorded sessions, because each session uses a fresh ephemeral key.

Under the GDPR, personal data is any information relating to an identified or identifiable living person, directly or indirectly.

A diagnostic tool that measures round-trip latency to a network host — and a useful metric for choosing the closest, fastest VPN server.

Poly1305 is a fast message authentication code (MAC) designed by Daniel J. Bernstein that proves a message has not been altered in transit.

A numbered communication endpoint on a device, used along with the IP address to direct incoming traffic to the right application.

A VPN feature that opens a specific public port on the VPN server and routes incoming traffic on it back to the user, enabling P2P seeding and inbound connections.

Cryptographic algorithms designed to resist attack by future large-scale quantum computers, increasingly being added to VPN and TLS protocols as a defense against 'harvest now, decrypt later' threats.

An obsolete VPN protocol from the late 1990s, fast and broadly compatible but cryptographically broken — listed here only because it still appears in legacy configurations.

Control over one's personal information — what is shared, with whom, and under what conditions. The fundamental motivation behind nearly every consumer VPN.

An intermediary server that forwards your requests to their destinations — similar to a VPN in some uses, but typically without encryption and operating at the application layer.

Cryptography that exploits quantum-mechanical phenomena — most notably Quantum Key Distribution — distinct from but often confused with post-quantum cryptography.

QUIC is a modern transport protocol that runs over UDP with TLS 1.3 encryption built in, and it underpins HTTP/3.

A VPN server that runs entirely from volatile memory with no writable disk, ensuring no user data can persist across reboots — a structural foundation for serious no-logs claims.

A VPN configuration in which individual users connect from anywhere to a centralized network — the workhorse of corporate work-from-home setups.

An IP address assigned by a consumer ISP to a home subscriber — far less likely to be blocked by streaming and anti-fraud systems than a data center IP.

Roam Like at Home is the EU rule letting mobile customers use calls, texts and data in other EU/EEA countries at domestic prices, extended until 2032.

A device that forwards data packets between networks — and, when configured with VPN client software, the simplest way to protect every device in a household at once.

The first widely deployed asymmetric encryption algorithm, named after its inventors Rivest, Shamir, and Adleman — still used in VPN certificates but increasingly displaced by elliptic curves.

A cloud-native architecture that combines networking and security functions — including VPN-like remote access — into a unified service delivered from the network edge.

The remote endpoint of a VPN connection — the machine that accepts your encrypted traffic, decrypts it, and forwards it to the public internet.

SHA-2 is a family of cryptographic hash functions published by NIST, including SHA-256 and SHA-512, that turn any input into a fixed-length fingerprint.

An encrypted SOCKS5 proxy designed in China specifically to bypass the Great Firewall — strictly speaking not a VPN, but widely used as one.

The default VPN configuration where many users connect through and exit from the same IP address — a privacy feature, since any single user's activity is mixed with everyone else's.

An authentication scheme that lets users log in once with a central identity provider and access many applications without re-authenticating — a common front end to enterprise VPNs.

A VPN configuration that joins two whole networks together with a permanent encrypted link, typically used to connect branch offices or corporate networks to cloud environments.

A geo-spoofing technique that redirects only the DNS lookups associated with geo-blocked services, leaving the rest of traffic unencrypted and at full speed.

SNI is a TLS extension in which the browser names the website it wants at the start of an HTTPS connection, so one server IP can host many sites.

A general-purpose proxy protocol that forwards arbitrary TCP and UDP traffic — sometimes offered by VPN providers as a lightweight alternative to a full tunnel.

A VPN feature that lets some traffic flow through the VPN tunnel while other traffic goes directly over the regular internet connection — useful for performance and accessing local resources.

The original protocol for secure web traffic, now obsolete and replaced by TLS — though the term 'SSL' persists colloquially in references to TLS-based products and SSL VPNs.

A VPN that uses TLS (often referred to as SSL) as its transport layer, typically running over standard HTTPS port 443 to traverse restrictive firewalls.

SSTP is a Microsoft VPN protocol that carries PPP traffic inside an HTTPS (TLS) connection on port 443, which helps it pass through restrictive firewalls.

An IP address that does not change over time — the opposite of a dynamic IP — and a VPN feature for users who need a stable inbound endpoint or whitelist-friendly address.

A marketing term for VPN configurations using obfuscation to hide that a VPN is in use — used to bypass aggressive censorship or VPN-blocking firewalls.

Watching video content over the internet — and one of the leading reasons individuals subscribe to consumer VPNs, to bypass geographic content restrictions.

A subdivision of an IP network, defined by a network address and a subnet mask — the basic building block of how networks are organized and routed.

The FADP is Switzerland's data protection law; its revised version came into force on 1 September 2023 and brought Swiss rules closer to the GDPR.

Encryption in which both parties use the same secret key to encrypt and decrypt — fast, simple, and used for the bulk of every VPN session's data.

A reliable, connection-oriented transport protocol that guarantees ordered delivery — a common but performance-suboptimal carrier for VPN traffic.

Intentional reduction of bandwidth by an ISP — often targeting specific protocols or services — and one of the practical wins of using a VPN.

The actual amount of data successfully delivered through a connection per unit of time — the practical performance metric, distinct from theoretical bandwidth.

The successor to SSL and the foundation of modern internet security — providing the encryption, authentication, and integrity that secure HTTPS, email, and many VPNs.

TLS 1.3 is the current version of Transport Layer Security, published in 2018 as RFC 8446, with a faster handshake and only forward-secret encryption.

A free, open anonymity network that routes traffic through three volunteer-operated relays with layered encryption, providing stronger anonymity than any VPN can offer alone.

A traffic correlation attack de-anonymises a user by matching the timing and volume of traffic entering a privacy network with traffic leaving it.

Encapsulating one network protocol inside another — the conceptual heart of every VPN, where original traffic is wrapped in encrypted packets for transit.

An authentication method requiring two distinct factors to log in — typically a password plus a code or physical token — strongly recommended for any VPN account.

A lightweight, connectionless transport protocol — the preferred carrier for modern VPN traffic because it avoids the TCP-over-TCP performance pathology.

An encrypted network connection between a device and a remote server, designed to provide privacy, security, and access to restricted resources over the public internet.

The software running on a user's device that initiates and maintains a VPN connection — the user-facing half of the VPN equation.

A device or service that terminates VPN connections at the edge of a network, accepting incoming tunnels and routing decrypted traffic to internal resources.

The set of rules and cryptographic methods that govern how a VPN client and server communicate — the fundamental design choice behind every VPN connection.

The remote machine that accepts VPN connections, decrypts incoming traffic, and forwards it onward to the public internet — the destination half of every VPN tunnel.

The encrypted channel between a VPN client and server through which all protected traffic flows — the actual mechanism that makes a VPN private.

A periodically updated public statement asserting that a service has not received any secret legal demands — its disappearance signals that something has changed.

A browser-level leak in which the WebRTC API exposes the user's real local and public IP addresses to JavaScript on web pages — even while a VPN is active.

A modern VPN protocol designed for simplicity, speed, and strong cryptography — increasingly the default choice for new VPN deployments.

The standard format for digital certificates used in TLS, VPNs, and most modern public-key infrastructure — the data structure that binds a public key to an identity.

A security model that abandons implicit trust based on network location and instead authenticates and authorizes every request individually — increasingly replacing traditional remote-access VPNs.