A VPN sends your traffic through an encrypted tunnel to a remote server. For traffic routed through the tunnel, the visible public IP is normally a VPN exit address instead of your ISP-facing address. That swap is the main privacy move. It is also easy to misunderstand.
This post is only about what changes on the exit identity others see. It is not a product review and it does not sell a VPN.
Check the before/after yourself on What Is My IP. For the provider label on the address you present, use ISP Lookup.
Visible IP vs the rest of your identity
Your visible IP is the source address remote servers log for a connection. On home Wi‑Fi without a VPN, that is usually your ISP's public IPv4 (or IPv6). With a VPN on and working, it is usually the VPN exit IP.
That label is separate from:
- Accounts you are logged into (Google, bank, social)
- Browser cookies and fingerprints
- Files and apps already on your device
- Your ISP still seeing that a VPN tunnel is active from your line
A changed IP shows a different source for the tested request. Accounts, cookies and traffic outside the tunnel need separate consideration.
For the broader "what does an IP reveal" picture, start with what your IP address reveals. This article zooms in on the VPN toggle alone.
What usually changes when the VPN is on
1. The public address itself. Reload What Is My IP with the VPN connected. If the address differs from your baseline on the same network, this request reached the site with a different source. A network change or different address family can also change the result, so keep the comparison conditions consistent. If it does not change, the VPN may be off, split-tunneling that browser, or failing quietly.
2. The ISP / organization label. ISP Lookup reads who owns the public address you show. Off VPN, that is often your cable or mobile carrier. On VPN, it is often a hosting company, a VPN brand's ASN, or a cloud provider. That shift is normal. It is also why some sites treat VPN exits differently from residential lines.
3. Coarse location tags. Geo-IP databases map address blocks to cities or countries. A London exit can make sites assume UK; a US exit can flip currency or content rules. Treat those pins as approximate — useful for region, unreliable as a street address.
4. Reputation and "hosting / VPN" signals. Many fraud and bot filters flag data-center and known VPN ranges. You may see more CAPTCHAs, stricter login checks, or a blocked stream region. That is a side effect of the same exit swap, not proof someone "hacked" your home IP.
5. Different destinations can see different results. IPv4 and IPv6 have different addresses, split tunneling can exclude apps, and providers may use multiple exits. A difference between two sites is a reason to inspect routing and provider behavior, not proof of a leak by itself.
What a VPN does not change
Your ISP still sees a customer session. They may not see the final websites inside a working tunnel, but they still see a VPN connection, timing, and volume. A VPN relocates trust to the provider; it does not erase the ISP relationship. Read what remains visible to your ISP for the HTTPS, DNS and VPN distinctions.
Logged-in accounts still know you. Turning on a VPN does not log you out of email or social apps. Those services already have your account — the IP is extra context, not the whole identity.
Malware and phishing still work. A clean exit IP does not sanitize bad links or infected software.
Inbound home access is a different problem. A consumer VPN client is outbound. It does not magically give you a unique reachable home IPv4 for port forwards. If you are on CGNAT, see what is CGNAT — VPN-on does not fix that inbound gap.
DNS and WebRTC require separate checks. A DNS query can use a resolver outside the tunnel, and WebRTC may expose connection information beyond an ordinary HTTP request. RFC 8828 explains the browser-specific tradeoffs. FindMyIP’s homepage and ISP Lookup do not test WebRTC, DNS leaks, both address families or kill-switch behavior. DNS Lookup reads a domain’s public records through this site’s server; it does not reveal which resolver your browser uses.
A simple verify loop (two minutes)
- Baseline. VPN off. Open What Is My IP. Note the address. Optionally open ISP Lookup and note the provider name.
- Connect. Turn the VPN on. Pick one server. Wait until the client says connected.
- Recheck. Reload FindMyIP and compare the address and family with your baseline. Record any warning instead of treating missing data as a successful check.
- Provider check. Run ISP Lookup again. Expect a different org than your home ISP in most cases.
- Spot-check another destination. Compare its reported address and family. A location label alone is not a routing test, and different address families or provider exits can legitimately differ.
If you expected a different exit but the result is unchanged, inspect the client and routing before drawing a conclusion. Common causes: VPN not actually connected, browser on a different interface, or kill-switch/split-tunnel rules excluding that app.
What this comparison establishes
| Observation | Interpretation | Separate checks still needed |
|---|---|---|
| Different IP after connecting on the same network | This request used a different source address | Other apps, IPv4/IPv6, DNS and WebRTC routing |
| Provider label changes | The database associates the new address with another network | Provider identity, logging practices and security |
| IP lookup fails or returns a warning | The check is incomplete | Retry and distinguish tool failure from connection failure |
These are interpretation examples, not measurements of a particular VPN. If performance changes, you can compare a short browser-to-site speed test. Keep conditions similar; this limited test measures transfers to FindMyIP and HTTP latency, not a VPN’s overall speed ranking.
When the IP changes but privacy barely moves
- Same exit shared by thousands. Sites see a busy VPN IP, not "your" unique home line — good for blending in; sometimes bad for reputation filters.
- You keep logging into the same accounts. Cross-site identity still sticks via login and cookies.
- You only VPN on public Wi‑Fi and forget at home. Your baseline residential IP remains the everyday label.
- You chase "residential" exits without reading the policy. Marketing labels vary. Judge by logging policy and whether the exit actually changes what FindMyIP shows — not by slogans.
Practical takeaways
- Use the VPN when you care who sees the network label: hostile Wi‑Fi, region tests, less ISP-path visibility to destinations.
- Verify with What Is My IP every time you change servers or networks.
- Use ISP Lookup to interpret the registered network associated with the visible address; the name is not a VPN safety verdict.
- Keep expectations honest: exit IP swap ≠ full anonymity, and it ≠ a fix for hosting services on a CGNAT home line.
Use the result for the question it answers
A working VPN changes the visible public IP — the address, its ISP/org label, and often the geo and reputation tags sites apply. It does not rewrite accounts, remove malware, or turn a shared home line into a unique inbound IP. Compare the observed request with your baseline, and investigate untested paths separately. Neither a client icon nor one changed IP proves complete protection.