Yes, with one precise caveat: a VPN doesn't hide your IP address, it replaces it.
Every site you open sees the VPN server's address instead of yours, and your internet provider sees one encrypted connection to that server instead of a list of the sites you visited. What nobody removes is the fact that an address exists: your provider still knows your real one, and the VPN operator now knows both. That trade is the whole product, and everything below is about where it holds and where it doesn't.
Three things are often confused with hiding your IP and aren't the same: your location, your identity, and your search history. They come apart differently, so they're worth separating before you rely on any of them.
address sites see ▇▇▇▇▇▇ swapped site names your ISP ▇▇▇▇▇ hidden approximate location ▇▇▇▇ follows IP browser fingerprint ▇ unchanged who you are ▁ unchanged
What a website sees with and without a VPN
Before the tunnel, a site sees the address your provider gave you. From it, commercial databases infer a rough location, usually the city or region of the network, often wrong by a lot, and the name of your provider. After the tunnel, the site sees the server's address and infers the server's city and its hosting company.
That is the whole mechanism. There's no step where the address disappears; there's a step where it's swapped. Confirm it yourself on what is my IP: the country and provider shown should be the server's, not yours.
| What a site can tell | Without VPN | With VPN |
|---|---|---|
| your IP address | yes | no, the server's |
| rough location | your region | the server's region |
| your provider | yes | the hosting company |
| your browser fingerprint | yes | yes, unchanged |
| accounts you log into | yes | yes, unchanged |
What a VPN doesn't hide
Your identity. The moment you sign in anywhere, the account is you regardless of the address it came from. A different IP doesn't make a logged-in session anonymous.
Your browser fingerprint. Screen size, fonts, time zone, graphics rendering and dozens of smaller signals form a profile that survives the address change entirely, and a mismatched time zone can even make you more distinctive. See browser fingerprinting and check yours with the privacy checker.
What you type in. Forms, payments, uploads: the tunnel protects them in transit and hands them over intact at the other end.
Your search history on your own account. If you're signed in to a search engine, it records the searches under your account. The provider stops seeing them; the search engine doesn't.
How your real IP leaks with a VPN on: DNS, WebRTC, IPv6
A tunnel that is up isn't the same as a tunnel that carries everything. Three common gaps let the real address out while the app still shows "connected".
- DNS. The name lookups go to your provider's resolver outside the tunnel. The provider keeps the full list of sites. How to check and fix: is my DNS leaking, which walks through the extended test on
dnsleaktest.comoripleak.net. - WebRTC. A browser feature for voice and video calls connects directly and can expose the real address to a page. Run the WebRTC leak test.
- IPv6. If your network hands out IPv6 and the tunnel only carries IPv4, half your traffic goes around it. Run the IPv6 leak test.
A fourth gap isn't a leak but a gap in time: the seconds between the tunnel dropping and reconnecting, when traffic falls back to the open network. That's what a kill switch is for. See what is a VPN kill switch.
| Check | Good result |
|---|---|
| IP address | server's country, not yours |
DNS leak test on dnsleaktest.com | resolvers in the server's country |
| WebRTC test | no real address shown |
| IPv6 test | no local IPv6 address |
Who still knows your real address
Your internet provider, always: the tunnel starts at your device and they carry it. They see that you connected to a VPN server, for how long, and how much data moved, just not what was inside.
And the VPN operator, by necessity: your real address on one side, the destinations on the other. This is why "does it hide my IP" is the wrong last question. The right one is who you'd rather have holding that knowledge, and what they write down. A provider that states clearly what is and isn't stored is checkable; a claim of "no logs" with no detail isn't. See what does no-logs VPN mean.
When hiding the address isn't enough
If the goal is for a specific site not to connect this visit to your previous ones, the address is one signal out of many: cookies, the account you're signed into, and the fingerprint usually matter more. If the goal is for nobody at all to link the traffic back to you, that is a different threat model with different tools, and a commercial VPN isn't it: see VPN vs Tor vs proxy.
If the goal is that your provider and the coffee shop Wi-Fi stop seeing which sites you open, that a VPN does well, and that is most people's actual reason.
Help me read my leak test results.
What I ran: (IP page / DNS leak test / WebRTC /
IPv6).
IP page shows: (country and provider).
My VPN server is in: (country).
DNS test shows: (what servers appear).
WebRTC shows: (an address or nothing).
Protocol: (WireGuard / VLESS / other).
Tell me which of these is a real leak and which is
normal, and what to change first. If a result means
the app is not doing what it claims, say so plainly.The short answer
A VPN replaces your IP address, and that holds as long as DNS, WebRTC and IPv6 go through the tunnel too. It doesn't hide who you are, it doesn't change your browser fingerprint, and it moves the knowledge of your real address from your provider to the VPN operator rather than erasing it. Anyone promising full anonymity from a tunnel alone is selling something else.
404 VPN runs on VLESS with Reality in its apps and also offers WireGuard configs for Istanbul and Marseille from the dashboard. Both resolve DNS inside the tunnel, the Android app has a kill switch, and the privacy policy lists what is and isn't stored. The builds available today are Android and macOS, with other platforms in progress: see the download page.
