A VPN and a proxy both make websites see a different IP address than your own, but a VPN tunnels all of your device's traffic through an encrypted connection, while a proxy usually handles only one application's traffic and often does not encrypt it. Tor goes further by routing traffic through three separate relays so no single one knows both who you are and where you are going.
Which one you need depends on what you are trying to hide, and from whom. This guide explains how each changes your visible IP address, what it does and does not protect, and the leaks that can quietly undo it.
How websites see your IP address
Every TCP or UDP connection carries a source IP address. Without any intermediary, that is the public address your ISP assigned to your router, the one shown on the ToolsForAnyone homepage. A website, game server or mail server sees it on every connection and can map it to an approximate location and to your ISP.
VPNs, proxies and Tor all work the same basic way: your traffic goes first to an intermediary server, and that server opens the connection to the destination. The destination sees the intermediary's IP, not yours. The differences lie in how much traffic is redirected, whether it is encrypted, and who has to be trusted.
How a proxy works
A proxy is a server that makes requests on your behalf. Applications have to be configured to use it, either individually or through the operating system's proxy settings, which many but not all programs respect.
HTTP and HTTPS proxies
An HTTP proxy understands web requests. For plain http:// pages it receives the full request, so it can read, cache or modify everything. For https:// sites, the browser sends a CONNECT example.com:443 request and the proxy simply relays the encrypted TLS stream. The proxy then knows which host you visit but cannot read the pages.
SOCKS5 proxies
SOCKS5 (RFC 1928) works below the application layer and forwards arbitrary TCP connections, and optionally UDP. It is protocol-agnostic, which makes it useful for apps other than browsers, but it adds no encryption of its own.
Transparent and forwarding proxies
Some proxies are installed by networks rather than users, such as corporate web filters or school content filters. Many of them add headers like X-Forwarded-For: 203.0.113.50 or Forwarded: for=203.0.113.50 to pass your original IP to the destination. A proxy that does this hides nothing from the website. Proxies that strip such headers are often called anonymous proxies.
How a VPN works
A VPN client creates a virtual network interface on your device and changes the routing table so traffic goes into an encrypted tunnel to the VPN server. The server decrypts it and forwards it to the internet from its own IP address. Because routing happens in the operating system, every app is covered automatically, including games, mail clients and background updates.
Common VPN protocols are:
- WireGuard: a modern, compact protocol using UDP, with a fixed set of current cryptographic primitives.
- OpenVPN: a mature TLS-based protocol that can run over UDP or TCP, including TCP port 443, which helps on restrictive networks.
- IKEv2/IPsec: built into most operating systems and good at reconnecting when a phone switches between Wi-Fi and mobile data.
Most VPN apps use a full tunnel by default, sending everything through the VPN. Split tunnelling lets chosen apps or destinations bypass it, which is convenient but means those connections show your real IP.
How Tor differs
Tor wraps traffic in three layers of encryption and sends it through three volunteer-run relays: a guard, a middle relay and an exit. Each relay removes one layer and only knows the hop before and after it. The guard sees your IP but not your destination; the exit sees the destination but not your IP. Websites see the exit relay's address.
That design removes the need to trust a single provider, but it is noticeably slower, and the list of exit relays is public, so many sites block or challenge Tor users. Traffic between the exit and an unencrypted http:// site is readable by the exit operator.
Side-by-side comparison
| Proxy | VPN | Tor | |
|---|---|---|---|
| Traffic covered | Only apps configured to use it | All traffic on the device (unless split tunnelling) | Only apps using Tor, usually Tor Browser |
| Encryption to the intermediary | Usually none (HTTPS sites stay encrypted end to end) | Yes, for all tunnelled traffic | Yes, layered across three relays |
| IP seen by websites | Proxy server's IP | VPN server's IP | Exit relay's IP |
| Who can link you to your browsing | The proxy operator | The VPN provider | No single relay, by design |
| Speed | Fast | Fast to moderate | Slow |
| Typical use | Web scraping, testing geo-content, corporate filtering | Public Wi-Fi, privacy from your ISP, remote access | Strong anonymity, avoiding censorship |
What none of them hide
Changing your IP address hides only one identifier. Websites can still recognise you through:
- Accounts and cookies. If you sign in, the site knows who you are regardless of IP.
- Browser fingerprinting. Screen size, fonts, time zone and the user agent string together can be fairly distinctive.
- Time zone and language mismatches between your browser and the IP's apparent location.
For a broader look at the options, including mobile data and public Wi-Fi, see how to hide your IP address.
Leaks to watch for
A VPN or proxy can be working while your real IP or browsing still escapes by another route:
- DNS leaks: name lookups go to your ISP's resolver instead of through the tunnel, revealing which sites you visit.
- WebRTC leaks: the browser discovers your real public IP through STUN requests that bypass a browser proxy or split tunnel.
- IPv6 leaks: the VPN tunnels only IPv4, so IPv6-capable sites still see your ISP-assigned IPv6 address.
- Reconnect leaks: traffic flows normally for a few seconds when the VPN drops. A kill switch, which blocks traffic while the tunnel is down, prevents this.
Our guide to DNS and WebRTC leaks explains each in detail.
How to check that it is working
- With the VPN or proxy off, note your IP address and ISP on the homepage.
- Connect, reload the page, and confirm that both the IP and the ISP have changed.
- Run the WebRTC leak test. No candidate should show your original public IP.
- Run the IPv6 test. If it shows an IPv6 address from your own ISP, IPv6 is bypassing the tunnel.
Frequently asked questions
Is a proxy safer than a VPN?
Generally not. Most proxies do not encrypt traffic between you and the proxy, and they cover only configured apps. A proxy is fine for changing your apparent location in one browser, but a VPN is the better choice on untrusted networks.
Can I use a VPN and a proxy together?
Yes. Traffic leaves your device through the VPN tunnel, and the browser then talks to the proxy through it. Websites see the proxy's IP. This adds complexity and latency, and rarely adds much privacy.
Does incognito mode hide my IP address?
No. Private browsing only stops the browser from saving history and cookies locally. Websites and your ISP still see your real IP address.
Why do some websites block VPN and proxy IPs?
Many people share each VPN or proxy address, so it accumulates abuse reports, and services with regional licensing restrictions block known VPN ranges. IP databases flag these addresses as hosting or anonymiser networks.