Guide

VPN vs proxy

Both change the address a site sees. What happens underneath is not the same.

They solve overlapping problems in different ways

From a website’s point of view a VPN and a proxy look similar: your traffic arrives from an address that is not yours. From your device’s point of view they are not alike at all, and the differences decide whether either one actually does what you wanted.

A proxy is a relay you configure in an application. The application sends its requests to the proxy, the proxy forwards them, and the response comes back the same way. Anything on your machine that was not configured to use the proxy — another browser, a system updater, a messaging client — continues to connect directly, and the proxy never learns about it.

A VPN is a virtual network interface. Once it is up, the operating system routes traffic through it by default, so applications need no configuration and cannot opt out by accident. Everything goes through the tunnel: DNS lookups, background traffic, applications that have no proxy setting at all.

That difference in scope is the one that matters most in practice. Most “my proxy is not working” problems are really traffic that was never routed through it.

Three approaches, side by side

Aspect	VPN	Proxy	Tor
Scope	Everything on the device or system	Only applications configured to use it	Applications routed through it, usually a browser
Encryption to the operator	Always	Only with HTTPS or SOCKS over TLS	Three layers, one per relay
DNS lookups	Carried through the tunnel	Often leak outside it	Resolved at the exit relay
Who sees your real address	The VPN provider	The proxy operator	The entry guard only
Who sees your destination	The VPN provider	The proxy operator	The exit relay only
Speed cost	Small — one extra hop	Small to none	Large — three relays, often intercontinental
Typical use	Privacy from the ISP, remote access, geo-restrictions	Scraping, caching, corporate filtering	Anonymity under genuine threat
Cost	Subscription	Free to expensive	Free

What each one actually protects

The useful question is not “which is more private” but “private from whom”. Every one of these tools removes one observer and adds another.

With no tunnel, your internet provider sees every destination you contact and, on unencrypted connections, the content. With a VPN, your provider sees only an encrypted stream to the VPN endpoint — and the VPN operator sees everything your provider used to. You have not eliminated the observer; you have chosen a different one, which is a real decision and only an improvement if you trust the new party more than the old one.

Tor is the exception that makes the trade-off differently. Traffic passes through three relays chosen by your client, and no single one knows both who you are and what you asked for: the entry guard sees your address but not your destination, the exit relay sees your destination but not your address, and the middle relay sees neither. That property is what genuine anonymity requires, and it costs a great deal of speed.

The DNS leak

The most common way a tunnel fails silently is DNS. If your browser is configured to use a proxy but your operating system still resolves names through your provider’s resolver, then your provider learns every site you visit even though the traffic itself goes elsewhere. A properly configured VPN carries DNS through the tunnel; a proxy frequently does not, and this has to be checked rather than assumed.

Why detection works at all

A website cannot see software running on your machine. What it can see is the address your traffic arrives from and the public registration data attached to it — and commercial operators register their ranges under their own names, because they have to.

That is the basis of every honest detection. If an address belongs to a network registered to a company that sells VPN service, the inference is strong. If it belongs to a hosting or cloud provider, the address is a datacenter address, which is a fact rather than an accusation. If it appears on the Tor Project’s published exit list, that is definitive. And if the request carries forwarding headers that your own infrastructure did not add, an intermediary announced itself.

None of these is perfect, and a tool that claims certainty is overstating what it can know. A corporate VPN terminating on the company’s own network looks exactly like an ordinary business connection, because that is what it is. Some residential ISPs announce home ranges from autonomous systems that also carry hosting customers. The right response is to show the evidence alongside the verdict so it can be judged rather than merely believed.

Why services treat these networks differently

Fraud and abuse concentrate on shared egress. An address used by thousands of unrelated people is worth more to an attacker than a residential address used by one household, so services that care about abuse weight it accordingly. That is why using a VPN produces more captchas, more login challenges, and occasionally a flat refusal to create an account — not because you did anything, but because the address you are borrowing has been used by others.

Choosing between them

If the goal is that your internet provider should not have a log of everywhere you go, a VPN from an operator you have reason to trust is the tool, and it needs to be carrying all your traffic to do the job.

If the goal is to make a specific application appear to come from somewhere else — testing a geo-restricted service, scraping within terms, working behind a corporate filter — a proxy is lighter and often sufficient.

If the goal is anonymity because being identified carries real consequences, neither is adequate, and Tor with its accompanying operational discipline is what the situation calls for.

In all three cases, verifying that the tunnel is actually carrying your traffic is worth more than any amount of configuration. A tunnel that has silently dropped looks identical from inside the client and completely different from outside.

Frequently asked questions

Is a VPN just a proxy with encryption?

That is close enough to be useful but hides the important difference. A proxy is configured per application and relays specific requests; a VPN is configured at the operating system level and carries everything, including DNS lookups, background updates and any application that has no proxy setting of its own. The encryption matters, but the scope matters more: traffic that never learns about your proxy will simply bypass it, whereas a VPN captures it by default.

Which one hides me from my internet provider?

A VPN, and only if it is carrying all your traffic. Your provider still sees that you are sending encrypted data to a VPN endpoint, and how much of it, but not what is inside. An HTTP proxy over a plain connection hides almost nothing from your provider — they can see every destination and, on unencrypted sites, the content. A HTTPS proxy hides content but still reveals which hosts you contact.

Does either make me anonymous?

No. Both move the point at which your traffic appears on the internet; neither makes you unidentifiable. Your provider is replaced as the party who can see your activity, not eliminated — the VPN or proxy operator can now see it instead. Browser fingerprinting, logins and cookies continue to identify you regardless. Tor is meaningfully different because no single relay knows both who you are and what you are requesting, at a substantial cost in speed.

Why do sites still block me when I use a VPN?

Because commercial VPN operators announce their address ranges under their own names, and those ranges carry an unusual concentration of traffic from many unrelated people. Services that fight fraud or abuse frequently treat them as higher risk, which is why you meet more captchas, more login challenges and occasionally an outright refusal. The block is on the network your traffic emerges from, not on you.

What is a residential proxy?

A proxy service that routes traffic through ordinary consumer connections rather than datacenter addresses, so it looks like an ordinary home user. The supply of those connections is the uncomfortable part: it usually comes from people who installed an application that quietly resells their bandwidth. They are widely used for scraping and for evading exactly the kind of detection described above, and they are the reason "is this a proxy" is a harder question than "is this a datacenter".

Can a website tell which one I am using?

Often, though never with certainty. VPN and proxy operators are identifiable from the public registration data attached to their address ranges. A proxy may also announce itself through headers such as Via or Forwarded that an intermediary adds. Tor is the most detectable of the three, because the Tor Project publishes a complete list of exit relays. None of these observes software on your device — they are inferences about the network your traffic emerges from.

Try it yourself

Everything above is easier to follow against a real answer.