Glossary

44 terms, each with the part most explanations leave out. Every entry answers why the term should change what you buy, not only what it means.

A

Ad-blocking DNS

A resolver run by the VPN provider that refuses to answer lookups for known advertising and tracking domains.

AES-256

A symmetric encryption cipher with a 256-bit key, standard in OpenVPN and IKEv2 configurations.

Always-on VPN

An operating-system-level setting that prevents any traffic leaving the device unless the tunnel is up.

Anonymous signup

Creating an account without providing an email address, name or other identifying detail.

D

Dedicated IP

A VPN address assigned to you alone rather than shared with other subscribers.

Deep packet inspection

Network equipment that examines the structure of traffic rather than only its destination address.

DNS leak

When name lookups travel to your ISP’s resolver instead of through the tunnel, exposing every domain you visit.

F

Fourteen Eyes

A set of intelligence-sharing arrangements between allied states, expanding from the original five to fourteen participants.

Free VPN

A VPN offered at no cost, funded either by a paid tier or by something else.

G

Geo-blocking

Restricting access to content based on the country your address appears to be in.

I

Independent audit

An examination of a provider’s systems or policy by an external firm, published with the firm’s name, the date, and the scope.

IP address

The numeric address identifying your connection on the internet, visible to every site you contact.

IPv6 leak

When a tunnel carries only IPv4 while your connection also has IPv6, so IPv6-capable sites see your real address.

ISP logging

The records your internet provider keeps of which addresses and domains your connection contacted.

J

Jurisdiction

The country whose law governs the company operating the VPN, which determines who can compel it and by what process.

K

Kill switch

A control that blocks all internet traffic if the VPN tunnel drops, rather than letting it fall back to your normal connection.

M

Multi-hop

Routing traffic through two VPN servers in sequence, usually in different countries.

N

NAT

Sharing one public address between many devices, which is how commercial VPN servers put hundreds of users behind a single IP.

No-logs policy

A provider’s commitment not to record which sites you visit, when you connected, or what address you connected from.

NordLynx

NordVPN’s implementation of WireGuard with an added double-NAT layer intended to avoid storing user IP addresses on the server.

O

Obfuscation

Disguising VPN traffic so it resembles ordinary encrypted web traffic to a system inspecting the connection.

Open-source client

A VPN application whose source code is published, so anyone can inspect what it does.

OpenVPN

The long-established open-source VPN protocol, slower than WireGuard but more configurable and more widely supported.

P

Perfect forward secrecy

Generating a new session key for each connection, so a future key compromise cannot decrypt past recorded traffic.

Port forwarding

Allowing inbound connections to reach your device through the VPN, rather than only outbound connections.

R

RAM-only server

A server that runs entirely from volatile memory, so a reboot or a seizure leaves nothing behind on disk.

Refund window

The period during which a subscription can be cancelled for a full or partial refund.

Renewal pricing

The price charged when an introductory multi-year term ends and the subscription auto-renews.

Router VPN

Running the VPN client on your router so every device on the network is covered without individual installation.

S

Server count

The number of servers a provider advertises, typically in the thousands.

Server seizure

Physical confiscation of a VPN server by authorities, usually at the datacentre rather than from the provider.

Shared IP

A VPN address used simultaneously by many subscribers.

Simultaneous connections

How many devices can use one subscription at the same time.

Smart DNS

A service that redirects only the DNS lookups used for region detection, without encrypting your traffic.

SNI

The field in a TLS handshake that names the site being requested, historically sent unencrypted even over HTTPS.

Split tunnelling

Routing some applications or destinations through the VPN while leaving others on your ordinary connection.

T

Throughput retention

The share of your unencrypted line speed that survives once the VPN is connected, expressed as a percentage.

Tor over VPN

Connecting to the Tor network through a VPN tunnel, so your ISP sees a VPN connection rather than Tor usage.

V

Virtual server location

A server advertised as being in one country while the hardware physically sits in another.

VPN detection

Techniques services use to identify and block traffic arriving from known VPN infrastructure.

VPN protocol

The set of rules governing how the tunnel is established and how data is encrypted inside it.