VPN Glossary — A to Z Reference

AES-256 — Advanced Encryption Standard with 256-bit keys. The same encryption used by the US military. Industry-standard cipher for OpenVPN and IKEv2 connections.

reported (Independent) — A third-party security firm (provider materials, provider materials, public provider materials) reviews a VPN's code, infrastructure, or privacy claims. The strongest privacy signal a VPN can provide.

ChaCha20-Poly1305 — An encryption cipher used by WireGuard. Equally secure as AES-256 and faster on devices without hardware AES acceleration.

DNS Leak — When DNS queries leak around the VPN tunnel and reveal browsing destinations to the ISP. Test for it with our DNS Leak Test.

Double VPN (Multi-Hop) — Routing your traffic through two VPN servers in sequence for extra privacy. See double VPN guide.

Encryption — Mathematically scrambling data so only authorized parties can read it. See encryption guide.

Five Eyes — Intelligence-sharing alliance: US, UK, Canada, Australia, New Zealand. Some users prefer VPNs headquartered outside this alliance. See jurisdiction guide.

Fourteen Eyes — Five Eyes plus France, Germany, Italy, Spain, Belgium, Netherlands, Denmark, Norway, Sweden.

Handshake — The cryptographic exchange between your device and a VPN server that establishes the encrypted tunnel. Typically completes in under low latency with WireGuard.

IKEv2/IPSec — A VPN protocol particularly good for mobile devices because it handles network switching (Wi-Fi to cellular) seamlessly.

IP Address — The unique identifier assigned to your internet connection. A VPN replaces your real IP with the VPN server's IP. Check yours with our What Is My IP tool.

Jurisdiction — The country a VPN provider is legally based in, which determines what data-retention laws apply. See jurisdiction guide.

Kill Switch — A feature that blocks all internet traffic if the VPN connection drops, preventing IP leaks. See kill switch guide.

Lightway — ExpressVPN's proprietary protocol, documented in public provider materials. Built on wolfSSL with a lightweight codebase optimized for speed and battery efficiency.

Logs — Records a VPN provider keeps about your activity. A 'privacy' VPN doesn't store activity logs. See privacy guide.

Man-in-the-Middle (MITM) — An attack where someone intercepts and potentially modifies communication between two parties. VPN encryption defeats MITM attacks on hostile networks.

Multi-Hop — Same as Double VPN. Routing through multiple VPN servers in sequence.

NordLynx — NordVPN's proprietary protocol, built on top of WireGuard with a custom double-NAT system.

Privacy Policy — A VPN provider's promise not to store records of user activity. The strongest are publicly documented or publicly documented.

Obfuscation — Disguising VPN traffic as regular HTTPS traffic to work on networks that block VPN protocols. Useful in restrictive networks.

OpenVPN — A widely-used open-source VPN protocol. Slower than WireGuard but battle-tested with over 100,000 lines of reported code.

P2P (Peer-to-Peer) — File-sharing networks like BitTorrent. Some VPNs offer P2P-optimized servers. See torrenting guide.

Port Forwarding — Allowing incoming connections from the internet to reach your device through the VPN. Improves torrent speeds. Supported by Private Internet Access and ProtonVPN.

Protocol — The set of rules a VPN uses to encrypt and transmit data. Common protocols: WireGuard, OpenVPN, IKEv2, Lightway. See protocols guide.

RAM-Only Servers — VPN servers that store nothing on disk. All data wipes on every reboot, eliminating the possibility of long-term data retention.

Server — A computer operated by the VPN provider that you connect to. Your traffic exits to the open internet from this server's IP address.

Smart DNS — A feature that selectively routes only DNS queries through the VPN. Faster than full VPN but provides less privacy. ExpressVPN's MediaStreamer and NordVPN's SmartPlay are examples.

SOCKS5 Proxy — A proxy protocol that masks your IP without encrypting traffic. Faster than VPN but less private. Often bundled with VPN subscriptions.

Split Tunneling — Choosing which apps route through the VPN and which use the regular internet connection. See split tunneling guide.

Tor (The Onion Router) — A separate anonymity network that routes traffic through three random volunteer relays. Some VPNs offer 'Onion over VPN' for combined protection.

Tunnel — The encrypted connection between your device and the VPN server. All traffic flows through this tunnel.

WebRTC Leak — A browser feature that can reveal your real IP even when connected to a VPN. Test with our WebRTC Leak Test.

WireGuard — A modern VPN protocol with a minimal ~4,000-line codebase. Fast, secure, and the basis for NordLynx and most modern VPN apps. See protocols guide.