VPN or proxy: how they differ and when each one is enough

A proxy is a server that applications hand their connections to. An HTTP proxy accepts a web request, or a request to open a connection to a named host and port, and makes the onward connection itself. A SOCKS proxy relays connections more generally, for any application written to use it. A web proxy page is a website that fetches other pages on your behalf and displays them inside its own.

In each case only the applications configured to use the proxy send traffic through it. Everything else on the device keeps its direct path.

A VPN works lower down, at the network layer. It adds a network interface to the operating system, and the routing table decides which packets go to it. Applications do not need to know that the interface exists: a route that covers every destination sends every application's traffic into the tunnel.

WrapVPN's configuration uses routes of that kind on every platform, so while it is connected, every application's traffic goes into the tunnel.

An HTTP or SOCKS proxy does not, by itself, encrypt the connection between your device and the proxy. Whoever can observe the local network, including its operator, can read which hosts you ask the proxy to reach, along with the full contents of any plain HTTP request and response.

Some setups wrap the proxy connection in encryption, for example a proxy reached over TLS.

Traffic to HTTPS sites stays encrypted end to end either way, unless the device has been set to trust a certificate from the proxy's operator, which lets the proxy decrypt it. Through an HTTP proxy, the browser asks the proxy to open a connection to the site and then negotiates TLS with the site directly, so the proxy relays encrypted data it cannot read.

A web proxy page is the exception. Your browser's encrypted connection ends at the proxy website, which fetches the destination itself, so the operator of that website can read everything on the page, including passwords typed into it and the cookies it receives.

A VPN encrypts every packet between the device and the exit server, whatever the application. WrapVPN's tunnel uses WireGuard, which our WireGuard guide describes. Beyond the exit server, traffic continues as it would from any connection: HTTPS stays encrypted to the destination and plain HTTP does not.

A connection to a named site begins with a name lookup, and the two tools handle it differently.

An HTTP proxy receives host names and resolves them itself, so the lookups for proxied web requests are normally made at the proxy. A SOCKS5 proxy can work either way: the application can pass the host name to the proxy, or resolve it locally and pass only the address, depending on its settings.

Local lookups cross the network in readable form unless the device encrypts them. A proxy can therefore leave a list of names visible on the local network even when the requests themselves go through it, and applications that do not use the proxy keep using the device's usual resolver, which is normally the one the network provides.

With WrapVPN connected, the app sets the DNS server for the tunnel and lookups travel inside it. With Clean Web on, they go to a filtering resolver on the exit server; with Clean Web off, they go to a public resolver, still through the tunnel.

Clean Web blocks by domain name only. It is on by default on Android and off by default on iPhone, iPad and Mac; on Windows, check the switch in the app. A browser that uses its own encrypted DNS (DNS over HTTPS) still sends those queries through the tunnel, but it bypasses Clean Web, because it does not ask the resolver the app set.

The gaps in a proxy's coverage come from the applications that are not pointed at it.

Desktop and mobile operating systems offer a proxy setting for the whole system or for each network connection, but each application decides whether to follow it. Applications with their own networking code may ignore it, and so may background services such as software updates, mail synchronisation and push notifications.

Traffic that is not web traffic, such as voice and video calls, online games and mail sent over its own protocols, often does not pass through an HTTP proxy at all. A proxy set in one browser does not cover a second browser on the same device, and real-time features inside a browser can open UDP connections that an HTTP proxy does not carry.

On a phone, a proxy configured for a Wi-Fi network applies to that network only. It stops applying when the phone moves to mobile data or joins another network.

A VPN takes those decisions away from the applications. While the tunnel is up, the routing table sends every application's packets into it, and on iPhone, iPad and Android a move between Wi-Fi and mobile data does not end WrapVPN's tunnel.

The tunnel has gaps of its own, and they fall in time rather than in applications. Before you connect, during a pause and after you disconnect, traffic leaves outside the tunnel. On iPhone, iPad and Mac, a connection opened before the tunnel came up can also stay outside it until that connection ends. WrapVPN has no kill-switch setting. On Windows, firewall rules block traffic outside the tunnel while it is connected; they lift when you disconnect or pause, and briefly while the app changes server location.

In both cases the destination sees the intermediary's address: the proxy's, or the exit server's. A website places you wherever its geolocation database places that address, and different databases can disagree about the same address.

Every user connected to a WrapVPN exit shares its IPv4 address, so the address a site records is not yours alone. A proxy's address may be shared in the same way, or used by you alone, depending on who runs it and how.

A proxy that handles plain HTTP can also add headers to each request, and some proxies add one that carries your own address. Inside an HTTPS connection that it relays without decrypting, a proxy can neither read nor add headers.

Neither tool changes what a site learns from a signed-in account, from cookies or from the browser itself. Our guide to who can see what covers those limits.

An intermediary that forwards your traffic takes the position your internet provider holds without one. It sees which hosts you contact, when and how much data moves, and it can read anything that is not encrypted end to end.

With a proxy, that party is whoever runs the proxy. Lists of free proxies circulate openly, and an entry on such a list does not say who operates the server or what it keeps.

With WrapVPN, that party is our exit server. Each connection and each disconnection is logged with the account, the time, the exit server and the session's length. Each exit server also reports an hourly summary per tunnel address, listing the data transferred, the external addresses reached over TCP and the domain names associated with them, and that summary can be linked to the account. The rest is set out in our privacy policy.

A VPN moves your provider's view of your destinations to the exit server, for the whole device. A proxy gives the same view to its operator for the applications it serves, and unless the connection to the proxy is encrypted, your provider keeps that view as well.

A proxy carries only the traffic sent to it, so the rest of the device keeps its direct path and its usual speed. The proxied traffic takes a detour through the proxy, and the detour adds delay that grows with the extra distance, as a VPN's detour does.

A VPN sends everything through the exit server and adds a small header to every packet. On current devices the encryption itself costs little; the distance to the exit server and the capacity it shares among its users matter more.

A proxy is enough when the stakes are low and the scope is one application: reading public pages in one browser, checking how a public site appears from another country, or meeting a proxy requirement on an organisation's network.

A VPN is the better tool when the whole device needs covering, when the network itself is untrusted, such as hotel or café Wi-Fi, when you cannot configure the applications involved, or when name lookups should stay off the local network.

WrapVPN is a VPN app in this sense, on iPhone, iPad, Mac, Android and Windows, and the apps have no proxy setting. It does not offer per-app routing (split tunnelling) on any platform, so it cannot send one browser through the tunnel and leave the rest of the device outside. If only one application needs rerouting, a proxy is the tool for that, and WrapVPN is not.

The weekly plan is $1.99 and the monthly plan is $3.99. Both are bought in the App Store or Google Play and renew until you cancel them in the store's subscription settings. The free plan gives each account three one-hour sessions a week, with every server location and no device limit.