Kovra"VPN or proxy" sounds like a question about two competing products. It is really a question about scope. A proxy changes the address one program presents to the internet. A VPN changes what the network underneath your device is allowed to know. Everything else that matters follows from that one difference.
What each one actually does to a packet
When your browser opens a site through a proxy, it asks the proxy to fetch the page on its behalf. The proxy makes the outbound connection, so the site logs the proxy's IP. Your packets still travel from your device to the proxy as ordinary traffic on the local network: the operator of that network sees a connection to the proxy, and with a plain HTTP proxy sees the destination hostname in clear text. Even with HTTPS, the TLS handshake and DNS lookups reveal which domains you are reaching.
With a VPN, the operating system creates a virtual interface and every packet from every application is encrypted and wrapped before it leaves. The local network sees one continuous encrypted stream to one address, with no hostnames, no DNS queries and no way to tell a video call from a download. Decryption happens at the VPN server, which then makes the request on your behalf.
Side by side
| Proxy | VPN | |
|---|---|---|
| Scope | Per application, usually the browser | Entire device, all apps |
| Encryption | None of its own (HTTPS still applies end-to-end) | Full tunnel encryption |
| What your ISP sees | Destination domains via DNS and TLS SNI | One encrypted connection, nothing else |
| DNS handling | Usually still your ISP's resolver | Resolved inside the tunnel |
| Leak surface | High: any app not configured bypasses it | Low, with kill switch and DNS forcing |
| Speed cost | Minimal | A few percent on modern devices |
| Typical use | IP rotation, scraping, geo-checks, one-off unblocks | Privacy, untrusted networks, censorship, torrenting |
| Setup | Per app, manual, easy to get wrong | Once per device |
The failure mode nobody mentions: partial coverage
A proxy configured in your browser does nothing for the updater running in the background, the messenger in your tray, the mail client, or the operating system's telemetry. This is not a theoretical gap. The most common way people are deanonymized while "using a proxy" is that a second application on the same machine reached the same service directly, from the real IP, at the same time. A VPN has no such split because the routing table sends everything through one interface.
The related trap is DNS. If your browser proxies traffic but the system still resolves names through your provider's resolver, every domain you visit is logged upstream regardless of the proxy. Our leak test guide walks through checking this in a couple of minutes.
Where a proxy is genuinely the right tool
- Automation and scraping where you need many different exit IPs, and the traffic is not sensitive.
- Checking geo-specific content — how a page renders in another country, what price a store shows.
- Per-application routing when the rest of the device must keep its normal connection: one game, one client, one test.
- Inside an existing tunnel, when a specific service needs a specific exit and everything else stays on the VPN.
The technical details of the most common variant are covered in the SOCKS5 versus VPN guide, and the ecosystem of "free" ones in what really happens on public proxy lists.
Where only a VPN will do
- Untrusted networks. Hotel, airport, conference and cafe Wi-Fi. See what a VPN actually prevents there.
- Hiding the domain list from your provider or employer. A proxy leaves that visible; a tunnel does not.
- Censored or filtered networks. Plain proxies are trivially blocked by port and IP. Camouflaged tunnels are the whole field of VLESS with Reality.
- Peer-to-peer traffic, where every peer in the swarm sees your address — see the torrenting guide.
What neither of them fixes
Both change the network path, not your identity. If you log into a personal account, the service knows exactly who you are no matter which IP the request came from. Browser fingerprinting, cookies and logged-in sessions survive every tunnel ever built. A VPN moves the trust boundary from your network operator to your VPN provider, which is why the provider's logging posture is the thing to verify — the method is in how to actually verify no-logs claims, and the payment side in the anonymity guide.
Choosing in one line
If the question is "which IP does this website see", a proxy answers it. If the question is "who can see what I am doing", only a VPN does. Most people asking about proxies are actually asking the second question.