What a VPN Cannot Do

Definition: a virtual private network in consumer use is software that encrypts traffic between your device and a remote server, then exits to the internet from that server's address.

That gives you two concrete effects. Local observers (cafe WiFi, hotel LAN, a nosy ISP) have a harder time reading content and seeing destinations. Remote sites see a VPN IP, not your home or mobile IP, unless something leaks.

It does not give you a new legal identity. It does not inspect every website for scams. It does not copy your photos to a safe place. It does not type your one-time codes. If you keep those jobs assigned to the VPN in your head, the rest of this article will feel like nitpicking. It is not nitpicking. It is the support queue.

Klox apps also include practical extras — kill switch, leak-minded defaults — because the tunnel can drop. Those extras still live at the network layer. They do not live in your inbox, your disk, or your bank's login page.

Definition: anonymity means other parties cannot reasonably tie an action to you. A consumer VPN does not provide that.

You log into email. You pay with a card. You carry a phone that pings towers. You use a browser with cookies. The VPN hid the cafe's view of your packets. It did not hide you from Google if you are in Gmail. It did not hide you from your employer if you use SSO. It did not hide you from a site that already has your account.

Even "logged out," browsers leak uniqueness. Fonts, screen size, extensions. That fingerprint can follow you across IPs. We wrote a whole article on tracking limits. The short version: IP is one signal. It is not the only signal. Masking it is useful. It is not a witness protection program.

If you need stronger anonymity, you are in Tor-and-discipline territory, with speed and convenience costs most people will not pay. That is fine. Most people needed a tunnel, not a new identity. Buy the tunnel for the tunnel. Do not buy it for a fantasy.

Definition: phishing is a scam that tricks you into handing over secrets or installing a payload, usually via a message and a fake site or attachment.

The tunnel carries whatever you send. If you type your bank password into a lookalike domain, the VPN encrypts that mistake on the way out. Encrypted mistakes still arrive. The fake site still gets the password. Your IP being a Klox IP does not make the password fake.

Phishing also happens inside real sites: fake job chats, fake shipping SMS, fake "IT support" that wants Remote Desktop. None of those are solved by WireGuard. They are solved by slowing down, checking domains, not installing random remote-access tools, and using 2FA so a stolen password is not enough.

I get why people want one gadget to end fear. Email filters, browser warnings, and password managers do more against phishing than a VPN. Keep the VPN for the cafe. Keep your brain for the inbox.

Definition: a backup is a copy of data you can restore after deletion, ransomware, theft, or a dead disk.

A VPN moves packets. It does not snapshot your laptop. If ransomware encrypts the disk, the tunnel will still be happy to carry the extortion note. If you drop the machine in a river, WireGuard will not swim.

People mix this up because "VPN" and "cloud" sit next to each other in blog posts. Sync folders are not backups if the ransomware syncs too. Versioned backups, preferably one copy that is not always connected, are backups. That is a different product. Buy it. Test a restore once. You will not test it. Please test it.

Travelers use VPNs on untrusted WiFi and then never back up the camera roll. The risk they feel is the cafe. The risk that ruins the month is the stolen bag. Encrypt the cafe. Also duplicate the photos.

Definition: 2FA means a login needs a second factor besides the password — a code, a prompt, a passkey, a hardware key.

The VPN does not sit in that login. Attackers with your password still get in if 2FA is off, whether your IP is home or a VPN exit. Attackers who phish the password and the SMS code still get in too, which is why app-based 2FA or passkeys beat SMS. None of that is configured in the Klox app. It is configured at Google, at your bank, at your registrar.

I treat 2FA as more important than a VPN for account theft. I treat a VPN as more important than 2FA for cafe snooping. Different layers. Stack them. Do not pick a favorite child and starve the other.

If a site locks you out from a VPN IP, that is annoying. Add a trusted device, use a nearby server, or pause the VPN for that login. Do not disable 2FA to make a site "like you more." That trade is backwards.

Malware can ride inside the tunnel like anything else. Some networks even use VPNs to look less like malware to the cafe. The protocol does not care. WireGuard is a truck. It will haul groceries or it will haul a bad installer.

OS updates, browser updates, not sideloading random APKs, and a basic endpoint tool on Windows still matter. A kill switch blocks traffic when the tunnel dies. It does not scan attachments. Different buttons.

Mobile users think they are safer because "it's an app store." Stalkerware and bad profiles exist. A VPN on a compromised phone encrypts the stalker's telemetry too. If you suspect the device is not yours in spirit anymore, fix the device. Do not add a hop and call it clean.

Definition: account-based identity is everything the service knows because you authenticated — user ID, device, payment, history.

You can change IPs every hour and still be "you" in the session cookie. Shopping, social, streaming, school portals. They personalize. They log. The VPN IP might even look weirder to their fraud team than your home IP. Captchas are not a personal attack. They are a bored risk engine.

If your goal is "this site should not have my home address via IP," the VPN helps. If your goal is "this site should not know I exist," log out, stop using the account, and accept that is a bigger life change than a $2.83/month plan.

Cross-device linking is worse. Same account on phone and laptop, five devices on one Klox plan, all happily logged into the same streaming profile. The VPN did its job on each hop. The profile still merged the story.

If your password is already in a dump, the attacker logs in from their house. Your cafe tunnel is irrelevant. Change the password. Revoke sessions. Turn on 2FA. Check forwarding rules in email. That is the incident. Installing a VPN after the fact is fine for the next cafe. It is not containment.

Credential stuffing does not care about your WireGuard handshake. It cares that you reused the password. Unique passwords are the control. I would rather you skipped a VPN for a week than reused the same password for a year. I would rather you did neither skip.

Have I Been Pwned exists. Use it. A VPN homepage that never mentions password reuse is selling a layer while the house is on fire. We will mention it. It is not off-mission. It is the mission adjacent to the one we are paid for.

Untrusted networks. Hotels, airports, conference WiFi, guest houses. Encrypt the path. Hide your IP from the local network. Use a kill switch so a drop does not dump you onto the raw cafe.

Less ISP visibility into destinations, especially on networks that log or throttle by site. They still see volume and that you use a VPN. They see less of the rest.

A less public IP toward random sites that did not need your home address. Not anonymity. Just less map-pin accuracy for the bored advertising IP database.

A consistent way to run the same policy on five family devices. That is operational hygiene. It is not a superpower. It is how you stop arguing about who forgot to connect on the tablet.

OpenVPN when a network hates UDP. WireGuard when you want the lighter hop. Choice is practical. It is not a personality.

If those jobs match what you wanted, a paid app from a company that states limits is a reasonable purchase. Klox is that kind of purchase: from $2.83/month yearly, five devices, 7-day money-back. If those jobs do not match, keep your money. I mean that.

Layer 1: patch the OS and browser. Layer 2: password manager and 2FA. Layer 3: backups you have restored once. Layer 4: VPN on untrusted networks and whenever you want the IP masked. Layer 5: browser tracking controls if that is your anxiety. Layer 6: judgment, which does not ship in an APK.

If you only buy layer 4, you bought a good hop and left the doors open. If you buy everything except layer 4, you are still naked on hotel WiFi. I use both sentences depending on who is arguing.

Teach family members the phishing bit before you teach them WireGuard vs OpenVPN. They will not remember the protocol. They might remember "we do not type passwords from SMS links." That memory is worth more than a city list.

Klox will keep saying what the product is. Other brands will keep implying a cloak. You can open their homepages. You can also open ours, download the app, and use the 7-day window as a test of the hop — not as a test of invisibility. Invisibility will fail the test. The hop might pass.