History of VPN: What VPN Stands For, and How It Got Here (1995 to 2026)

VPN stands for virtual private network, and the history of VPN explains why those three words fit. The idea began in the mid-1990s as a cheaper way for companies to link offices and let staff dial in, without renting private lines. Microsoft and its partners submitted the PPTP tunnelling protocol to the internet's standards body in June 1996; IPsec, OpenVPN and finally WireGuard, which joined the Linux kernel in March 2020, followed. Somewhere along the way the same name moved from the server room to the app store.

In plain English: a virtual private network is a private link built on top of a shared, public one. Companies used it to stitch offices together; today most people use the same idea to shield their own connection.

Most pages that answer this question stop at the expansion of the acronym. This one keeps going: what each word means, the dates the technology was written down, and how a corporate networking tool became a consumer privacy product. Every date below comes from the standards documents, vendor histories or project announcements themselves.

What does VPN stand for? The one-line answer

VPN is short for virtual private network. People sometimes write it as "virtual personal network" or "virtual public network", but neither is correct; the IETF's standards documents and Microsoft's own early PPTP documentation both use virtual private network. As a noun it usually means the connection itself ("connect to the VPN"), and in everyday speech it has also come to mean the app or subscription that provides one ("which VPN do you use?").

What VPN means in practice has shifted more than the words have. In 1999 it meant a remote office joining headquarters over the internet. In 2026 it usually means an app on your phone that encrypts your traffic to a server run by a VPN company. Both are virtual private networks; they just protect different things for different people. Our guide to what a VPN is covers the modern meaning in full.

Each word, explained

The clearest early definition comes from the Internet Engineering Task Force. RFC 2764, published in February 2000, defines a VPN simply as the "emulation of a private Wide Area Network (WAN) facility using IP facilities", including the public internet. Read that against each word and the name makes sense.

Virtual means the network is simulated rather than physical. Before VPNs, a company that wanted two offices on one network rented a leased line or a dedicated circuit, such as Frame Relay or ATM, as RFC 2764 describes. A VPN builds the same link out of software, carrying the company's traffic inside packets that cross ordinary shared infrastructure.

Private means the network belongs to its users, not to everyone else on the wire. In practice that means two things: only authorised devices can join, and the traffic is encrypted so anyone watching the shared network in between sees scrambled packets. The early protocols were not always good at the second part, as the PPTP story below shows.

Network means it connects things: a laptop to an office, an office to an office, or, in the consumer version, your phone to a VPN company's server, from which your traffic continues to the wider internet. The mechanism that makes this work, wrapping one packet inside another, is what we mean by a VPN tunnel.

A short history of VPN, from 1995 to 2026

RFC 2764 itself admits that people used the internet for private communications before VPNs had standard tools; what changed in the late 1990s was that the necessary IP mechanisms finally came together. The timeline below picks out the milestones that shaped the VPNs people use now.

1995 to 1998: IPsec is written down

IPsec, a set of rules for authenticating and encrypting traffic at the IP layer, was first described as an architecture in RFC 1825 in August 1995. RFC 2401 replaced it in November 1998, and RFC 4301 replaced that in December 2005. IPsec became the backbone of office-to-office VPNs, and it still underpins the IKEv2 connections many phones use today.

1996 to 1999: PPTP and L2TP bring tunnels to Windows

The protocol that put VPNs on ordinary desktops was PPTP, the Point-to-Point Tunneling Protocol. Microsoft's own documentation says a draft was submitted to the IETF in June 1996 by the companies of the PPTP Forum, which included Microsoft, Ascend Communications, 3Com/Primary Access, ECI Telematics and US Robotics, and the protocol shipped with Windows NT 4.0. It let a remote worker dial an internet provider and then open a second, tunnelled connection to the office.

PPTP was published as RFC 2637 in July 1999, and an IETF note on it says plainly that it was developed by a vendor consortium. That is why there is no single inventor of the VPN: the RFC lists six authors from five companies. The IETF's own answer, L2TP, appeared as RFC 2661 in August 1999. L2TP carries traffic but does not encrypt it, so RFC 3193 in November 2001 set out how to secure it with IPsec, the L2TP/IPsec pairing that still appears in network settings menus.

2001 and 2002: OpenVPN

OpenVPN, written by James Yonan, had its first private release in 2001 and its first official public release in 2002, according to the project's own history. It took a different route from IPsec, running as ordinary software that uses TLS to set up its keys, which made it easy to install on almost any system. Its registered port, 1194, is still assigned to Yonan in the official IANA registry. It went on to become one of the most widely offered protocols in consumer VPN apps.

2005 to 2014: IKEv2 matures

IKEv2, the key-exchange protocol paired with IPsec, was published as RFC 4306 in December 2005. A mobility extension called MOBIKE followed in June 2006 as RFC 4555, letting a connection carry on when a phone hops between Wi-Fi and a cellular network, which is why IKEv2 became common on phones. The current version, RFC 7296, became a full Internet Standard in October 2014.

2012 to 2016: PPTP is retired

The first widely used VPN protocol aged badly. On 20 August 2012 Microsoft published a security advisory warning that exploit code for weaknesses in MS-CHAP v2, the login method PPTP commonly relies on, was public, and that an attacker who captured the handshake could recover credentials. Apple removed PPTP from VPN profiles in iOS 10 and macOS Sierra, released in September 2016. Windows still lists PPTP among its built-in VPN types, but no one should use it for anything private.

The consumer turn: from office tool to privacy app

Through the 2010s the same technology found a second audience. Subscription services began selling access to their own servers so that individuals could encrypt their traffic on public Wi-Fi, hide their browsing from their internet provider, or appear to be in another country. The core idea was unchanged; the difference was who ran the far end of the tunnel. In a corporate VPN it is your employer. In a consumer VPN it is a company you pay, which means you are trusting that company with everything your provider used to see.

That trust question shaped the industry's next decade. Free services showed the risk: starting in late 2014, Hola resold the bandwidth of people running its free app to paying customers, through an offshoot called Luminati that has traded as Bright Data since 2021. Paid providers answered with outside checks. NordVPN's first no-logs audit, by PwC, came in 2018, and audits by named firms have since become the evidence that matters; our explainer on what no-logs means covers how to read them. Server seizures pushed the same way: after two Windscribe servers seized in Ukraine in 2021 turned out to hold an unencrypted OpenVPN key, Windscribe pledged to move to RAM-only servers, and Mullvad finished moving its whole fleet to diskless servers in September 2023.

2020 onward: WireGuard and after

The newest chapter starts with WireGuard, a deliberately small protocol whose Linux implementation runs to under 4,000 lines of code, according to its whitepaper. WireGuard 1.0.0 arrived with the Linux 5.6 kernel on 29 March 2020, making it part of mainline Linux. Several large providers now build their default protocol on it, NordVPN's NordLynx among them. OpenVPN responded with version 2.6.0 in January 2023, which can move the handling of data packets into the kernel for speed. And in January 2026 Mullvad switched off OpenVPN entirely, client and server, leaving WireGuard as its only protocol: a sign of how far the balance has tipped in six years.

Corporate VPN vs consumer VPN: same name, different job

The two kinds of VPN share a protocol family and a name, which is why the term confuses people. The table sets them side by side.

Corporate VPNs are changing too. With FortiOS 7.6.3, Fortinet dropped SSL VPN tunnel mode in favour of IPsec across all FortiGate models, which forced its business customers to move remote users over before they could upgrade. The practical rule for workers is simple: use your employer's VPN for work, and do not run personal browsing through it, because your employer is the one who can see that traffic.

Related terms people confuse with a VPN

Three other tools sit close to VPNs and are often mixed up with them, partly because some products bundle them together.

• Proxy: relays the traffic of one app or browser through another server, usually without encrypting everything your device sends. Our page on VPN vs proxy explains where the two overlap.
• Tor: a free network that sends your traffic through several volunteer-run relays, so no single relay knows both who you are and where you are going. It is slower than a VPN and built for anonymity rather than convenience.
• Smart DNS: reroutes the DNS lookups for chosen services through the Smart DNS provider's servers, without encrypting anything. It can change what a streaming catalogue shows you, but it gives no privacy at all.

The common thread is that only a VPN encrypts all of a device's traffic to a server you choose. A VPN also does not make you anonymous; it hands the view of your activity that your internet provider used to have to the VPN company instead, which is the trade-off the whole consumer history has been about.

Choosing a VPN today: what the history teaches

Three lessons from three decades still hold. Protocols age, so prefer a service built on WireGuard or a modern OpenVPN, and treat PPTP as a red flag. Trust is the product, so look for a no-logs audit by a named firm with a recent date, such as Deloitte's examination of NordVPN between 10 November and 12 December 2025 or Securitum's on-site inspection of Proton VPN in May 2026. And free services have to be paid for somehow, so ask how before you install one.

If you want a starting point, NordVPN is one audited option, and you can compare NordVPN's plans on its own site; that is an affiliate link, so we earn a commission if you buy. Before paying, look at what the plan costs once its introductory term ends. Mullvad, which pays us nothing, is another audited option and needs no email address to sign up. For how the tunnel itself works, read how a VPN works.