A virtual private network (VPN) extension usually works as a proxy: it forwards the browser's requests through an intermediary server.
Websites see the address of that server, but messaging apps, games and other programs on the device are not covered. In Chrome and Edge, the extension manages the browser's proxy settings; in Firefox, it manages the proxying of web requests. To protect the connections of the whole device, you need a system-level VPN client with the appropriate operating mode.
A proxy forwards requests on your behalf. The website sees the proxy's Internet Protocol (IP) address, its network address, instead of the address of your own connection.
Websites see the address of that server, but messaging apps, games and other programs on the device are not covered.
An application programming interface (API) is the set of tools available to the extension. In Chrome, the chrome.proxy interface changes the proxy settings; in Firefox, the proxy interface handles web requests.
A system client creates an encrypted tunnel from the device to the VPN server. This is how the Electronic Frontier Foundation describes how it works. With full tunnelling, the connections of all applications go through it. Exceptions in the settings may leave part of the traffic on a direct route.
With full tunnelling, the connections of all applications go through it.
Exceptions in the settings may leave part of the traffic on a direct route.
| Compared | Proxy extension | Browser's built-in VPN | System VPN client |
|---|---|---|---|
| Scope | The browser's web requests | Browser requests according to the feature's rules | Device traffic with full tunnelling |
| Other programs | Not covered | The browser feature does not cover them | Covered, if there are no exceptions |
| Who sets the route | The extension's developer and the browser settings | The browser's developer and the chosen mode | The client and the system settings |
| Encryption to the server | Depends on the proxy scheme | Check the feature's description | An encrypted tunnel |
| Private windows | Have separate permissions and caveats | Depends on the implementation | Follow the system route |
Not necessarily. Browser APIs also support proxy schemes in which the segment between the browser and the intermediary is not encrypted. Check the service's technical description.
HyperText Transfer Protocol Secure (HTTPS) encrypts the exchange between the browser and the website, including when traffic passes through an ordinary proxy. That is a separate layer of protection. For Opera, the encryption of the "browser → server" segment is confirmed in the browser's help documentation.
Choose according to which applications need to connect through the server.
| Your task | Suitable option | What to check |
|---|---|---|
| Change the address visible to websites in a single browser | An extension or a built-in feature | Site exceptions and direct connections |
| Route a browser, a messenger and an email program through the server | A system client | Whether the whole-device mode is enabled |
| Protect browsing in Safari | A system VPN or iCloud Private Relay for browsing in Safari | Whether the other applications need protection |
| Open a website via an "online VPN" page | A web proxy, and only if you trust the operator | Whether the intermediary can read the data you enter |
If the connections of the whole device should go through the VPN, I recommend a compatible system client with a subscription from CitadelVPN. Add the subscription link from your account to the client, refresh the list and select the connection. Then enable the VPN mode for the device: importing a subscription does not by itself send all traffic through the tunnel. The availability of the mode depends on the client and the platform.
In Chrome, extensions are installed from the Chrome Web Store; in Edge, from its own store or the Chrome store. You need to check the compatibility of a particular product. Permissions and limitations are discussed in the guide on installing a VPN extension in Chrome and Edge.
Firefox lets you set a proxy in its own network settings or entrust requests to an extension. The differences between these approaches, private windows and the limitations of the mobile version are discussed in the article on Firefox extensions and proxy settings.
Safari does not support the proxy-extension interface in the Chrome and Firefox model, so a VPN requires a system client. iCloud Private Relay, included with an iCloud+ subscription, protects browsing in Safari through two relays, but does not replace a whole-device VPN. The choice is discussed on the page about a VPN for Safari.
A built-in VPN remains a browser feature: in Opera the connection to the server is encrypted, while for Edge Secure Network the coverage depends on the mode. In its description of Firefox 149, Mozilla calls its feature a secure proxy. Its gradual rollout began on 24 March 2026, including in the UK; you need to check whether it is present in your installation.
An "online VPN browser" with a field for entering a website address is usually a web proxy. Its operator can read the pages loaded and the data entered through it. For email or banking, a random intermediary is not suitable. The boundaries of these solutions are examined in the review of browsers with a built-in VPN and online proxies.
Yes, for requests that genuinely go through its server. Direct connections and WebRTC, the browser's real-time communication technology used for calls, can reveal the original public address under certain settings. The domain name system (DNS), which translates a website's name into a network address, also needs checking: its queries may travel by a separate route.
Compare the address before and after connecting, then check WebRTC and DNS using the guide "Does a browser VPN hide your IP". Changing the address does not stop a website from recognising you by your account.
Running an extension in Chrome's incognito mode requires separate permission. Private windows may inherit the ordinary proxy settings, so the absence of an icon proves nothing. In Firefox, changing the shared proxy settings requires access to private windows.
Yes, if the extension has been granted permission to read their content. This is a separate form of access: HTTPS encryption does not stop the extension itself from reading the page inside the browser. An ordinary proxy server without such access does not automatically obtain the plaintext of HTTPS pages, although the server's operator can see which sites you connect to.
No, a system client with a full tunnel is sufficient. Add an extension only for a specific feature you need: two switches do not, by themselves, strengthen your protection.
For a single browser, choose a proxy extension or a built-in feature; for a browser alongside a messenger and games, choose a system VPN with full tunnelling. In Safari, a system client and iCloud Private Relay are available, with different scopes of protection. After connecting, check the visible IP address, WebRTC and DNS.