An encrypted tunnel
A VPN sits between your device and the rest of the internet. Everything you send and receive travels through that tunnel, scrambled so others cannot read it.
Your ISP, the cafe Wi-Fi, and anyone on the same network see a private connection — not your passwords, searches, or bank login.