I use one when connecting via a public access point such as a hotel, restaurant and the like. Data is encrypted by the VPN provider from my machine to the 'other end' of the provider's network. From the provider's server to the target site is up to the browser/destination site AFAIK, i.e. HTTPS or similar. For my purposes VPN is another layer for the ner'do'wells to compromise.