Depends on the context. If you are at home on a wired / non public connection…HTTPS by itself is probably good enough for protecting your password / credentials from your general “web goblin” type of hacker.

However, if your device is compromised with malware (keylogger or whatever) then neither HTTPS nor a VPN can protect you.

HTTPS uses a special key sharing algorithm to safely encrypt your data so that it’s relatively secure to transmit across the internet. Even if a man-in-the-middle intercepts it, they can’t decrypt the data.

A VPN is an extra layer of security that hides your session from your internet service provider, or your boss, or random people on the WiFi at your local coffee place, that sort of thing. Using VPN is a good idea, but it’s not a magic solution, and it’s not always necessary. The VPN helps hide things like the websites you are visiting, your IP address, stuff like that. It also encrypts your traffic in a “tunnel” which is nice, but HTTPs packets are already encrypted. So HTTPS over a VPN is doubly encrypted.

Security-wise, you do no harm using both. However, using a VPN can be a little bit slower and some services (like the Google platform and major video content streamers) really don’t like it when you use a VPN. You can sometimes get around this by purchasing a dedicated IP address from your VPN service provider, but that usually costs extra (on top of whatever you may be paying for the VPN service itself).

And…a dedicated IP may or may not fool those picky content streamers. They have gotten pretty aggressive about blocking VPNs because they know people use them to get around regional content lockouts and restrictions.