VPNs, by design, only encrypt traffic from a client to the server. I can't say how different software handles this problem for you, but it's important to understand that when using a VPN with HTTP Basic Auth enabled, your username and password are transmitted in plain text. For this reason, if security is of utmost importance to you, use HTTPS instead of HTTP if logging into webpages on the same computer as your connected VPN service. (e.g., if connected through OpenVPN)