Are Free VPNs Safe? Follow the Money and the Traffic
- Find the Company Before You Enter the Tunnel
- The Limit May Be How the Service Pays Its Bills
- Read for Verbs, Not “No Logs”
- A Permission Prompt Is a Small Cross-Examination
- A Green Button Hasn't Passed the Leak Test
- Honest Friction Can Be a Good Sign
- The VPN Can't Protect the Account You Hand Away
- Safe Enough Requires Evidence, Not a Price
A free VPN can protect a connection without charging you. It can't run without money, infrastructure, or an operator you have to trust. “Free” isn't the verdict; it is the first question.
You're at an airport gate with ten minutes before boarding. A VPN app promises unlimited data, every country, and one-tap privacy. It also wants permission to create a VPN connection—and access to your contacts.
The tunnel permission makes sense. The contacts request changes the decision.
Find the Company Before You Enter the Tunnel
A VPN sits in a powerful place. Covered traffic leaves your device through infrastructure chosen by its operator before continuing to websites and apps.
If the app actually encrypts its tunnel, the airport Wi-Fi sees an encrypted connection to the VPN server rather than separate covered destinations. Websites usually see the server's public IP. At the other end of the tunnel, the VPN company becomes the new intermediary.
That is why the app's publisher matters more than its icon, download count, or star average.
Find a legal company name, working contact method, privacy policy, and consistent ownership across the app store and website. Check whether the operator belongs to a larger advertising, analytics, or security group. An affiliate isn't automatically a problem; an operator that is hard to identify is.
Ownership can change, so repeat this check after an acquisition or a major policy update. Yesterday's trustworthy funding model isn't a lifetime guarantee.
The Limit May Be How the Service Pays Its Bills
Servers, bandwidth, app development, abuse handling, and support all cost something. A free plan needs a visible answer for who covers that cost.
Some companies fund a limited free tier with paying subscribers. They may restrict data, devices, locations, speed, or advanced features while keeping the operator and business model easy to see.
Other apps use advertising, analytics, partnerships, or data sharing. The FTC warns in its VPN app guidance that some free VPNs support themselves through ads or third-party data arrangements. That doesn't prove every free service behaves this way. It tells you which question not to skip.
“Free forever” isn't an explanation. If the service promises unlimited infrastructure but won't identify the paying customer, keep your traffic out of it.
Privacy is larger than one tunnel. A business can hide your address from a website while collecting a valuable account and device profile of its own.
- Connects everyday data collection to real choices about freedom, power, and control
- Explains why privacy matters even when you have nothing to hide
- Turns a broad social issue into practical questions you can apply to your digital life
Use that wider lens when you read the VPN's policy. The app can hide one observer while adding another; the real question is who can use the data after the tunnel ends.
Read for Verbs, Not “No Logs”
Open the policy and search for collect, use, share, retain, and delete. Then look for the data that could be attached to those verbs:
- source and assigned IP addresses;
- connection times and session duration;
- DNS requests or browsing activity;
- bandwidth totals;
- device and advertising identifiers;
- crash reports and analytics; and
- account and payment information.
A “no activity logs” sentence can coexist with connection logs, device analytics, or account data. The useful answer names what is kept, why, for how long, and who receives it.
Check whether diagnostics are optional and whether deleting the account deletes associated data. If one policy covers several unrelated apps, find the section that actually applies to the VPN.
Independent audits and open-source apps can add evidence, but scope matters. Confirm that the reviewed version and systems cover the free service you will use. An audit is a dated inspection, not a permanent warranty.
A Permission Prompt Is a Small Cross-Examination
Return to the phone at the gate. The operating system must authorize the VPN connection. That permission lets the service route traffic; it's the reason you're installing the app.
Contacts, messages, call history, photos, microphone access, accessibility control, or device administration need separate explanations tied to a real feature. An operating system may require approximate location access for a feature that identifies nearby Wi-Fi networks, but the app should explain that need. Deny an unrelated request and see whether the core tunnel still works.
On Android, compare the technical permission list with the store's data disclosure. Google explains that the Data safety section is based on developer declarations, while the permission list reflects what the app can access. They answer different questions; read both.
Do the same for a browser extension. Permission to read and change data on websites is broad even if the download itself is free.
A Green Button Hasn't Passed the Leak Test
Connect while the gate Wi-Fi is stable. Compare the public IP address before and after, then run DNS and IPv6 leak tests. Marketing silence doesn't make an uncovered route safe.
Then make the connection misbehave on purpose. Lock and wake the phone. Walk away from Wi-Fi and switch to mobile data. Change servers. Interrupt the VPN while a harmless page reloads.
A kill switch or operating-system blocking mode should stop covered traffic when the private route fails. It shouldn't silently send that traffic through the normal connection. Repeat the test after major app and operating-system updates, because transitions expose failures that a calm five-minute session can hide.
Watch for injected ads, changed search pages, unexpected certificate warnings, or unexplained redirects. Stop if the VPN interferes with secure connections. Slow service may simply mean crowded free servers; repeated dropouts are different because they make failure protection do more work.
Honest Friction Can Be a Good Sign
A 5 GB cap, three locations, one device, or slower queues may be the visible price of a sustainable free tier. Those limits are inconvenient, but they are understandable.
The important part is what happens at the boundary. When the allowance ends, the app should stop, disconnect clearly, or ask you to upgrade. It shouldn't quietly move traffic outside the tunnel.
Read platform details too. The desktop app may have a kill switch that the phone version lacks. A protocol or server available to paying users may not exist on the free tier. Marketing for the whole service doesn't establish what your plan receives.
Check the date and substance of recent updates, supported operating systems, and technical documentation. The service should name an established protocol, but a protocol name isn't proof. Look for current outside testing that confirms the app actually encrypts traffic; the FTC warns that some VPN apps encrypt only part of it—or none of it. An old app can miss platform changes even when its policy still sounds careful.
The VPN Can't Protect the Account You Hand Away
A free and paid VPN share the same outer limits. Neither automatically stops phishing, removes malware, fixes a weak password, or prevents a signed-in website from recognizing you.
Begin testing with low-risk browsing. Don't send banking, work, or private messages through an operator you haven't identified simply to see whether its server is fast.
Protect important accounts with unique passwords and phishing-resistant multifactor authentication where supported. That's a different layer from the VPN and deserves its own recovery plan.
- Adds a physical FIDO sign-in check through USB-C or NFC
- Helps protect supported accounts from fake login pages and stolen passwords
- Keeps setup focused on core passkey and multi-factor use without a battery or app on the key
Stronger account protection doesn't make a questionable VPN safe. VPN trust and password security are separate problems.
Safe Enough Requires Evidence, Not a Price
A free VPN can be a reasonable choice when the operator is identifiable, the funding model is clear, the policy minimizes data, requested permissions fit the job, the apps are maintained, their encryption is confirmed by current outside testing, and leak and failure tests hold up. Clear caps can be evidence of an honest trade, not a defect.
Walk away when ownership is murky, permissions are unrelated, sharing is vague, updates have stopped, secure connections are altered, or “unlimited” has no economic explanation.
If regular use, several devices, or specific locations make the limits painful, compare a low-cost paid VPN by total price and the same privacy tests. Paying removes one mystery only when the paid service also explains what it does.
The safest free VPN isn't the one with the loudest lock icon.
It is the one that makes the trade visible—and still works when you try to break it.