How to use a VPN

Using a VPN is genuinely simple, and almost every guide to it is padded because the honest version is three sentences long. So here is the short version first, then the four settings that actually matter, then where to go for your specific device.

The two minutes

1. 1

   Subscribe on the provider's website

   Not through an in-app purchase. It is usually cheaper — the app stores take a commission and providers price accordingly — and a website subscription works across Windows, macOS, iOS, Android and a Fire TV Stick rather than being tied to one ecosystem.

   Take a long plan. Every VPN we rate has a money-back guarantee and we have claimed all ten, so the exposure is small and the monthly rate is four to six times the two-year one.

2. 2

   Install the app

   From the provider's own site, or the official store for your platform. Check the developer name matches the company — VPN brand names attract imitators, and this is an app you are about to authorise to route all your traffic.

3. 3

   Sign in and press Connect

   Your device asks permission once. On iOS it is "would like to add VPN configurations"; on Android it is a connection request; on macOS it is a system extension approval. This is the operating system checking whether this app may handle your traffic, and it will not work without it.

   Then look for the system indicator — a VPN badge on iOS, a key icon on Android, a menu-bar icon on macOS. That indicator, not the app's own screen, is what tells you the tunnel is really up.

4. 4

   Turn on the kill switch

   In the app's settings. It blocks all traffic whenever the tunnel drops — which happens more than people think, because laptops sleep, phones move between networks and servers restart.

   Three of the ten we tested ship with this off. The trade-off is that a failed connection means no internet rather than an unprotected one, which is the correct behaviour and occasionally inconvenient on a hotel captive portal.

5. 5

   Set auto-connect on untrusted Wi-Fi

   So the VPN comes up by itself on any network that is not your home one. The whole point of a VPN is the networks you did not choose, and those are exactly the moments you will not remember to open an app.

6. 6

   Set the protocol to WireGuard

   Explicitly, not "Automatic" — some apps fall back to OpenVPN on certain networks without saying so. WireGuard is faster, reconnects in a fraction of a second after your device wakes, and uses noticeably less battery. The protocols guide has the measurements.

7. 7

   Run one leak test

   Load our IP checker and confirm your address and ISP both changed. Then run a DNS leak test — every resolver should belong to the VPN.

   This is the step that catches a VPN which is connected but not actually protecting you, and it takes about ninety seconds.

Which server to pick

The nearest one, almost always.

Distance is the dominant cost in both speed and latency, and a server in your own city hides your IP from websites and your traffic from your ISP exactly as well as one on the other side of the world. Routing through a distant country buys you nothing and costs a lot.

Choose a different country only for a specific reason: that country's streaming catalogue, a service blocked where you are, or a particular jurisdiction. The server location guide covers each case with the numbers.

And switch back afterwards. The most common cause of "my VPN is slow" is someone still routed through Tokyo three weeks after an evening of anime.

Should you leave it on?

On a phone and a laptop, mostly yes. The cost is a few milliseconds and a little battery; the benefit is being covered on every network you did not choose without having to think about it.

Two exceptions worth handling properly rather than by switching it off:

Apps that break behind a VPN — usually banking, which blocks VPN IP ranges as fraud prevention. Use split tunnelling to send that one app outside the tunnel. On Android and desktop this is straightforward; iOS does not support it at all, so there you disconnect briefly.

Captive portals — hotel and airport networks that need you to accept terms on a web page. With a kill switch on you may need to disable it to reach the portal, then re-enable.

Your specific device

The steps above are the same everywhere. These go deeper where a platform has its own quirks worth knowing.

Device	What is different
iPhone / iPad	No split tunnelling at all; Background App Refresh decides whether it reconnects
Android	Always-on VPN is a system-level kill switch; per-app routing works properly
Windows 11	The DNS leak is a Windows-specific behaviour worth understanding
Mac	The system-extension approval blocks connections silently until granted
Fire TV Stick	Seven of ten have an app; the rest need sideloading or a router
Smart TV, console	Cannot run a VPN app — router or smart DNS only

Which VPN to install

If you have not chosen one yet, the honest shortcut is our five-question finder, which asks what you need it for and scores the ten against your answers. Or the comparison:

VPN	Devices	2-year price	Avg speed	Money-back
NordVPN	10	$3.39/mo	712 Mbps	30 days
Surfshark	Unlimited	$2.19/mo	655 Mbps	30 days
ExpressVPN	8	$4.99/mo	598 Mbps	30 days
Proton VPN	10	$4.49/mo	541 Mbps	30 days
PIA	Unlimited	$2.03/mo	480 Mbps	30 days

What it does not do

Worth knowing before you start, so the thing meets your expectations.

A VPN hides your browsing from your internet provider and your IP from websites. It does not hide you from anything you log into, does not stop malware or phishing, and does not secure your device. Those are covered properly in what a VPN hides and does a VPN protect you from hackers — both worth five minutes if you are buying one for security reasons rather than privacy ones.

The whole thing, once more

Install. Sign in. Connect. Kill switch on, auto-connect on, WireGuard, one leak test.

Everything else on this site is detail for a specific situation. That list is the part that applies to everyone.