How to use a VPN on Android

Android is the best platform for VPNs, and almost nobody uses the two features that make it so: a kill switch enforced by the operating system rather than the app, and genuine per-app routing. The install takes two minutes; those two settings take another two and are what this page is really about.

Set it up

1. 1

   Subscribe on the provider's website

   Not as an in-app purchase. It is usually cheaper — Google takes a commission and providers price accordingly — and a website subscription works on Windows, iOS and a Fire TV Stick as well.

2. 2

   Install from the Play Store, checking the developer

   Search the provider by name and look at the developer line before installing. VPN brand names attract imitators, and this is an app you are about to give permission to route all your traffic.

3. 3

   Sign in and connect

   Enter your login and tap Connect. Android shows a one-time system dialog asking permission to set up a VPN connection — accept it.

4. 4

   Check the key icon

   A small key appears in the status bar whenever the tunnel is up. That icon is the reliable indicator, not the app's own "Connected" screen.

5. 5

   Turn on Always-on VPN

   Settings → Network & internet → VPN → the gear icon beside your VPN → enable Always-on VPN and Block connections without VPN. Details below — this is the most valuable two taps on this page.

6. 6

   Set per-app routing, if anything breaks

   In the VPN app's own split tunnelling settings, exclude the apps that misbehave behind a VPN. Usually that is a banking app and nothing else.

Always-on VPN: the setting worth the whole page

Your VPN app has a kill switch. Android has a better one.

The app's kill switch is enforced by the app, which means it depends on the app running. Android kills background apps to save memory and battery, and a killed VPN app cannot block anything.

Always-on VPN is enforced by the operating system. With Block connections without VPN enabled, Android refuses to pass any traffic unless the tunnel is up — whether or not the VPN app is alive. It also re-establishes the connection itself after a reboot, without you opening anything.

That is a materially stronger guarantee than any app-level feature, and it is free, built in, and off by default.

The trade-off is real and worth knowing: with it on, a failed connection means no internet at all rather than an unprotected one. On a captive-portal Wi-Fi — a hotel or an airport that makes you accept terms on a web page — you may need to turn it off briefly to reach the portal, then back on. That is the correct behaviour and it is the reason the feature exists.

Per-app routing: the thing iOS cannot do

Android lets you decide, app by app, what goes through the tunnel. iOS does not, at all, on a personal device.

The common use is a banking app. Many banks block known VPN IP ranges as fraud prevention, so the app fails while the VPN is on. Rather than disconnecting each time — and forgetting to reconnect — you exclude that one app. Everything else stays protected.

Two ways to configure it, and the direction matters:

• Exclude specific apps (bypass the VPN) — the sensible default. Everything is protected except the handful you name.
• Include only specific apps (only these use the VPN) — narrower, and it means everything you did not list is unprotected. Only choose this if you genuinely want one app tunnelled and nothing else.

Every VPN we rate supports this on Android.

Why it keeps disconnecting

Almost always battery optimisation. Android aggressively suspends background apps, and a suspended VPN app drops its tunnel.

Settings → Apps → your VPN → Battery → Unrestricted.

Then combine that with Always-on VPN and the problem is largely solved: the app is allowed to keep running, and the OS re-establishes the tunnel if it does not.

The other fix is the protocol. WireGuard reconnects in a fraction of a second where OpenVPN takes several — on a phone that constantly moves between networks, that difference is the whole experience. The protocols guide has the measurements.

Which app to install

VPN	Devices	2-year price	Avg speed	Added ping
NordVPN	10	$3.39/mo	712 Mbps	+4 ms
Surfshark	Unlimited	$2.19/mo	655 Mbps	+6 ms
Proton VPN	10	$4.49/mo	541 Mbps	+9 ms
PIA	Unlimited	$2.03/mo	480 Mbps	+10 ms
Mullvad	5	$5.40/mo	590 Mbps	+8 ms

A word on free Android VPNs

The Play Store contains hundreds of free VPN apps and the barrier to being there is not a privacy audit.

Several have been found logging traffic, and several have been found operating as residential proxy networks — meaning your connection is used to route other people's traffic, in exchange for routing yours through theirs. That means requests you know nothing about appearing to originate from your phone. It is usually disclosed somewhere in a terms document nobody reads.

If you want a free tier, use one funded by a paid business with a published audit. Proton VPN's is the one we rate: no data cap, same no-logs policy as the paid plan, three countries.

Removing it

Uninstall the app, then check Settings → Network & internet → VPN and delete any leftover configuration. Android keeps the profile after the app is gone, and a stale one is the usual reason a removed VPN still appears in Settings. Also turn Always-on VPN off first — otherwise you can end up with a device that blocks all traffic waiting for a VPN that is no longer installed.