How to use a VPN on a Mac

Installing a VPN on a Mac is straightforward, with one step that stops people — the system extension approval — and one behaviour nobody mentions until you go looking for it.

Set it up

1. 1

   Download from the provider's website

   Not a download portal, and generally not the Mac App Store — see below for why. Every VPN we rate ships a native Apple-silicon build, so there is no Rosetta overhead on any current Mac.

2. 2

   Open the app and sign in

   Enter the login from your subscription.

3. 3

   Approve the system extension

   macOS asks permission to add a VPN configuration, and most clients additionally install a network system extension that needs approving in System Settings → General → Login Items & Extensions.

   This is the step that trips people up. The app installs fine, appears to run, and then cannot connect — because the extension is sitting unapproved. If your VPN will not connect on a fresh install, check here first.

4. 4

   Connect

   Nearest server for general use, or the country you need. A VPN icon appears in the menu bar when the tunnel is up — that icon, not the app window, is the indicator worth trusting.

5. 5

   Turn on the kill switch and connect-on-launch

   Both in the app's own settings. On a laptop that sleeps and wakes on a different network several times a day, these are what make the difference between a VPN you rely on and one you keep having to check.

6. 6

   Verify once, properly

   Confirm your IP and ISP changed with our IP checker, then run a DNS leak test and the WebRTC test. Two minutes, once.

App Store or website?

Both exist for most providers. The website build is usually the better choice for two reasons.

Price. Subscribing through an in-app purchase carries Apple's commission, and providers price accordingly. The same plan bought on the website is often meaningfully cheaper, and it works on Windows, Android and a Fire TV Stick rather than being tied to your Apple ID.

Features. App Store builds run under stricter sandboxing. In practice that occasionally costs something — split tunnelling is the usual casualty, sometimes absent or limited in the App Store version of a client that has it on the website.

The App Store's advantage is convenience: automatic updates and a one-click uninstall that actually removes everything. If you value that over the price difference, it is a reasonable trade — just check the feature list against the website version before deciding.

The macOS behaviour worth knowing

Apple has historically routed some of its own system services outside VPN tunnels on macOS and iOS. This affected specific Apple services rather than your general browsing, and it is not something a third-party VPN can fully override — the operating system decides how its own traffic is routed.

Whether this matters depends entirely on what you want the VPN for.

If your concern is your ISP, a café network, or a landlord's router — which is most people — it is close to irrelevant. Your browsing, your downloads and your DNS all go through the tunnel.

If your threat model includes Apple itself, it is a real limitation and no macOS VPN configuration solves it. That is a Linux-shaped answer, not a VPN-shaped one.

We mention it because it is true and because most Mac VPN guides do not.

The settings that matter on a laptop

Connect on launch, plus auto-connect on untrusted Wi-Fi. A MacBook is the device most likely to be opened on a network you did not choose. Setting it to connect automatically on anything other than your home Wi-Fi removes the one habit you would otherwise have to remember.

Kill switch on. With the caveat that a captive portal — a hotel or airport that requires accepting terms on a web page — may need it off briefly to reach the portal.

WireGuard as the protocol. Explicitly, not "Automatic". It reconnects far faster after the lid closes, which on a laptop is the difference you actually notice. The protocols guide has the measurements.

Split tunnelling, if your bank blocks VPN IP ranges. Exclude that one app rather than disconnecting each time.

The built-in macOS VPN client

System Settings → Network → VPN. It exists, and for a commercial VPN it is the wrong tool.

It is designed for connecting to a workplace or university network with a configuration IT gave you: a server address, a protocol, credentials. For that job it works.

What it lacks for commercial use: no server list, no kill switch, no DNS leak protection, no WireGuard, no obfuscation, no split tunnelling. It supports IKEv2, L2TP/IPsec and Cisco IPsec.

Use it if your employer handed you a configuration file. Use the provider's app for everything else.

Which client

VPN	Split tunnelling	Kill switch	Avg speed	2-year price
ExpressVPN	Yes	Yes	598 Mbps	$4.99/mo
NordVPN	Yes	Yes	712 Mbps	$3.39/mo
Surfshark	Yes	Yes	655 Mbps	$2.19/mo
Proton VPN	Yes	Yes	541 Mbps	$4.49/mo
Mullvad	Yes	Yes	590 Mbps	$5.40/mo

Removing it properly

Dragging the app to the Trash leaves things behind. Use the provider's own uninstaller if it ships one, then check both of these:

• System Settings → Network — delete any leftover VPN configuration
• System Settings → General → Login Items & Extensions — remove the stale system extension

A leftover configuration is the usual reason a "removed" VPN still shows up in Settings, and occasionally the reason a newly installed VPN will not connect — two network extensions fighting over the same job is a real failure mode. If you are switching providers, uninstall the old one completely and restart before installing the new one.