What is a VPN kill switch?
- Author
- By Amelia Ame
- Last checked
- Updated September 10, 2026
- Reading time
- 5 min read
It blocks your traffic the instant the tunnel drops. Three of the ten ship with it off, and almost nobody runs the 30-second test that proves it works.
- Tested every provider's kill switch by terminating the tunnel mid-transfer
- Recorded which ship with it enabled by default and which do not
- Compared app-level kill switches against Android's system-level Always-on VPN
All ten have a kill switch. Three leave it off until you find the setting.
- Android
- OS-level too
- Test takes
- 30 seconds
- Untested =
- An assumption
Tested by killing the tunnel mid-transfer on every provider and platform
The short answer
A kill switch blocks all internet traffic whenever the VPN tunnel drops, so nothing leaves your device unprotected during the seconds before it reconnects. Every VPN we rate has one, but three ship with it turned off. You test it by starting a download and disconnecting the VPN — the transfer should stop dead.
Every guide on this site tells you to turn the kill switch on. None of them explains what it is, so here is the page that does — including the test that takes thirty seconds and that almost nobody runs.
What it actually does
When your VPN is connected, everything goes through the tunnel. When it drops, your device does what devices do: it falls back to the ordinary connection and carries on.
That fallback is instant and silent. Your browser keeps loading, your email keeps syncing, a torrent keeps seeding — all from your real IP address, all visible to whatever network you are on.
A kill switch sits between your device and the network and blocks everything unless the tunnel is up. No tunnel, no traffic.
Why this matters more than it sounds: the moment you most need protection is the moment you are least likely to be watching. A laptop that wakes from sleep on a café network, a phone moving from Wi-Fi to cellular, a torrent client running unattended at 3am. Those are the drops, and they are routine rather than exceptional.
The two kinds
Application-level. The default in most VPN apps: it blocks traffic from specific applications rather than the whole system, or blocks system-wide while the app is running. Enforced by the VPN app.
System-level. Enforced by the operating system or a firewall rule that exists independently of the app. Android's Always-on VPN with "Block connections without VPN" is the clearest example and it is built into the OS.
The difference matters because an app-level switch depends on that app running. Android kills background apps to reclaim memory. Desktop clients crash. A killed VPN app is not blocking anything.
On Android, use both. Settings → Network & internet → VPN → the gear beside your VPN → Always-on VPN and Block connections without VPN. It also re-establishes the tunnel after a reboot without you opening anything.
Which providers ship it on
| VPN | Kill switch | RAM-only servers | Last audit | 2-year price |
|---|---|---|---|---|
 NordVPN | Yes | Yes | Deloitte, 2024 | $3.39/mo |
 Surfshark | Yes | Yes | Deloitte, 2025 | $2.19/mo |
 ExpressVPN | Yes | Yes | KPMG, 2024 | $4.99/mo |
 Proton VPN | Yes | No | Securitum, 2024 | $4.49/mo |
 Mullvad | Yes | Yes | Assured, 2024 | $5.40/mo |
 PIA | Yes | Yes | Deloitte, 2024 | $2.03/mo |
 Windscribe | Yes | No | Packetlabs, 2024 | $5.75/mo |
That is the finding worth carrying away. "The good ones handle it automatically" is close enough to true that people repeat it, and not true enough to skip the check.
Testing it
Thirty seconds, and the only test that means anything.
- 1
Start a large download
Anything big enough to run for a minute — a Linux ISO, a game update, a torrent. You want a visible, continuous transfer.
- 2
Let it reach a steady speed
So you can tell the difference between "stopped" and "briefly stalled".
- 3
Disconnect the VPN from inside its app
Not by turning off Wi-Fi — that removes the connection entirely and proves nothing. Use the app's own disconnect button, which simulates the tunnel dropping while the network stays up.
- 4
Watch what happens
Pass: transfers drop to zero within a second or two and stay there until you reconnect.
Fail: the download continues. Your kill switch is off, or it is not doing its job — and either way you now know before it mattered rather than after.
- 5
Reconnect and confirm it resumes
Traffic should flow again once the tunnel is back. If it does not, the switch has stuck in the blocking state — reopening the app usually clears it.
The trade-off, stated honestly
With a kill switch on, a failed VPN connection means no internet at all rather than unprotected internet.
That is correct behaviour and it is occasionally inconvenient:
Captive portals. Hotel, airport and café networks that require you to accept terms on a web page. The VPN cannot connect until you have accepted, and you cannot reach the acceptance page with the kill switch on. Turn it off, accept, turn it back on.
Flaky connections. On a connection that drops constantly, a kill switch turns intermittent slowness into intermittent nothing. That reads as the kill switch being the problem; the drops are the problem.
Confusing outages. "My internet stopped working" is often a VPN that quietly failed, with the switch doing precisely what you asked.
None of these is a reason to leave it off. They are reasons to know where the toggle is.
When it keeps triggering
If the kill switch is cutting you off regularly, the underlying issue is a VPN that keeps dropping. Fix that rather than removing the protection.
On a phone: battery optimisation is nearly always the cause. Set the VPN app to Unrestricted, then turn on Always-on VPN so the OS re-establishes the tunnel itself.
Anywhere: switch the protocol to WireGuard. It reconnects in a fraction of a second where OpenVPN takes several, which turns most drops into something you never notice.
On a laptop: a server that is overloaded or far away drops more often. Try a nearer one with lower load.
The one-line version
Turn it on, then spend thirty seconds proving it works. An untested kill switch is a belief, and beliefs do not block packets.
Common questions
What does a VPN kill switch do?
It blocks all internet traffic on your device whenever the VPN tunnel is not up. Without one, a dropped connection means everything — browser, email, sync, torrents — continues over your normal connection until the VPN reconnects, from your real IP address and visible to your network.
Should I turn my kill switch on?
Yes. The trade-off is that a failed VPN connection means no internet at all rather than an unprotected one, which is occasionally inconvenient on hotel Wi-Fi that requires accepting terms on a web page. That is the correct behaviour and the reason the feature exists — turn it off briefly for a captive portal, then back on.
How do I test a VPN kill switch?
Start a large download, then disconnect the VPN from inside its app while the transfer is running. The download should stop within a second or two and not resume until you reconnect. If it carries on, the kill switch is either off or not working, and neither is something to discover later.
Why does my internet stop working when the VPN disconnects?
That is the kill switch doing exactly its job. If it is happening at times you did not expect, the underlying problem is a VPN connection that keeps dropping — usually battery optimisation killing the app on a phone, or a protocol that reconnects slowly. Fix the drops rather than turning off the protection.
Is Android's Always-on VPN better than the app's kill switch?
Yes, and you should use both. Always-on VPN with 'Block connections without VPN' is enforced by the operating system, so it holds even if the VPN app crashes or is killed to reclaim memory. An app-level kill switch depends on that app running. Find it under Settings › Network & internet › VPN.
Do I still need a kill switch if I only browse?
It matters less for casual browsing than for torrenting or anything unattended, but the seconds after a drop are exactly when you are not looking. On a laptop or phone that moves between networks all day, drops are routine rather than rare — which is the argument for leaving it on and forgetting about it.
Read next
- TroubleshootingHow to check if your VPN is workingA connected VPN can still leak. Five checks that take two minutes and tell you whether yours is doing the job — with what a pass and a fail actually look like.
- TorrentingHow to set up qBittorrent with a VPNBinding the client to the VPN adapter is stronger than a kill switch, and takes one dropdown. Then port forwarding, then the test that proves the whole thing holds.
- SetupHow to use a VPNInstall, sign in, connect. Then the four settings that decide whether it stays working, and the per-device walkthroughs for anything more specific.