Are free VPNs safe?

Who pays for a free VPN?

Running VPN servers costs money: hardware, bandwidth and staff. A free VPN pays for that somehow. The honest models are a free tier that encourages people to upgrade, or a nonprofit. The worrying models are advertising, selling data about users, or selling users' bandwidth to others. Because a VPN sees all of your traffic, the business model matters more than for almost any other app.

What the research found

2016: 283 Android VPN apps (CSIRO Data61 and partners)

Researchers from CSIRO's Data61, UNSW, ICSI and UC Berkeley analyzed 283 Android apps that use Android's VPN permission. Their paper reported that 18% used tunneling without encryption despite promising security, about 84% didn't send IPv6 traffic through the tunnel and about 66% didn't tunnel DNS. Coverage of the study reported that around three-quarters used third-party tracking libraries. Malware figures in the press varied: some reports said 38% of the apps contained some form of malware or adware, while Tripwire's summary said about 8% had at least one positive malware report on VirusTotal. The researchers also reported that two apps injected JavaScript into users' traffic for advertising and tracking. The two they named were Hotspot Shield and WiFi Protector VPN.

2015: Hola sold free users' bandwidth

Hola, a popular free VPN browser extension, worked by routing other users' traffic through each member's connection. In May 2015 its founder, Ofer Vilenski, confirmed that the company also sold access to free users' bandwidth through a separate business, Luminati. The operator of the message board 8chan said an attacker had used that network to flood his site. Hola said it screened Luminati customers and that the attacker had slipped through.

2020: seven free VPNs left logs open online

In July 2020 researchers at vpnMentor reported that seven free VPN apps based in Hong Kong, including UFO VPN, FAST VPN and Free VPN, shared a database server left open on the internet. The Register and Sophos reported that it held connection logs, IP addresses and other user data, even though the apps advertised that they kept no logs. The apps were said to have around 20 million users. UFO VPN said the data was anonymized; the researchers disputed that.

2018 to 2025: hidden Chinese ownership

Top10VPN's investigation, first published in 2018, found that many of the most popular free VPN apps in US app stores had hidden ownership in mainland China, often behind companies registered elsewhere, and that many had privacy policies allowing data sharing. In April 2025 the Tech Transparency Project reported that 20 of the top 100 free VPN apps in the US App Store in 2024 were owned by companies in mainland China or Hong Kong without clearly disclosing it, and that several traced back to Qihoo 360, which the US Defense Department has listed as a Chinese military company. The apps had been downloaded more than 70 million times, according to TTP.

Warning signs in a free VPN

• No company name, address or country you can verify. Top10VPN found many popular free apps had no dedicated website at all.
• A privacy policy that mentions advertising partners, data sharing or “anonymized” data sales.
• Requests for permissions a VPN doesn't need, such as contacts or location.
• Ads inside the app, which usually means ad tracking.
• No independent audit and no public record of how it handled legal requests. Our audits tracker lists which providers have been audited.
• Unlimited everything for free, with no paid plan to explain where the money comes from.

Free plans with a better record, and their limits

The safer free options are free tiers of established paid services. The paid customers fund the servers, and the free tier is meant to win new ones. These two stand out because their limits and policies are clearly published:

Both companies' records, audits and legal cases are covered in their reviews. Windscribe's no-logs claim was tested in a Greek court case that was dismissed in April 2025; see no-logs policies explained. Free plans are best for occasional use, such as public Wi-Fi. For daily use, torrenting or streaming, a paid plan from a provider with a strong record is the better choice. Our best free VPNs page and free vs paid VPN comparison go further.

What about free VPNs built into browsers?

Some browsers include a free VPN or proxy that covers only browser traffic. These are run by the browser company rather than an anonymous app developer, but they protect less than a full VPN: other apps on your device aren't covered. Our Opera VPN review and Opera VPN vs a real VPN look at one example in detail.

So, are free VPNs safe?

Most free VPN apps in app stores aren't, on the evidence. The research found tracking, leaks, missing encryption and hidden owners repeatedly over ten years. A small number of free tiers from providers with published policies and independent audits are reasonable for light use. Whatever you choose, check it with our leak test guide.