What a VPN kill switch does, and where it falls short

What is a VPN kill switch?

A VPN sends your traffic through an encrypted tunnel to a server run by the VPN company. If that tunnel breaks, most devices quietly fall back to your normal connection. Your apps keep working, and you may not notice that your traffic now goes out through your home ISP or the café Wi-Fi with your real IP address.

A kill switch is a setting that blocks all internet traffic unless it goes through the VPN. If the tunnel drops, the connection stops instead of falling back. Some apps call it a network lock, lockdown mode or “always require VPN”. The idea is the same.

When does a VPN connection drop?

• Your device switches networks, for example from Wi-Fi to mobile data.
• The VPN server restarts or goes offline.
• Your laptop wakes from sleep before the VPN app reconnects.
• The VPN app crashes or updates itself.
• You start the device and apps open before the VPN connects.

Each gap may last only seconds. For most people that's harmless. It matters more if you torrent, if your ISP or network operator is someone you don't want watching, or if you live somewhere that punishes people for what they read. Remember that a VPN, kill switch or not, doesn't make copyright infringement legal. See is torrenting illegal.

App kill switches and system kill switches

There are two broad designs.

Some apps also offer an app-specific kill switch that closes chosen programs, such as a torrent client, when the VPN drops. It protects those apps only.

Kill switch on Android

Android has a built-in kill switch. Google's Android Enterprise help explains that in the Settings app you can open the VPN entry under Network & internet and switch on Block connections without VPN, usually together with Always-on VPN. VPN apps on Android mostly rely on this system setting rather than their own firewall.

There's a documented gap. In October 2022 Mullvad reported that Android sends connectivity checks outside the tunnel every time the device joins a Wi-Fi network, even with Block connections without VPN turned on. These checks let Android find captive portals such as hotel login pages. Mullvad said the setting's name and Google's documentation were misleading, and that the only way to turn the checks off was with developer tools (adb). It filed a feature request with Google. BleepingComputer reported the leaked data could include source IP addresses, DNS lookups and HTTPS traffic.

Kill switch on iPhone and iPad

Apple doesn't give iPhone owners a system kill switch toggle. VPN apps can set an option Apple added for developers, often called includeAllNetworks, that asks iOS to send all traffic through the tunnel. Apps usually label it “kill switch”.

In 2020 Proton VPN disclosed that iOS didn't close connections that were already open when you turned the VPN on, so those connections could continue outside the tunnel. Proton later said the kill switch setting helped but that some Apple services' traffic still went outside the VPN, and Apple told Proton this was expected behavior. 9to5Mac reported in August 2022 that researchers still saw the issue on iOS 15.6. Mullvad's iOS help page also warns that traffic to some Apple services can bypass the tunnel.

Kill switch on Windows, macOS and Linux

Desktop VPN apps usually build their own kill switch with the computer's firewall. Settings vary by provider, so check the provider's help page for two things:

• Does the kill switch stay on when the app quits or crashes, or only while the app is running?
• Does it block traffic at startup, before you've logged in or connected?

Some providers turn the kill switch off when you use split tunneling. Proton's support pages say split tunneling doesn't work alongside the kill switch on most platforms, Windows being the exception.

How to check your kill switch

1. Turn it on Enable the kill switch in your VPN app, or on Android enable Always-on VPN and Block connections without VPN.
2. Note your VPN address Connect to the VPN and open our What is my IP tool. You should see the VPN server's address, not your ISP's.
3. Break the tunnel Disconnect from the VPN server in a way the app doesn't expect, for example by switching Wi-Fi networks. Pages should stop loading until the VPN reconnects.
4. Check again Once you're back online, reload the IP tool and run a leak test for DNS, IPv6 and WebRTC.

A simple test like this can show an obvious gap. It can't prove there are no brief leaks, such as Android's connectivity checks, which need packet-capture tools to see.

Should you turn the kill switch on?

For most people, yes. The cost is that you'll sometimes lose your connection until the VPN comes back, and hotel or airport Wi-Fi login pages may not load until you briefly turn it off. If you mostly use a VPN to watch another country's streaming catalogue, a kill switch matters less, and keep in mind that services often block VPNs anyway. See why streaming services block VPNs.

When you compare providers, look for kill switch details in their help pages and in independent audits. Our VPN audits tracker lists which providers had their apps examined.