A free VPN can be safe, but many aren't: researchers have found free Android VPN apps that leak DNS and IPv6 traffic, embed trackers or even intercept encrypted traffic. You can sort the good from the bad in a few minutes with ten checks. The first is always the same: who pays for it, and do they say so?
A VPN sees every connection your phone makes. That's the whole point of it, and it's also why choosing a bad one is worse than using none. The good news: you don't need to be an engineer to tell them apart. These nine checks take a few minutes, and most of the answers are on the provider's website or its Google Play listing.
Why "free" deserves a closer look
Running a VPN costs money: servers, bandwidth, people. If you don't pay, someone else does, and the question is what they get in return. That isn't hypothetical. A study of 283 Android apps that use the VPN permission, presented at the Internet Measurement Conference in 2016, found apps with insecure tunnels, apps leaking DNS and IPv6 traffic outside the tunnel, apps embedding tracking libraries and some intercepting encrypted connections. The paper is listed in the sources below.
None of that makes every free VPN dangerous. It means the burden of proof is on the app.
The 9 checks
1. Who pays, and do they say so?
Look for a plain answer on the website: a paid plan that funds the free one, a sponsor, the project's own money. "We're free because we care about privacy" isn't an answer. No answer at all is a red flag.
2. What does it keep, in writing, with time limits?
"No logs" on a banner means little. A good privacy policy lists what is stored, in what form and for how long, row by row. Our guide on what "no logs" really means shows what to look for.
3. Is there a company you can identify?
A name, a country, an address and a legal notice. Jurisdiction decides which courts can ask for data, and a company you can find is a company you can hold to its word.
4. Does it embed ad or tracking SDKs?
Ad and analytics libraries in a VPN app are a bad sign: the app that protects your traffic shouldn't be profiling you. The listing's Data safety section declares what the app collects and shares; privacy tools that scan apps for known trackers can confirm it.
5. Which permissions does it ask for?
A VPN needs Android's VPN permission and network access. It has no reason to read your contacts, storage or SMS. If it asks for location, it should say exactly why. The VPN permission itself triggers a scary-sounding Android warning for every VPN app; our help article on that permission explains what it means.
6. Does it leak?
Connect, then test. Your public IP should be the VPN's, your DNS server should be the VPN's, and IPv6 should either go through the tunnel or be blocked. A free IP and WebRTC check in the browser shows what websites see.
7. Which protocol does it use?
WireGuard, or a well-reviewed configuration of OpenVPN or IPsec. Be wary of "proprietary encryption" that nobody outside can examine.
8. Is there a kill switch?
On Android, the most reliable one is built into the system: Always-on VPN plus Block connections without VPN. A good app tells you how to turn them on instead of promising a switch of its own that the system can't back up.
9. Is there a transparency report and a security contact?
A page that counts requests from authorities and abuse reports, and a way to report vulnerabilities (a security page or a security.txt file), show a provider expects to be held accountable.
How PryVPN does on the same checks
We'd be asking you to hold other apps to a standard we don't meet if we skipped this. So here's our own row, including the gaps.
| Check | PryVPN |
|---|---|
| 1. Who pays | Yes: the beta is paid for by the project itself; no ads and no data sold. See why PryVPN is free |
| 2. What it keeps | Yes: every row of the privacy policy has a form and a period; what we store and who pays summarizes it |
| 3. Identifiable company | Not yet: the legal entity isn't published |
| 4. Ad or tracking SDKs | None: no advertising or analytics SDKs, no Firebase |
| 5. Permissions | VPN, network and notifications; location only if you add a trusted Wi-Fi network, because Android shares Wi-Fi names only with apps that have it |
| 6. Leaks | An in-app leak test for IP, DNS and IPv6 |
| 7. Protocol | WireGuard; a stealth mode carries it inside TLS 1.3 on port 443 |
| 8. Kill switch | The app opens Android's Always-on VPN settings for you |
| 9. Transparency | A transparency page, a security page and security.txt |
One of the nine is still "not yet". We'd rather you knew that before installing than after.
Red flags that should end the search
- No privacy policy, or one that only says "we don't sell your data".
- A request for permissions unrelated to networking.
- "Military-grade", "100 % anonymous" or "unlimited, fastest, best" with nothing behind it.
- A download offered as an APK from a website instead of a store you trust.
- Reviews that praise the app but never mention what it does.
Frequently asked questions
Are paid VPNs automatically safer?
No. Paying removes one reason to monetize your data, but the other eight checks still apply. A paid app with ad SDKs or no written retention periods fails just the same.
Is a free VPN better than no VPN on public Wi-Fi?
A trustworthy one, yes: it hides the sites you visit from the network. An untrustworthy one moves the risk from the café's Wi-Fi to a company you know nothing about. Our guide to public Wi-Fi covers what the network can see.
Can I check an app's trackers myself?
Partly. The Data safety section on Google Play is the developer's own declaration. Tracker scanners that analyze the app package give you an independent view of which known libraries are inside.
If PryVPN passes enough of these checks for you, join the beta, and tell us which check you'd want us to close first.
Sources
- Ikram et al., An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps (IMC 2016)
- Google Play Help: the Data safety section
- App Defense Alliance: Mobile Application Security Assessment (MASA)
- Play Console Help: Google Play's VpnService policy
- Privacy Guides: VPN recommendations and criteria
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
