A kill switch stops your phone from sending traffic outside the VPN when the tunnel drops. On Android the reliable one is built into the system: open Settings › Network & internet › VPN, tap the gear next to your VPN app and turn on both Always-on VPN and Block connections without VPN. Always-on keeps the VPN running; the blocking switch is what stops leaks.
A VPN protects you only while the tunnel is up. Tunnels drop for ordinary reasons: you walk from Wi-Fi to mobile data, the phone wakes from deep sleep, the app updates, or a battery saver closes it. For those few seconds, or longer, your apps keep sending data. A kill switch decides what happens to it.
On Android, the most reliable kill switch isn't a button inside a VPN app. It's two settings in Android itself, and they don't do the same thing. This post compares them: what each one changes in the gap while the VPN is down. For the steps inside PryVPN, see our Kill Switch help article; to make the VPN start by itself, see our guide to auto-connecting a VPN on Android.
What a kill switch does, and why the app alone isn't enough
A kill switch has one job: when the VPN isn't connected, nothing goes out over your normal connection.
A VPN app can do part of that itself. While it's running and reconnecting, it can hold your traffic inside its own tunnel interface instead of letting it out. But if the app is closed, crashes, or is stopped by a battery saver, it can't block anything, because it isn't running. Only the operating system can guarantee the block in every case, and Android has offered exactly that since Always-on VPN arrived in Android 7.0.
The two Android switches
| Setting | What it does | What it doesn't do |
|---|---|---|
| Always-on VPN | Starts your VPN app when the phone boots and keeps it running; Android restarts it if it stops | On its own, it doesn't block traffic while the tunnel is down |
| Block connections without VPN | Blocks every app's internet access whenever the VPN isn't connected | Needs Always-on turned on first; a few system checks may still bypass it |
Android's developer documentation describes the second one plainly: "The system blocks any network traffic that doesn't use the VPN." You want both.
How to turn on the kill switch
- Open Settings › Network & internet › VPN. On Samsung phones it's Settings › Connections › More connection settings › VPN. Menu names vary a little by brand and Android version.
- Tap the gear next to your VPN app.
- Turn on Always-on VPN.
- Turn on Block connections without VPN.
Google's own help page, Connect to a VPN on Android, shows the same path. In PryVPN, Settings › Kill Switch › Open VPN settings takes you straight to that screen, and our Kill Switch help article walks through it.
What changes day to day
The blocking switch is strict on purpose. Expect these side effects:
- Disconnect means no internet. If you tap Disconnect in the VPN app, your apps stay offline. To use your normal connection, turn Always-on off.
- Wi-Fi login pages may not open. Hotel and airport networks need you to sign in before anything else works, and with blocking on, the login page can't load. Turn Always-on off for a moment, sign in, then turn it back on; our guide to hotel Wi-Fi that blocks VPNs covers the whole routine.
- Apps you exclude from the VPN can lose internet. Split tunneling sends some apps outside the tunnel, and blocking stops everything outside the tunnel.
- Only one app can be always-on. Android runs one VPN at a time per profile, so choose the one you actually use.
What a kill switch can't stop
We'd rather be precise than promise too much:
- A few system checks. On some Android versions, a handful of connectivity checks can bypass any VPN, even with blocking on. They don't carry your browsing, but they exist.
- Android 16 edge cases. Our help pages describe two: after some updates, Android can keep blocking the VPN app's own connection, and a malicious app could send a few packets outside the VPN as its connections close. Install apps you trust.
- Other profiles and devices. A work profile has its own VPN setting, and devices connected to your hotspot don't use your phone's VPN.
- What a VPN never hides. Sites you sign into still know it's you.
How to check it works
- With both switches on, open your VPN app and tap Disconnect. Web pages and apps should stop loading.
- Reconnect, then open our What is my IP tool: it should show the VPN server's address, not your own.
- If the VPN keeps dropping in the first place, the usual culprit is a battery saver. Our guide to VPNs that keep disconnecting on Android has the fix for each brand.
How PryVPN handles it
- Inside its own service, PryVPN keeps your traffic blocked while it reconnects or switches to a backup server.
- Settings › Kill Switch opens Android's VPN screen directly, because the app can't flip those switches for you.
- If Android closes PryVPN to save battery, the app notices and tells you once, with the steps for your phone (battery settings).
- On Android 16, if the system keeps blocking PryVPN's own connection after an update, PryVPN restarts its VPN service up to three times before asking you to toggle Always-on.
Frequently asked questions
Does the kill switch drain the battery?
No. Blocking costs nothing extra. Always-on keeps the VPN running, which it would be anyway while you're protected; with WireGuard that means a tiny keep-alive packet every few tens of seconds.
Is a kill switch inside a VPN app the same thing?
Not quite. An in-app switch works while the app is alive. Android's Block connections without VPN works even when the app isn't running, which is exactly when you need it.
Why can't I sign in to the hotel Wi-Fi?
Because blocking also stops the login page. Turn Always-on off, sign in, and turn it back on.
Can I use it with two VPN apps?
No. Android allows one always-on VPN per profile; starting another VPN stops the first.
If you'd like a VPN that takes you straight to the right settings, you can join the PryVPN beta.
Sources
Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.
