Guide
How to set up a VPN on Android
The app from the Play Store, the two switches in Android's own settings that matter more than anything inside the app, and how to confirm the tunnel is carrying your traffic on a phone that changes networks all day. Written against Android 17.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a store listing.
Install the app from the Play Store, from the listing the provider’s own site links to. Never install a VPN from an APK file sent in a chat or downloaded from a forum: a VPN app sees every byte your phone sends, and a repackaged one is the most efficient way anyone has ever found of reading it.
Install the app
- Sign in on the provider’s website first and follow its link to the Play Store listing. Store searches for a VPN return lookalikes above the real thing; a link from the account you pay for does not.
- Install, open, and accept the connection request. Android asks once whether the app may set up a VPN connection — that is the system handing the app the tunnel, and refusing it leaves an app that cannot connect. The prompt names the app; if the name is not the one you installed, stop.
- Sign in to the app with the same account. Most apps ask to name the device; the name is stored by the provider, so give it something that does not identify you.
- Do not connect yet. Two of the settings that matter are not in the app at all. They are in Android’s own settings, and they are off until you turn them on.
The settings worth checking
Android is the one platform where the system itself carries the kill switch, so this section starts outside the app. Each setting has an entry in the glossary if the name is unfamiliar.
Always-on VPN and Block connections without VPN
Open Settings › Network & internet › VPN, tap the gear beside the app, and turn on both switches. Always-on VPN makes Android start the tunnel at boot and restart it whenever it drops, without waiting for the app. Block connections without VPN is the kill switch, enforced by the system: while the tunnel is down, nothing on the phone reaches the network.
Take the system switch even if the app offers its own. The app’s switch stops working when the app is killed; Android’s keeps working because it is not the app enforcing it. What a kill switch is for is on its own page; the short version is that a dropped tunnel becomes a dead connection rather than an unnoticed one, and on a phone that changes networks all day that is the whole point.
DNS inside the tunnel
Name lookups can leave the phone outside the tunnel even when everything else is inside it, which tells the network which sites you visited and hides only what you did there. Inside the app, look for DNS leak protection, use provider DNS or a custom DNS field, and set it to the provider’s own resolver.
Android’s Private DNS setting is a separate thing and does not conflict: lookups it sends travel inside the tunnel like everything else. But a Private DNS resolver run by a third party is a third party who sees every lookup, and you are already trusting the provider with the traffic. Adding a second party increases the number of parties without reducing what any of them knows. How a leak happens is on the DNS leaks page.
Battery optimisation
Android’s battery manager, and the manufacturer’s on top of it, stop apps that run in the background for long. A VPN client is exactly such an app. Open the app’s page in Settings › Apps, set battery usage to Unrestricted, and do the same in any manufacturer power manager the phone has. Otherwise the tunnel is dropped in your pocket and the first app that wakes sends its traffic through whatever is there — unless the system switch above is on, in which case it sends nothing.
The protocol
Leave it on the modern default — the protocol page lists which are current and which are legacy. On a phone the modern one also reconnects faster after a change of network and costs less battery. If the app offers an older option to fix a connection problem, that is a trade to make knowingly and then undo: the register marks the weakest protocol a provider still offers, and selecting it by hand is choosing that mark for yourself.
Confirm it is actually working
Connect, then check rather than assume. Three checks, in this order, all of them free and none of them needing another app:
- Your address changed. Open any “what is my IP” page in the browser and confirm the country matches the exit you chose. Do it once on Wi-Fi and once on mobile data: the two are different networks, and a tunnel that holds on one can fail on the other.
- Lookups are inside the tunnel. Run a DNS leak test and read the resolvers it reports. Anything belonging to your mobile carrier or your home internet provider means the DNS setting above did not take.
- The kill switch does what it says. Start a large download, then force-stop the VPN app from its page in Settings › Apps, so the tunnel drops without the app being asked. The download should stop dead and stay dead until the tunnel is back. If it carries on, Block connections without VPN is not on.
The longer battery of tests, including what each one can and cannot show, is its own guide.
What those checks prove
+Your traffic is leaving through the exit server, in the country you selected, on both networks the phone uses
+Neither the carrier nor the Wi-Fi you are on can read which sites you reach
+A dropped tunnel fails closed, enforced by Android rather than by the app
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: the apps signed in on the phone are still signed in, see what a VPN does not protect you from
−A passing test today is not a promise about the next app update or the next phone update
The phone on a bad network
A phone spends its day on networks a laptop never sees: a congested cell, a café captive portal, a train. Three adjustments are worth making and no more. Pick an exit near you, since every extra thousand kilometres is latency on top of a network that already has too much. Switch the protocol once if the modern one will not connect at all, and switch it back the next day. Turn on Always-on VPN, above, so that the reconnection after a tunnel loss is Android’s job rather than yours.
If a network blocks the tunnel on every protocol and every exit, that is a fact about the network. This guide does not go further than naming it.
When it does not work
The connection keeps dropping when I leave Wi-Fi
Every handover between Wi-Fi and mobile data breaks the tunnel for a moment, and a client that reconnects slowly turns that moment into a gap. The modern protocol survives a change of network far better than the older one, so check which the app is using before anything else.
With Block connections without VPN on, the gap is a dead connection rather than a leak. That is the setting working: the phone waits for the tunnel instead of using the bare network.
The app disconnects on its own after a while
Usually the battery manager, not the provider. Several manufacturers add their own aggressive app killer on top of Android's, and a VPN client that is “optimised” is simply stopped in the background.
Exclude the client from battery optimisation in Settings, and from any manufacturer-specific power manager as well. Always-on VPN makes Android restart the tunnel itself when it does drop, which is the second half of the fix.
Everything is slow on mobile data
A longer path on a network that was already slow. Pick an exit closer to you, try a second server in the same country, and switch the protocol once — the modern one is lighter on a phone. If the connection is slow on every exit and fine on Wi-Fi, the mobile network is shaping VPN traffic.
That is a statement about the network, and this guide stops there.
Only one app can use the VPN at a time
Android allows a single active VPN, so a second client, a work profile’s VPN or a DNS app that works as a local VPN will take the slot and silently disconnect the first. Private DNS is the exception: it is a system setting rather than a VPN and runs inside the tunnel.
Uninstall or disable anything else that appears under Settings > Network & internet > VPN before blaming the provider.
A site says it can see I am using a VPN
It can. Exit server addresses are published and widely listed, so any site that wants to know can look yours up. A VPN hides your traffic from the network carrying it; it does not disguise itself from the site you arrive at.
Nothing in the app changes that, and a provider promising otherwise is selling something the mechanism cannot deliver.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.