Guide
The app from the Play Store, the two switches in Android's own settings that matter more than anything inside the app, and how to confirm the tunnel is carrying your traffic on a phone that changes networks all day. Written against Android 17.
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a store listing.
Install the app from the Play Store, from the listing the provider’s own site links to. Never install a VPN from an APK file sent in a chat or downloaded from a forum: a VPN app sees every byte your phone sends, and a repackaged one is the most efficient way anyone has ever found of reading it.
Android is the one platform where the system itself carries the kill switch, so this section starts outside the app. Each setting has an entry in the glossary if the name is unfamiliar.
Open Settings › Network & internet › VPN, tap the gear beside the app, and turn on both switches. Always-on VPN makes Android start the tunnel at boot and restart it whenever it drops, without waiting for the app. Block connections without VPN is the kill switch, enforced by the system: while the tunnel is down, nothing on the phone reaches the network.
Take the system switch even if the app offers its own. The app’s switch stops working when the app is killed; Android’s keeps working because it is not the app enforcing it. What a kill switch is for is on its own page; the short version is that a dropped tunnel becomes a dead connection rather than an unnoticed one, and on a phone that changes networks all day that is the whole point.
Name lookups can leave the phone outside the tunnel even when everything else is inside it, which tells the network which sites you visited and hides only what you did there. Inside the app, look for DNS leak protection, use provider DNS or a custom DNS field, and set it to the provider’s own resolver.
Android’s Private DNS setting is a separate thing and does not conflict: lookups it sends travel inside the tunnel like everything else. But a Private DNS resolver run by a third party is a third party who sees every lookup, and you are already trusting the provider with the traffic. Adding a second party increases the number of parties without reducing what any of them knows. How a leak happens is on the DNS leaks page.
Android’s battery manager, and the manufacturer’s on top of it, stop apps that run in the background for long. A VPN client is exactly such an app. Open the app’s page in Settings › Apps, set battery usage to Unrestricted, and do the same in any manufacturer power manager the phone has. Otherwise the tunnel is dropped in your pocket and the first app that wakes sends its traffic through whatever is there — unless the system switch above is on, in which case it sends nothing.
Leave it on the modern default — the protocol page lists which are current and which are legacy. On a phone the modern one also reconnects faster after a change of network and costs less battery. If the app offers an older option to fix a connection problem, that is a trade to make knowingly and then undo: the register marks the weakest protocol a provider still offers, and selecting it by hand is choosing that mark for yourself.
Connect, then check rather than assume. Three checks, in this order, all of them free and none of them needing another app:
The longer battery of tests, including what each one can and cannot show, is its own guide.
+Your traffic is leaving through the exit server, in the country you selected, on both networks the phone uses
+Neither the carrier nor the Wi-Fi you are on can read which sites you reach
+A dropped tunnel fails closed, enforced by Android rather than by the app
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: the apps signed in on the phone are still signed in, see what a VPN does not protect you from
−A passing test today is not a promise about the next app update or the next phone update
A phone spends its day on networks a laptop never sees: a congested cell, a café captive portal, a train. Three adjustments are worth making and no more. Pick an exit near you, since every extra thousand kilometres is latency on top of a network that already has too much. Switch the protocol once if the modern one will not connect at all, and switch it back the next day. Turn on Always-on VPN, above, so that the reconnection after a tunnel loss is Android’s job rather than yours.
If a network blocks the tunnel on every protocol and every exit, that is a fact about the network. This guide does not go further than naming it.
Every handover between Wi-Fi and mobile data breaks the tunnel for a moment, and a client that reconnects slowly turns that moment into a gap. The modern protocol survives a change of network far better than the older one, so check which the app is using before anything else.
With Block connections without VPN on, the gap is a dead connection rather than a leak. That is the setting working: the phone waits for the tunnel instead of using the bare network.
Usually the battery manager, not the provider. Several manufacturers add their own aggressive app killer on top of Android's, and a VPN client that is “optimised” is simply stopped in the background.
Exclude the client from battery optimisation in Settings, and from any manufacturer-specific power manager as well. Always-on VPN makes Android restart the tunnel itself when it does drop, which is the second half of the fix.
A longer path on a network that was already slow. Pick an exit closer to you, try a second server in the same country, and switch the protocol once — the modern one is lighter on a phone. If the connection is slow on every exit and fine on Wi-Fi, the mobile network is shaping VPN traffic.
That is a statement about the network, and this guide stops there.
Same steps, other machines
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.
Android allows a single active VPN, so a second client, a work profile’s VPN or a DNS app that works as a local VPN will take the slot and silently disconnect the first. Private DNS is the exception: it is a system setting rather than a VPN and runs inside the tunnel.
Uninstall or disable anything else that appears under Settings > Network & internet > VPN before blaming the provider.
It can. Exit server addresses are published and widely listed, so any site that wants to know can look yours up. A VPN hides your traffic from the network carrying it; it does not disguise itself from the site you arrive at.
Nothing in the app changes that, and a provider promising otherwise is selling something the mechanism cannot deliver.