How to uninstall a VPN

Before you start

A VPN client is two things: an application you can see, and a network layer you cannot — an adapter, a driver, a system extension, a profile, a system-level rule that routes everything through it. The uninstaller removes the first and often leaves the second, and the second is what keeps a machine offline, resolving names through a resolver that no longer answers, or blocking every connection on behalf of an app that is gone. This guide removes both.

Two things in every case. Disconnect first, and quit the client fully rather than closing its window; a client holding a tunnel refuses to be removed. And sign in to the provider’s website afterwards to remove the device from the account, which frees the slot and invalidates the key the client held. The steps below are the same whichever provider you had, which is why none is named here.

Windows

1. Disconnect, then quit from the tray. Right-click the client’s tray icon and choose Quit or Exit; closing the window only hides it, and the background service keeps the adapter alive.
2. Uninstall the app from Settings. Settings › Apps › Installed apps, the client, Uninstall. Use this rather than deleting the folder: the uninstaller is what stops and removes the background service and, on a well-behaved client, the adapter with it.
3. Check Network Connections. Open ncpa.cpl. An adapter still listed under the provider’s name, or a generic tunnel adapter nothing else uses, is a leftover. Right-click it: if Delete is offered, take it; if not, it belongs to a driver.
4. Remove the driver in Device Manager. Under Network adapters, find the tunnel adapter, Uninstall device, and tick Attempt to remove the driver for this device when offered. Without the tick, Windows keeps the driver in its store and the adapter can come back.
5. Put DNS back. On your real adapter, Properties › Internet Protocol Version 4 › Properties: the DNS has to be Obtain automatically unless you set it yourself before the client. The same under Version 6. A client that wrote its resolver here and did not clean up is the common cause of a machine that connects and loads nothing.

macOS

1. Disconnect, then quit from the menu bar. The menu bar icon’s own Quit, not the red button on a window.
2. Use the client’s own uninstaller if it has one. It is usually inside the app’s menu or in its folder, and it is the only thing that knows to remove the system extension cleanly. Failing that, drag the app from Applications to the Bin and continue.
3. Remove the system extension and the login item. System Settings › General › Login Items & Extensions: under Network Extensions or VPN & Filters, the provider’s entry, remove or switch off; under Open at Login and Allow in the Background, the provider’s entry, remove. The extension is what carried the tunnel, and it survives the app being binned.
4. Check the VPN list. System Settings › VPN, or Network on a configuration the client created there: a configuration left under the provider’s name is removed with the minus or the information button’s Remove.
5. Put DNS back. System Settings › Wi-Fi, the network’s Details, DNS: an address the client wrote there is removed, and the list is left empty for automatic.

Android

This is the platform the guide exists for. Android’s always-on VPN and Block connections without VPN belong to the system, not the app, and uninstalling the app does not clear them: the phone goes on blocking every connection that does not pass through an app that no longer exists. The symptom is a phone that shows full signal and loads nothing.

1. Clear the binding first, while the app still exists. Settings › Network & internet › VPN, the gear beside the client, and turn off Block connections without VPN, then Always-on VPN. Doing this before the uninstall is the whole trick; what those switches are is its own page.
2. Disconnect in the client, then uninstall it from the Play Store or by holding its icon and choosing Uninstall. Both are the same uninstaller.
3. Check the VPN list again. The entry should be gone. If a stale entry remains, its gear still opens, and the two switches are turned off there.
4. Check Private DNS. Settings › Network & internet › Private DNS: if the client or you set a named resolver there, put it back to Automatic unless it was your own choice before.

iOS

1. Disconnect in the client, and turn off any connect on demand or always-on option the client offers, so the system is not asked to bring the tunnel back the moment you leave the app.
2. Remove the app by holding its icon and choosing Remove App › Delete App. iOS removes the app’s own VPN configuration with it on a well-behaved client.
3. Check the VPN list. Settings › General › VPN & Device Management: a configuration still listed under the provider’s name is opened with its information button and deleted. A client installed through a profile rather than the App Store has an entry under Device Management on the same screen, and that profile is removed there.
4. Check DNS only if you set one: iOS has no system resolver setting a client can write to, but a DNS profile under Device Management is the one way one gets there, and it is removed on the same screen.

Confirm it is actually gone

1. A page loads. Any page, on the plain network. If the machine connects and nothing loads, read the troubleshooting below: it is the binding or the DNS, in that order.
2. Names resolve from your own network. Open any “what is my IP” page or a DNS leak test and read the resolvers: they belong to your internet provider or to the resolver you chose yourself, and not to the provider you removed. Why that is the thing to read is its own page.
3. No adapter, extension or profile is listed. Network Connections and Device Manager on Windows, Login Items & Extensions on macOS, the VPN list on Android, VPN & Device Management on iOS: nothing under the provider’s name.