Guide
How to use a VPN browser extension
What a provider’s extension covers — the browser and only the browser — the browser’s own store and nothing else, the two settings that decide whether the browser leaks round it, and how to tell it apart from the app. Written against the current Chrome and Firefox.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, against a published score rather than against a listing in a store.
Install the extension from the browser’s own store, through the link on the provider’s own site, never from a search of the store by name. An extension reads and rewrites every page the browser loads; the extension stores are full of look-alikes that were built to be exactly that, and a free one with a familiar name is the usual shape of it.
The first step is not a click. A browser extension covers the browser’s traffic and nothing else: every other program on the machine — mail, the system’s updates, a second browser, anything that syncs — is outside it, on the plain network, while the extension says connected. And most extensions are a proxy rather than a tunnel, which is a different mechanism with different limits; VPN or proxy explains the difference, and this page assumes you have read it. If you want the whole machine inside, you want the app, and the platform page lists which providers in the register publish an extension at all.
Install the extension
- Sign in on the provider’s website first and follow the extension link from the account area to the browser’s store. That way the listing you install came from the session that proved you have a subscription, and there is nothing to search for.
- Read the developer line on the store listing before adding it. It has to be the provider, not a name near it, and the permission list has to be what an extension of this kind needs — proxy settings, privacy settings, the sites you visit — and nothing stranger.
- Sign in to the extension with the same account. If it asks to be pinned to the toolbar, agree: an extension you cannot see is an extension whose state you cannot read.
- Decide its scope before connecting. Chrome and Firefox both run extensions per profile, and by default not in private windows. If you want it in private windows, the browser’s extension settings have to say so; otherwise a private window is a window the extension does not cover, and nothing on its icon will tell you.
The two settings that decide whether it holds
An extension cannot have a kill switch in the app’s sense — the browser decides what leaves, not the extension — so the settings that matter are the ones that stop the browser going round it. Each term has an entry in the glossary.
WebRTC
The browser’s real-time calling layer can tell a page the machine’s own addresses, and it does so outside the proxy. Every serious extension has a WebRTC leak protection or block WebRTC switch; turn it on. Firefox has a setting of its own for the same thing, and the two do not conflict. The cost is that in-browser calls may stop working while connected, which is the switch doing what it says.
DNS
With a proxy, name lookups are the browser’s business, and the browser has its own opinion: Secure DNS or DNS over HTTPS, when switched on to a named resolver, sends every lookup to that resolver round the extension, and the extension’s own DNS protection cannot see it. Either leave the browser’s secure DNS on its automatic setting so the extension can route lookups, or accept that a third party sees the names. Why that matters is its own page.
The extension beside the app
Running both at once is allowed and rarely useful. The browser’s traffic leaves through the app’s tunnel and then through the extension’s exit, two hops, two sets of slowness, and the address a site sees is the extension’s. Most extensions can be told to stand down while the app is connected; set that, so the app decides, and use the extension on its own only where the app cannot be installed.
Confirm it is actually working
Connect, then check. An extension needs a check the app does not: the one that shows what it leaves outside.
- The browser’s address changed. Open any “what is my IP” page in this browser and confirm the country matches the exit you chose. In a private window as well, if you expect it to cover one.
- WebRTC and DNS agree. Run a leak test in the same browser and read both halves: the addresses the page can learn through WebRTC, and the resolvers it sees. Anything belonging to your internet provider means one of the two settings above did not take.
- Something else on the machine did not change. Open a second browser, or any program that reports the public address, and look. It shows your own country. That is not a failure; it is what an extension is, seen from outside, and the moment you want it otherwise you want the app.
What those checks prove
+This browser’s traffic is leaving through the exit you chose
+The browser is not telling pages your own address through WebRTC or your resolver through DNS
+You have seen, not assumed, where the extension’s cover ends
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: your logins, cookies and the browser itself are unchanged, see what a VPN does not do
−A browser update can switch secure DNS back on, and the extension will not notice
When an extension is enough, and when it is not
It is enough on a machine where you cannot install anything — a shared or managed computer, a library terminal that allows extensions, a laptop whose administrator is not you — and where what you want covered is what you do in this browser. For that case it is the honest tool, and the settings above are the whole of making it hold.
It is not enough when the question is the machine rather than the browser: a laptop on public Wi-Fi, where mail, updates and every other program are the traffic you wanted hidden; a machine where a kill switch matters, which an extension cannot provide; or any case where you have read connected and stopped thinking about the rest. The app covers the machine; the extension covers a window. Keep the difference in mind and both are useful.
When it does not work
A leak test in the browser shows my real address
Two usual causes. WebRTC: the browser’s real-time calling layer can report the machine’s own addresses to a page, round the extension; turn on the extension’s WebRTC protection, or the browser’s own setting where it has one, and run the test again. Or the extension is not active for this tab: a private window, a profile or a site excluded by rule.
If both are ruled out and the test still shows your address, the extension is not carrying this browser and should be removed and reinstalled from the store.
The extension says connected but a site still says it sees a VPN
It can. Exit addresses are published and widely listed, so any site that wants to know can look yours up, extension or app. An extension hides the browser’s traffic from the network carrying it; it does not disguise itself from the site you arrive at, and nothing in its settings changes that.
Pages load slowly or some will not load at all
A proxy exit far from you adds a round trip to every request, and a page makes many. Pick an exit closer to you and try a second one in the same country. A site that will not load at all over the extension while loading fine without it is a site refusing the exit’s address, which is its decision and not a setting of yours.
The extension and the app disagree about where I am
Then both are on and the browser’s traffic is leaving through the app’s tunnel first and the extension’s exit second. That works, slowly, and the address a site sees is the extension’s. Decide which one carries the browser and turn the other off for it; most extensions can be set to stand down while the app is connected.
I cannot install the app on this machine
Then the extension is the honest option and this page is for exactly that case. Know what it covers — this browser, in this profile — and what it leaves outside: every other program on the machine, the machine’s own updates and sync, and the other browsers. For the difference in mechanism, read VPN or proxy.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.