Explainer
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
Servers and bandwidth cost money every month, so a free VPN is paid for by something. Sometimes that is the people on the paid plan, which is an ordinary arrangement. Sometimes it is advertising, your data or your internet connection, and then the service is making money from the very thing it says it protects.
A VPN provider can see everything your network used to see. That is the trade at the centre of any VPN, and it matters most when the provider has a commercial reason to use that view.
| Who pays | How it works | What it costs you |
|---|---|---|
| Paying customers | The free tier is a limited sample of the paid product | Usually limits on data, speed or server choice |
| Advertisers | The app shows ads, or adds tracking to fund itself | A privacy tool that also carries trackers |
| Data buyers | Activity is collected and sold, sometimes described as anonymised | The record a VPN was supposed to stop anyone keeping |
| Bandwidth buyers | Your connection is resold, and other people's traffic leaves through it | Their traffic appears to come from your address |
Only the first row keeps your interests and the provider's pointing the same way. The other three are businesses in their own right, with the VPN as the way in.
These risks have been documented. Two cases show the range.
Neither case proves anything about a particular service today. Both show why a free label tells you nothing about how the product is built.
Some free services have no exit servers of their own, and traffic leaves through other users' devices instead. The register calls this a P2P exit.
The arrangement works in both directions. Your traffic leaves through a stranger's connection, and a stranger's traffic leaves through yours. If that traffic draws a complaint or an investigation, your address is the one on record, and you will have had no way of seeing what passed through.
You can answer most of this before installing anything.
A free tier and a security score are separate facts. The register can filter by free tier, but it does not count one as a recommendation. Where the money behind a free tier comes from counts under integrity, and a service with a free tier can score well if the rest of its record supports it.
Every record says what has been published about the provider, with a source and a date. The methodology shows how that becomes a score.
No. A free tier that exists to sell the paid plan can be run by the same company, on the same terms, as the paid product. The risk sits with services whose free product is the whole business, because the money has to come from somewhere else.
The useful question is who pays, and the answer should be findable in the provider's own documents.
A VPN needs permission to handle your traffic, and little else. An app that also asks for your contacts, your location or your storage wants something the tunnel does not require.
A permission is not proof of misuse, but it is a question the provider should be able to answer.
Not automatically. Without a VPN, most of your traffic is already protected by HTTPS, and the network sees which sites you reach. With a VPN you do not trust, that same view goes to a company whose income may depend on it.
You would be swapping a stranger you will never meet for one with a business reason to look.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.