Explainer
A kill switch stops your traffic when the VPN tunnel drops, so it cannot carry on unprotected without your noticing. Kill switches differ in what they cover, and the differences decide when one actually helps.
When a VPN tunnel drops, your device can quietly fall back to its ordinary connection. Your apps carry on, your address is exposed, and nothing tells you. A kill switch blocks traffic when that happens, so a failure leaves you offline and not exposed.
The glossary gives the short definition. The rest of this page covers the differences, which are larger than the single name suggests.
| Kind | How it works | Where it can fall short |
|---|---|---|
| App-level | Closes the apps you name when the tunnel drops | Everything you did not name keeps its connection |
| System-level, while connected | Blocks all traffic if a connected tunnel fails | Usually allows traffic after you disconnect on purpose, and possibly at startup |
| Always-on | Allows no traffic outside the tunnel at any time | Least convenient: nothing connects until the VPN does |
Names vary between providers, and the same word can cover different behaviour. The documentation should tell you which of these you have, and whether it is switched on. Not every client enables a kill switch by default.
A network with a login page cannot show that page while all traffic is blocked. To get online you may have to relax the block briefly, and that short gap is one a kill switch cannot cover. It is worth knowing before you are trying to connect at an airport, because your apps can all send traffic during that gap.
You can test the behaviour you actually have. Connect to the VPN, keep a page loading continuously, then stop the tunnel in a way the app did not intend, such as ending its process or cutting the network briefly. Traffic should stop, and it should not resume until the tunnel is back.
Repeat this after a major app or system update, as behaviour can change. Mobile systems also have their own settings for this: phones may offer an always-on VPN option that blocks connections made outside the tunnel.
A kill switch only acts on traffic leaving outside the tunnel when the tunnel has failed. A DNS or IPv6 leak can occur while the tunnel appears healthy, and these need their own fixes. Apps you exclude through split tunnelling go around it too.
A record on this site states whether a provider offers a kill switch, as published with a source and a date. The register does not run the software, so you will not find a test result there. It is one field among many, and the security score depends on other questions.
If your reason for using a VPN is that your traffic must not reach the network unprotected, yes. If you mostly use one for occasional convenience, a brief gap may not matter to you. It depends on how much one unprotected minute would cost you.
Often because it is doing its job: the tunnel is down and traffic is being blocked. Reconnecting or choosing another server usually restores it. Hotel and airport networks can also cause this, because their login page cannot load while traffic is blocked.
It depends on how it is built. A rule held in the system firewall can stay in force after the app stops. One that depends on the app running may stop along with it, so check how your provider's version behaves.
Next
Every explainer ends by naming the pages that own what it only touched.
Public Wi-Fi is less dangerous than the advertising says, because HTTPS already seals most of what you send. A VPN still hides which sites you reach, and some real risks remain that it does nothing about.
A DNS leak happens when your VPN carries your traffic but the name lookups go around it, which shows your network the sites you visit. This page covers why that happens and how to check for it.
"Independently audited" can describe very different pieces of work. This page covers the kinds of audit, what each one can show, and the questions to ask before an audit changes your mind about a provider.
Both make a request from another address. A VPN normally carries all your device's traffic and encrypts it; a proxy usually handles one app and may encrypt nothing at all. Here is how to tell which one you have.
Many people do not. A VPN solves a few specific problems well and does nothing for the rest, so the answer depends on which problem you have. This page goes through the common ones.
A VPN asks you to trust one company. Tor splits your connection across three relays so that no single one sees both who you are and where you are going. They solve different problems, and neither replaces the other.
What happens to a packet between your device and a website when a VPN is on: the handshake, the tunnel, the name lookup and the exit. Each step also explains one way a VPN can fail.
In most of the world, using a VPN is legal. A short list of countries restricts, licenses or blocks them, and what you do through one is a separate question everywhere. This page is a map of that, not legal advice.
Running a VPN costs money every month, so a free one is paid for by something. This page sets out what that usually is, what has gone wrong in practice, and how to tell a sample from a business model.
A VPN protects one stretch of the path: your device to its server. This page covers everything outside that stretch, from your browser and your accounts to malware, a dropped tunnel and the claims made in the advertising.
One encrypted hop between your device and the internet. This page is the starting point for the section: what the hop does, who it hides you from, who it hands the view to instead, and which of the promises made for it survive contact with the mechanism.
Not an explainer but the model itself, for a reader who got to the end of this page and wants to know how the judgement is made.
What the register knows about this market as a whole, and what it does not — every figure from the index, none from a survey.