You leave home in the morning, and your phone switches from your router’s Wi-Fi to 4G. At the station, it automatically joins the Wi-Fi network it saved the day your train was delayed. In the evening, you turn your computer back on at home. Should your VPN stay on the whole time?
On networks you do not control, yes, and it is best if that happens without you having to think about it. At home, it is a choice rather than a necessity. And when a website will not let you in or the printer stops responding, it is better to adjust the VPN, or turn it off for a moment, than to keep trying.
Where keeping it on really makes sense
On a network you do not control
Hotels, trains, cafés, holiday rentals: you do not know who runs the network or how it is set up. As France’s data protection authority, the CNIL, points out (in French), it is very easy for a hacker to set up a Wi-Fi hotspot using a restaurant’s name. It recommends sending personal data over your mobile network and, failing that, sticking to HTTPS sites and using a VPN.
HTTPS already encrypts the content of your communications with most websites. A VPN adds something else: whoever runs the network can normally no longer see which sites you are visiting, only a connection to the VPN server. Our public Wi-Fi guide explains which risks the tunnel reduces and what other precautions to take on these networks.
When your phone switches networks without asking
This is the strongest argument for an always-on VPN. A phone can reconnect on its own to a saved Wi-Fi network as soon as it is back in range. Indeed, the CNIL recommends limiting automatic connection to your office and home networks.
If you have to remember to turn the VPN on, it may well be off at the very moment your phone changes networks. Once it is set up to stay on permanently, you no longer need to think about it.
What a VPN does not do, even when it is on
A VPN protects the route your data takes, not what you do with it. A fake website still receives your password, even through the VPN’s encrypted tunnel. A malicious attachment is still malicious, and an account whose password has leaked is still exposed.
The Electronic Frontier Foundation (EFF), a US non-profit that defends civil liberties online, believes that adverts for VPNs vastly overstate their benefits. It points to strong passwords, two-factor authentication and software updates as more effective. A VPN does not make you anonymous either: a signed-in account or cookies are enough to recognise you.
At home: a choice rather than a necessity
Under your own roof, you normally know who connects to your Wi-Fi. That leaves your internet provider. Thanks to HTTPS, it cannot see the specific pages you visit or what you type into them. But, as the EFF’s guide to choosing a VPN explains, it can see the names of the sites you connect to and when you visit them.
With the VPN on, this information is hidden from your internet provider. It does not disappear, though: it is now the VPN provider that can see it. So keeping the VPN on at home means shifting your trust from one to the other. If you trust your VPN service more than your internet provider, keeping it on makes sense. If not, you do not have to.
Another limitation: a VPN app only covers the device it is installed on. Your TV or games console still goes through your router, just as before.
The price of an always-on VPN
Speed and response time. Your data takes a detour through the VPN server and is encrypted along the way. Depending on how far away the server is and how busy it is, you may not notice any difference, or you may well feel it, especially in activities where the slightest delay matters, such as online gaming. If in doubt, test your connection with and without the VPN, following the method in our guide on why a VPN can slow down your connection.
Battery. Keeping the tunnel up and encrypting all your traffic makes your phone do a little extra work; how much depends on the model and how you use it. After a few days, check your battery settings to see whether the VPN app is one of the most power-hungry.
CAPTCHAs. Google explains that its message “Our systems have detected unusual traffic from your computer network” can appear when other people using the same VPN as you are sending automated searches. Most of the time, you then just need to solve a reCAPTCHA (tick a box, and sometimes pass a quick picture test).
Services that refuse VPNs. Some block connections that appear to come through a VPN. Netflix, for example, asks you in its help centre to turn off your VPN or proxy, explaining that a VPN can make it look as if you are connecting from somewhere else.
When to turn it off, or rather adjust it
A website or your bank refuses to let you in
If a service blocks access or keeps making you go through extra checks while the VPN is on, start by choosing a server in your own country. If that is not enough, turn the VPN off while you finish what you are doing, preferably at home or on mobile data rather than on public Wi-Fi.
Your printer or TV stops responding
Depending on the app and its settings, traffic meant for devices in your home may also be sent into the tunnel, or blocked: your computer can no longer find the printer, and your phone no longer sees the TV. Check whether your app offers a local network option. If it does not, disconnect the VPN to print or cast the video: you are at home, on your own network.
An app needs to know where you are
A service that locates you from your IP address (local weather, content restricted to one country) sees the VPN server’s address instead and will usually place you in that server’s region. Choosing a server close to home may be enough. The VPN does not change your phone’s GPS position, however: if the app has access to it, turning off the VPN will not make any difference.
The classic trap: forgetting to turn it back on
You turn off the VPN “just for this site”, and it stays off until the next day, including when your phone joins the station’s Wi-Fi again. Turn it back on as soon as you have finished, before you even close the page, and check that the VPN icon has reappeared. On Android, if you have turned on “Always-on VPN” and “Block connections without VPN”, turning off the VPN also cuts you off from the internet: switch these options off in Settings first, and turn them back on straight afterwards.
Making an always-on VPN reliable
So that you no longer depend on your memory, two mechanisms work together: a VPN that starts on its own, and a block that stops traffic from getting out when the tunnel drops.
On Android: “Always-on VPN” and blocking connections without VPN
Since version 8.0, Android has offered two settings, described in its developer documentation. With “Always-on VPN”, the system starts the VPN when the phone boots and keeps it running as long as the device is on. With “Block connections without VPN”, it blocks any traffic from your apps that does not go through the VPN: if the tunnel drops, they do not quietly fall back on your normal connection.
The trade-off is deliberate, and Android warns you about it when you turn the option on: until the VPN connects, you have no internet at all. If the always-on VPN drops or cannot connect, a notification you cannot dismiss remains until the VPN is back. The notification also disappears if you turn the option off yourself, and nothing will then remind you to turn it back on.
This block is not absolute, however: the system lets a small amount of technical traffic bypass the tunnel, such as the connectivity checks it runs when it joins a Wi-Fi network. Google stands by this behaviour, which was reported in 2022 by the tech news site BleepingComputer.
These switches are in your phone’s Settings, under VPN: tap the cog icon next to your app’s name (if necessary, type “VPN” into the search bar). Their names and location vary with the Android version and the manufacturer. If they are greyed out and marked “Not supported by this app”, the app does not support always-on VPN; on a phone managed by an employer, the administrator may also have locked them.
One case worth knowing about: some hotel and train Wi-Fi networks make you go through a sign-in page before the VPN can connect. If the page does not appear, turn off the block so you can get past it, then turn it back on straight away.
On Windows: the app’s kill switch
Blocking is usually handled by the VPN app’s kill switch. Check that it is turned on, and look in the software’s help section to find out when it cuts traffic and what restores it. It will not start the VPN for you, however: when you switch on your computer, make sure the VPN has actually connected.
With FuzeVPN, for example, the Windows app’s kill switch takes effect as soon as you start connecting and, if the connection fails, keeps traffic blocked until you choose to disconnect. So if the internet seems to be down on your computer, check the VPN’s status before blaming your router.
A browser extension, even one left on all the time, usually covers only the browser: your other apps, email and messaging included, bypass the tunnel.
On iPhone: it all depends on the app
The “Always-on VPN” built into iOS is intended for iPhones managed by an organisation, such as a company or a school, and only works with the IKEv2 protocol. Since iOS 27, it no longer requires a “supervised” device, as Apple’s documentation states. On a personal iPhone, look instead in your VPN app’s settings for an option to connect automatically or to block traffic if the connection drops.
Frequently asked questions
Should you keep the VPN on when using mobile data too?
Your mobile network is not an unknown Wi-Fi network: it is actually the one the CNIL recommends using instead (in French). So the same reasoning applies as at home. The real benefit of keeping the VPN on over 4G or 5G is that it will still be on when your phone switches to Wi-Fi. The VPN also uses a little more data, which counts towards your allowance like the rest.
Which devices should have the VPN on first?
The ones that leave the house with you. Start with your phone, since it is the one that switches networks without asking: on Android, turn on “Always-on VPN” and “Block connections without VPN”, then leave them on for a few days. Note what actually causes problems, such as a website or the printer, and deal with each case one at a time, by changing server or turning the VPN off when needed rather than disabling everything. On your laptop, turn on the kill switch before your next trip, and each time you start it up, check that the VPN is connected.