Some free VPNs are safe and many are not. Running a VPN network costs real money for servers and bandwidth, so if you are not paying, something else is. The question is what.
How free VPNs make money
- Selling or sharing your data. Browsing and device information can be sold to advertisers or data brokers.
- Showing ads or injecting trackers into the apps or the pages you visit.
- Selling your bandwidth. The best known case is Hola, a free VPN whose users' connections were resold through a commercial proxy network, which in 2015 researchers showed could also be used to carry traffic for others through your IP address.
- Upselling a paid plan. This is the benign model: a limited free tier funded by paying users, often from a recognised provider.
A well-known data-harvesting example is Onavo Protect, a free VPN bought by Facebook in 2013, whose usage data fed the company's analytics until it was shut down in 2019.
Technical risks
Academic and journalistic audits of free VPN apps, especially on Android, have repeatedly found embedded trackers, missing or weak encryption, and DNS or IPv6 leaks. A VPN sits between you and the entire internet, so a bad one is worse than none: it sees everything your ISP would and may share it. Test any VPN with our DNS and WebRTC leak tests.
How to evaluate any VPN, free or paid
- Who owns it, and where? A named company with an address and a track record beats an anonymous app.
- Independent audits of the no-logs claim and the apps.
- A clear privacy policy saying what is logged and what is not.
- Modern protocols such as WireGuard or OpenVPN, plus a kill switch.
- Reviews that are not affiliate-driven. Many "best VPN" lists are paid placements, including some on websites like ours, which is why we label links and publish the tests.
- Run the tests yourself and read the results, not just the marketing.
What to use if you cannot pay
Use Tor Browser for anonymity, free and run by a non-profit project. The free tier of a reputable paid VPN is also reasonable, with a data cap and fewer servers. For public Wi-Fi, sticking to HTTPS sites and turning off sharing is often enough. Read VPN vs proxy vs Tor.