Is a Free VPN Safe? What You Can Verify From Your Own Device

The word “safe” hides the important part of this question. Installing any VPN, free or paid, places an operator directly in your traffic path and gives a program on your device permission to rewrite how that device reaches the network — those are not risks of a bad service, they are the mechanism of every service. So the useful question is narrower: given that this is structurally true, which specific risks does a free offer make more likely, and which of them can you detect yourself rather than take on faith?

Quite a lot of them, as it turns out. This page names no service and recommends none; it is a list of checks you can run.

What you consent to by installing any tunnel client

Being clear about the baseline stops the free-versus-paid argument from doing work it cannot do.

A VPN client is not an ordinary application. To function it creates a virtual network interface, edits your routing table so that traffic prefers that interface, and usually changes which resolver your system uses. On most platforms it needs elevated privileges to do this, and it typically installs a component that keeps running whether or not you have the window open. Any software with that position can see the traffic it carries, and can decide what to do with traffic you thought was inside the tunnel.

None of that is a defect. It is what a tunnel is. The consequence is that the decision is not “is this app safe” in the way you would ask of a note-taking app — it is “am I willing to give this specific party that position on this specific device”, which is a question about the party.

Where a free offer changes the risk

Three differences are real, and they are narrower than the usual warnings.

The party is more often unidentifiable. A subscription requires a payment relationship, and payment relationships tend to leave a company name behind. A free installation requires nothing, so it is entirely possible to hand that position to an operator you could not name if asked.

The client is more often a separate, thinner build. Where the free application is not simply the paid one with features switched off, the missing features are usually the protective ones: what happens when the tunnel drops, whether name resolution is forced through it, whether both address families are handled.

The recurring cost is being covered from somewhere you have not been told about. Not automatically sinister, but it is an open question, and the honest response is to close it before installing rather than after. Reading a free offer as a specification, including the funding question, is the subject of there is no best free VPN, only limits that fit or do not.

What does not change with price is the boundary of what a tunnel does at all. It carries traffic; it does not inspect it for malicious content, it does not protect an account you have signed into, and it does nothing about a device that is already compromised. Anyone suggesting the free-or-paid choice moves that boundary is describing a different category of product.

The checks your own machine can perform

This is the part that turns an opinion into an observation. Every item below is something you can establish in an evening, on the device in front of you, with no cooperation from the operator.

Which resolver you are actually using. Connect, then read the resolver your system has been given and see whether lookups are going through the tunnel or still being answered by whatever your network handed you. If they are not inside the tunnel, the list of names you asked for never left the network you were trying to keep it from — the mechanics are in what your VPN’s DNS setting actually changes, and why the resolver’s identity matters is in who runs your DNS resolver.

Whether both address families are carried. If your network offers the newer address family and the tunnel handles only the older one, some traffic can leave outside the tunnel while the application reports a healthy connection.

What the routing table says. Before and after connecting. This shows you what the client actually did, as opposed to what it claims, and it is the single most informative artefact available to you — how to read your own network settings covers where to find it on each platform.

What happens in the seconds after a drop. Force one deliberately by disabling the network interface the tunnel runs over. Watch whether traffic stops or quietly continues without the tunnel while the interface still shows a reassuring state. A client that misreports its own status has told you something no review could.

Whether anything was installed beyond the tunnel. A certificate added to your system’s trust store, a browser extension, a second background service, a helper that starts at boot. A tunnel does not require a new trust anchor to function, so finding one is a question worth answering before you continue.

What the client asks of the device. On mobile especially, compare the permissions requested against what carrying packets requires. Location, contacts and device identifiers are not inputs to a tunnel.

Identifying who is actually running it

The operator’s identity is the thing you most need and the thing least often stated plainly, so approach it from several directions and look for consistency.

Start with the terms and the privacy policy, which normally have to name a legal entity somewhere, and note whether that name matches the brand on the website. Then check the publisher name on the application listing — it is a separate assertion and the mismatches are informative. Look at who is named in the payment flow if there is a paid tier, since money leaves a clearer trail than marketing does. Search the entity name on its own and see what else it operates. Finally, note whether the operator publishes anything at all about legal demands it has received, because a company willing to describe that process has at least accepted that it exists.

If several of these disagree, or if you cannot find an entity name anywhere, you have your answer. Not “this is malware” — just that you have been unable to identify the party you were about to place in your traffic path, which is sufficient reason to stop.

The reasonable position

Free services are not uniformly unsafe, and the version of this advice that tells people who cannot pay to use nothing on a network they do not control makes them worse off, not safer. What is fair to say is that a free offer removes the paper trail that would otherwise identify the operator for you, and thins the parts of the client that behave well when things go wrong — and both of those gaps are ones you can close yourself with an hour of checking.

Do the checks, decline the offers you cannot attribute to anybody, and keep in mind that the tunnel’s real limits are the same at every price.