Running a VPN network costs real money: servers in many countries, bandwidth paid by the terabyte, and people to maintain it. An app giving all that away without limits and without charge still has to cover the cost somewhere.
The question isn't whether you pay, but with what.
What you're actually handing over
A VPN works by wrapping all of a device's traffic and sending it through the provider's server. That's useful on an untrusted network, because the Wi-Fi owner can no longer see where you go. But that vantage point doesn't disappear, it just moves. Now the VPN provider sits in the middle.
Installing a VPN is saying: I trust this company more than the network I'm on. For a service with a clear owner and reputation, that's a reasonable trade. For an app whose maker nobody knows, it's a gamble.
Four ways free VPNs cover their costs
Selling usage data. The list of sites you visit, active hours, rough location, and device type are worth money to advertisers and data brokers. Some apps say so openly in their privacy policy, in deliberately vague language like "sharing information with partners".
Injecting ads and trackers. The app is packed with ad libraries collecting device identifiers. Worse, some insert ads or trackers directly into the pages you open, something only possible because they sit in the path of your traffic.
Selling your connection. Some apps turn users' devices into exit points for other people. Strangers' traffic leaves through your internet address, and if that traffic is used for something illegal, your address is the one on record.
Fake apps that are malicious from the start. Using names and logos resembling well-known services, or downloaded outside official stores with promises of "free premium". Inside can be a password stealer, an SMS reader, or a back door. The disguise works much like phishing over public Wi-Fi, only in app form.
How to judge a VPN app
You don't need to be an expert. These five questions filter out most problem apps:
- Who owns it? A company name, country, and address that can be checked. If all there is is a generic email and a one-page site, skip it.
- How do they make money? A healthy service has a paid tier, and its free tier is deliberately limited by data or server choice. Unlimited free with no explanation is a warning sign.
- What does the privacy policy say? Look for the sections on logs and data sharing. Phrases like "we may share aggregated data with partners" mean your data is being sold in some form.
- What permissions does it ask for? A VPN doesn't need contacts, SMS, photos, or the microphone. Requests like that are reason enough to delete it.
- Has it been audited externally? Serious services publish independent audits of their "no logs" claims. Not essential for light use, but a clear differentiator.
One easy extra rule: install only from the official app store, and check the developer's name, not just the app's. A "free premium" APK from a chat group or download site almost always brings something you don't want.
When you don't actually need a VPN
Many people install a VPN because they feel they should, when the need isn't there:
- On your own home network. You know the router and the internet provider. Important sites use HTTPS, so the content of your communication isn't readable. A VPN here only moves trust, it doesn't add any.
- For banking. Banking apps already encrypt their own connection. Habits matter more, covered in mobile banking security on Wi-Fi.
- To prevent account takeover. A VPN doesn't protect against leaked passwords or fake pages. What works there is two-factor authentication.
A VPN is most useful on public Wi-Fi you don't know, while travelling, or when reaching an office network from outside. Exactly when it helps is explained in VPN for public Wi-Fi, and the basic habits in using public Wi-Fi safely.
Safer options
If you genuinely need one, there are inexpensive middle grounds:
- The free tier of a clearly owned paid service. Limited data, but an open business model: they hope you'll subscribe one day, not sell your data.
- Your workplace VPN for work matters. Run by a team that can be held accountable.
- Encrypted DNS if the goal is simply hiding which sites you visit from the local network. Lighter than a full VPN, covered in public DNS and privacy.
Remember too that a VPN isn't a tool for getting around rules. Blocked sites have their own reasons and mechanisms, explained in why sites get blocked and how it works. If the connection feels heavy once the VPN is on, the usual causes are in slow internet while using a VPN.
If a doubtful app is already installed
Don't panic, but don't put it off:
- Turn off and delete the app, then check the system VPN settings to make sure no profile is left behind.
- Revoke permissions already granted and check whether any other app was installed without you noticing.
- Change passwords for important accounts used while the app was active, starting with your main email.
- Watch account activity for the next few weeks: signed-in devices, transactions, and sign-in alerts from unfamiliar places.
Free is nice. But for an app asking to see all your traffic, the unwritten price is usually the most expensive one.
Frequently asked questions
Are all free VPNs dangerous?
No. There are free tiers of paid services with clear owners, usually limited by data or speed. The risky ones are apps that are completely free with no limits, no clear owner, and no business model that makes sense.
What can a VPN provider see of my traffic?
Everything your internet provider could see, the VPN provider now sees: which sites you visit, when, and for how long. The contents of HTTPS pages stay encrypted, but the list of destinations and your habits are open to them.
Do I need a VPN on my own home network?
For most people, no. On a home network you control, important sites already use HTTPS. A VPN at home only moves your trust from the internet provider to the VPN provider, and often slows the connection.
