Are Free VPNs Safe? What "Free" Actually Costs You

Some free VPNs are safe; most are not. A trustworthy free VPN is usually a limited tier of a paid service that funds itself through subscriptions, not your data. The dangerous majority make money by logging and selling your browsing activity, weakening your encryption, or quietly reselling your bandwidth — which means the "free" tool can leave you less private than no VPN at all.

What "free" actually pays for

Running a VPN is expensive. Servers in dozens of countries, bandwidth, engineering, security audits and app maintenance all cost real money every single month. When you pay nothing, that cost doesn't vanish — it gets recovered somewhere else. Understanding where is the whole story of whether a free VPN is safe.

There are really only two honest ways a VPN can be free. The first is a freemium model, where a paid product subsidises a deliberately limited free tier as a marketing funnel. The second is a non-profit or grant-funded service. Everything else has to monetise the one asset you handed over the moment you installed the app: your internet traffic.

• Selling your data. Browsing metadata, device fingerprints and app usage get packaged and sold to data brokers and advertisers.
• Injecting ads and trackers. The app inserts tracking libraries — or even rewrites the pages you visit — to serve ads.
• Reselling your bandwidth. Your device becomes an exit node in a 'residential proxy' network that strangers pay to route traffic through.
• Cutting corners on security. Weak or absent encryption and leaky apps are cheaper to ship than properly audited ones.

None of these are hypothetical. Each one has been documented repeatedly in independent research, and we'll walk through the evidence below. If you want the short version of which services avoid these traps, our editors maintain a vetted list in the best free VPN guide.

The data-selling problem, by the numbers

The biggest risk with a free VPN isn't that it fails to hide you — it's that it actively profits from watching you. A VPN sees every site you connect to, so a free provider with a data-monetisation business model has a front-row seat to your entire browsing life, and a financial incentive to record it.

The research here is grim and consistent. A long-running investigation by Top10VPN into the most popular free Android VPNs found that 71% shared personal data with third parties such as data brokers and social-media companies, while 80% contained third-party libraries with privacy-risking code and 53% shipped privacy-risking code with the permissions to execute it. An older academic study led by Australia's CSIRO of 283 Android VPN apps found 67% of free apps embedded at least one third-party tracking library, and that some used non-transparent proxies to inject JavaScript into users' traffic.

Ownership makes this worse and murkier. The same body of research found that a large share of popular free VPNs are quietly owned by, or linked to, companies in jurisdictions with weak privacy protections — in one snapshot, 20 of the 100 most-downloaded free apps in the US App Store traced back to Chinese ownership, none of them clearly disclosed. You often have no idea who is actually receiving your data, or which government can demand it.

Why "you are the product" hits hardest here

This conflict of interest isn't unique to VPNs — plenty of free apps monetise attention or data. What makes a free VPN different is the depth of access. A free game sees your taps; a free VPN sees every domain you connect to, the timing of every session and, on a badly built app, the contents of unencrypted traffic. That is the most intimate data stream on your device, handed to a company you're trusting precisely because you can't afford to pay one.

It is also the hardest conflict to detect from the outside. A polished app, five-star reviews and a confident 'military-grade encryption' tagline tell you nothing about what happens to your traffic after it leaves your phone. The only reliable signals are structural — who owns the company, how it earns revenue, and whether an independent auditor has ever checked its claims — which is exactly why the vetting checklist later in this guide focuses on those three things rather than on the marketing.

Weak encryption, broken apps and IP leaks

A VPN can have a flawless privacy policy and still expose you if the app itself is badly built. This is where a lot of free VPNs fail silently: the connection looks active, the little key icon is showing, but your real IP address or DNS queries are slipping out the side anyway. You feel protected while you're not.

Top10VPN's testing of the 100 most popular free Android VPNs found a staggering 88% suffered some form of data leak — IPv4, IPv6, DNS or WebRTC leaks that can reveal your true identity or location to the sites you visit. These are exactly the failure modes a VPN is supposed to prevent.

Two of the most common leaks are worth knowing by name, because you can test for them yourself:

• DNS leaks. Your device asks your ISP's DNS servers to look up domain names instead of routing those lookups through the tunnel, so your ISP still sees every site you visit. See our DNS leak explainer.
• WebRTC leaks. A browser feature meant for video calls can broadcast your real IP address even with the VPN on. We cover this in the WebRTC leak glossary entry.

On top of leaks, malware is a real and measured problem. The CSIRO study found that 38% of the free Android VPN apps it examined contained some form of malware presence (adware, trojans or riskware), often bundled into the very tool people installed to feel safer. A poorly secured free VPN doesn't just fail to protect you — it can become the threat.

When the app itself becomes the breach

It's tempting to think the worst case is a free VPN quietly selling anonymised metadata. The worst case is much louder than that: a provider that swears it keeps 'no logs', collects detailed records anyway, and then leaves them sitting on the open internet for anyone to download.

That is precisely what happened with SuperVPN, a free app with roughly 100 million downloads. In 2023, security researcher Jeremiah Fowler discovered an exposed database of over 360 million records (about 133 GB) tied to the service. The exposed data reportedly included email addresses, original IP addresses, geolocation, device and OS information, unique user IDs and references to servers users connected to — despite the app's public claim that it kept no logs that could identify users or their traffic.

The lesson isn't 'one app was bad.' It's that a 'no-logs' promise is only as good as the company behind it, and free providers rarely submit to the independent audits that hold paid leaders accountable. With a free VPN you usually have no way to verify the central claim the entire service rests on.

The bandwidth trap: when you become the exit node

There is one free-VPN business model that's uniquely alarming because it turns your device into part of someone else's infrastructure. Instead of selling your data, the provider sells your bandwidth — routing other people's traffic through your home connection, using your IP address as cover for whatever they're doing.

The textbook case is Hola, a wildly popular free VPN that resold its users' idle bandwidth through a commercial arm (Luminati, later rebranded Bright Data). In 2015 it emerged that this network had been used to launch a denial-of-service attack against the imageboard 8chan, meaning ordinary Hola users had unknowingly contributed their connections to an attack. If someone uses your IP for something illegal, it's your address in the logs.

This model still exists today under friendlier branding. Whenever a 'free' VPN, proxy or browser extension is genuinely free with no obvious revenue source, ask the hard question: am I the customer, or am I the product being rented out?

When a free VPN is actually fine

None of this means every free VPN is a scam. A genuinely safe free VPN almost always shares one trait: it's the free tier of a reputable paid service that already makes money from subscriptions, so it has no reason to sell you out. It limits you to nudge you toward upgrading — not to monetise your traffic.

A free VPN can be a perfectly reasonable choice in low-stakes situations like these:

• Encrypting a quick session on sketchy public Wi-Fi at an airport or café.
• Trying out how a VPN feels before committing to a paid plan.
• Light, occasional browsing where you just want a basic layer of encryption.
• Bypassing a simple network block when nothing sensitive is at stake.

The trade-offs you accept in exchange are real but honest. Reputable free tiers cap how much you can use them and how fast they go. ProtonVPN's free plan, for example, imposes no data cap but limits you to servers in a handful of countries, while Windscribe's free plan gives you up to 10 GB a month after you confirm your email. Those limits are the price of an honest free product — and they're a far better deal than 'unlimited' free apps that monetise you instead.

Where a free VPN falls down hard is anything high-stakes or bandwidth-heavy: serious privacy needs, handling sensitive accounts, or reliable streaming. Data caps and crowded servers make free tiers poor for video, which is why most people who want to stream with a VPN — whether that's Netflix or live sports — end up on a paid plan. You can sanity-check what a given service can actually unblock with our Can I Watch tool.

How to vet a free VPN before you install it

You don't need to be a security researcher to filter out the worst offenders. A few minutes of checking the right things will eliminate the overwhelming majority of dangerous free apps. Treat the steps below as a pre-install checklist, in roughly the order they matter.

1. 1Find the parent company. Does a known, named company stand behind it, ideally one that also sells a paid plan? Anonymous ownership is a red flag.
2. 2Check for an independent audit. Reputable providers publish third-party audits of their no-logs claims. If there's no audit, the 'no-logs' promise is just marketing.
3. 3Read what it makes money on. If the answer is ads, 'partners', or nothing you can identify, assume your data or bandwidth is the product.
4. 4Scan the app permissions. A VPN has no reason to need your contacts, location, SMS or call logs. Excessive permissions are a warning sign.
5. 5Test for leaks after connecting. Run a DNS and WebRTC leak test. If your real IP shows up, uninstall it.

If you want the deeper version of how no-logs, jurisdiction and audits fit together, our VPN privacy guide goes further. And if you'd rather skip the vetting entirely, a budget paid plan from a top provider removes the conflict of interest at the root — compare current options in our best VPN rankings and check live pricing on the VPN Price Index.

The bottom line

Free VPNs sit on a spectrum. At the safe end are the limited free tiers of audited, subscription-funded providers — fine for casual use, honest about their limits. At the dangerous end are the ad-stuffed, anonymously owned apps that log you, leak you, or rent out your connection — and those are unfortunately the majority of what you'll find by searching 'best free VPN' in an app store.

So the honest answer to 'are free VPNs safe?' is: a few are, most aren't, and the difference comes down to how the service makes money. If you can identify a real company, a real audit and a real revenue source that isn't you, a free tier is a fine starting point. If you can't, the few dollars a month for a vetted paid VPN buys you something a risky free app can never offer — a provider whose incentives are actually aligned with yours.