VPN for Android: free and paid options, and the settings that keep it on

This page has affiliate links. If you buy through them, freeswan.ca earns a commission; your price stays the same and it does not change what we write. How we review.

The short answer

On Android, use a VPN provider's app and then switch on two system settings that keep it running: Always-on VPN and Block connections without VPN. For a free option, Proton VPN has no data cap on one phone, Windscribe's free plan includes a server in Canada, and TunnelBear gives you 2 GB. For several devices, Surfshark and Windscribe allow unlimited devices on paid plans.

Android's own VPN settings

Google's Android Help page puts VPNs under the Settings app: tap Network & internet, then VPN. If you cannot find it, Google suggests searching Settings for "VPN" or asking your phone's manufacturer, because menus vary from one manufacturer to another. Google also notes that "Some of these steps only work on Android 14 and up."

From that screen you can add a VPN manually with details from an administrator, connect, disconnect and forget a VPN. If the VPN came from an app, tapping it opens the app.

Always-on VPN

Google's developer documentation explains that Android can start a VPN when the phone boots and keep it running. "This feature is called always-on VPN and is available in Android 7.0 (API Level 24) or higher." In the Help page's words, you open the VPN's settings and "Turn Always-on VPN on or off."

If the always-on connection drops, the documentation says "people see a non-dismissible notification", so you know your traffic is not protected.

Block connections without VPN

This is Android's system-level kill switch. The developer documentation says a user "can force all traffic to use the VPN. The system blocks any network traffic that doesn't use the VPN." You find the "Block connections without VPN" switch in the same VPN options panel in Settings. When you turn it on, Android warns that you have no internet connection until the VPN connects.

Work profiles and the Pixel VPN

If your phone has a work profile set up by your employer, Google says "You can make a VPN work only for apps associated with your work profile." Your personal apps then stay outside that VPN, and you can run a personal VPN app for them.

Google also says that "Pixel 7 & later phones and the Pixel Tablet have access to the optimized, built-in Virtual Private Network (VPN) by Google at no extra cost in countries where VPN is available." That is Google's own service. We have not reviewed it, and it sits outside the comparison on this page.

A catch with some apps

Google's Help page adds: "If you've set up a VPN through an app, you won't have the always-on option." The developer documentation explains why this can happen: an app can opt out of always-on VPN, and the system then disables those controls in Settings. If you do not see the switches for your provider, use the kill switch inside the provider's app instead. Proton describes its app's kill switch as one that "will prevent your device from connecting to the internet until your device reconnects to a VPN server."

Free VPNs for Android

Three providers we track offer a free plan with an Android app. Each has a different limit.

Proton VPN: no data cap

Proton's Android page says to install the app "from the Play Store", and adds that "Our open source Android app is also available on F-Droid or can be downloaded as an APK on GitHub." The free plan covers one device and connects to servers in 10 countries chosen at random. Proton lists split tunnelling on Android, which lets you "Include or except websites from the VPN". Our free VPN guide compares Proton's free plan with the other two in detail.

Get Proton VPN for Android

Windscribe: Canada on the free plan

Windscribe's server page says its free plan includes "free server access in 10 countries, including the US, Canada, UK". That is useful if you are abroad and want a Canadian IP address on your phone. The company is registered in Ontario, according to its terms. Paid plans were USD 9.00 a month or USD 69 a year when we checked on October 6, 2026, with unlimited devices. Read our Windscribe review for the gaps, including the lack of a published audit report.

Try Windscribe Free

TunnelBear: 2 GB for occasional use

TunnelBear's 2 GB free plan suits a few sessions on café or airport Wi-Fi. It has published Cure53 security audits every year since 2016. If you later pay, note that its terms exclude Google Play purchases from the 30-day money-back guarantee, which covers only the first year of annual plans bought directly.

Try TunnelBear Free

Paid picks for Android

Surfshark: unlimited devices

Surfshark's download page lists an Android app on Google Play and an Android APK. Its plans cover unlimited devices. The 2-year Starter plan showed EUR 2.49 a month (EUR 67.23 for the first 27 months) when we checked on October 6, 2026 from outside Canada; providers set prices by location, so your checkout will show your currency. Surfshark does not publish its renewal amount as a figure. The refund window is 30 days.

Check Surfshark's price

Mullvad: an audited Android app

Mullvad lists an Android app, and its about page records an Android app audit by NCC Group in March 2025. It charges EUR 5 a month on every plan length, shown as about CA$8 (CA$8.02 when we read it), covers 5 devices and offers a 14-day refund except for cash payments. Mullvad runs no affiliate program. Our Proton VPN vs Mullvad comparison sets it against Proton.

Which one to choose

• One phone, used every day, no budget: Proton VPN Free. Proton says the free plan has no data or speed limits.
• You travel and want a Canadian IP address for free: Windscribe Free, because Canada is one of its free locations.
• Occasional public Wi-Fi only: TunnelBear's 2 GB free plan.
• A family with several phones, tablets and a TV: Surfshark or Windscribe, both with unlimited devices on paid plans.
• You want a provider that publishes an Android app audit: Mullvad, which reports an NCC Group audit of its Android app in March 2025.

Avoid VPN apps from companies you cannot identify. The Privacy Commissioner of Canada's office has warned that a VPN provider is in a privileged position to monitor or tamper with what passes through its servers. Check the developer name on the Google Play listing against the provider's own website, and read who runs the service before you install.

Setting up a VPN on Android: step by step

1. Install the provider's app from Google Play, or from the provider's own F-Droid or APK link.
2. Sign in and connect once, accepting any connection request the phone shows.
3. Turn on the kill switch inside the app.
4. Open Settings, then Network & internet, then VPN. Tap the settings icon next to your provider and turn on Always-on VPN and Block connections without VPN, if they are available.
5. Test it: switch to airplane mode and back, and check that the VPN reconnects before apps get online.

A VPN protects your connection, not the phone itself. It does not stop phishing links or malicious apps. Our pages on what a VPN does and public Wi-Fi safety cover the rest, and the iPhone guide has the same advice for iOS.

Common questions