VPN for iPhone: built-in settings, provider apps and a free option

This page has affiliate links. If you buy through them, freeswan.ca earns a commission; your price stays the same and it does not change what we write. How we review.

The short answer

Install a VPN provider's app from the App Store, sign in and turn on the kill switch. That is the setup most iPhone users want. If you only need one iPhone covered, Proton VPN's free plan has no data cap. If you want a Canadian server on demand or cover for several devices, a paid plan from Surfshark, Mullvad, Windscribe or Proton is the next step.

The iPhone also has a VPN client built into iOS. It is useful when you already have a VPN server to connect to, such as one at work, but it does not come with a VPN service.

What iOS supports on its own

Apple's Platform Deployment guide lists the VPN protocols built into its operating systems. iOS supports IKEv2, along with L2TP over IPsec and Cisco IPsec. Apple adds that if an organization supports those protocols, "no additional network configuration or third-party apps are required" to connect.

That is the point: the built-in client connects to a server someone else runs and gives you the details for. Your employer's IT team might send a configuration profile, or you might run your own IKEv2 server at home. You enter the server address and credentials in the VPN section of the Settings app, and iOS handles the tunnel. Our page What is IPsec? explains the protocol behind it.

Apple adds that the built-in support "includes technologies such as IPv6, proxy servers, and split tunneling", and that iOS can also run a per-app VPN, where only chosen apps use the tunnel. Per-app VPN, though, needs a device management service to manage the app, which in practice means a work phone. On a personal iPhone, split tunnelling and similar options come from the provider's app, when it offers them.

Two other iOS features show up in searches and are easy to misread:

• Always On VPN. Apple's guide describes it as giving "your organization full control" over the device's traffic. It is installed by an organization on devices it manages. When it is active and the tunnel is down, "all IP traffic is dropped."
• VPN On Demand. This starts the VPN automatically under rules, for example when the iPhone joins an unknown Wi-Fi network. Apple says it "requires an authentication method that doesn't involve user interaction", such as certificates, so it is also mainly a business feature.

Why most people use a provider's app

Commercial VPN services work through apps. Apple explains that its Network Extension framework "allows developers to create a custom VPN solution", and that "Several VPN providers have apps that help configure Apple devices for use with their solutions." The app installs a VPN configuration on your iPhone, picks servers for you, and adds features the built-in client does not offer, such as a kill switch.

A provider's app can also use protocols that are not on Apple's built-in list, such as WireGuard. Our guide to VPN protocols compares them.

These providers list an iOS app on their own download pages, checked October 6, 2026:

The free option: Proton VPN on iPhone

Proton's iPhone page says to "Download and install Proton VPN from the App Store, then log in with your Proton Account", and that you can sign up for free if you do not have one. The free plan is listed as "1 device", "No ads", "No logs" and "Unlimited and free forever", and Proton says it "has no data or speed limits".

The limits are one device at a time and servers in 10 countries chosen at random, so you cannot pick a Canadian server on the free plan. Proton's iPhone app includes a kill switch, which Proton describes this way: "If your VPN connection fails, the kill switch will prevent your device from connecting to the internet until your device reconnects to a VPN server." If you need a Canadian server, Windscribe's free plan includes Canada; our free VPN guide compares all three free plans.

Get Proton VPN for iPhone

Paid picks for iPhone

Surfshark: for a household full of Apple devices

Surfshark allows unlimited devices, so an iPhone, an iPad, a Mac and an Apple TV all fit on one plan; its download page lists iOS, macOS and Apple TV apps. Its 2-year Starter plan showed EUR 2.49 a month (EUR 67.23 for the first 27 months) when we checked on October 6, 2026 from outside Canada. Surfshark does not publish the renewal amount as a figure, so check it at checkout. Providers set prices by location, so you will see your own currency.

Check Surfshark's price

Mullvad: one flat price, no email

Mullvad lists an iOS app on its download page. Signing up gives you an account number, and Mullvad says it does not ask for your email. It charges EUR 5 a month on every plan length, shown as about CA$8 (CA$8.02 when we read it), for up to 5 devices, with a 14-day refund window except for cash payments. Mullvad has no affiliate program. See our Proton VPN vs Mullvad comparison.

Windscribe and TunnelBear: free plans with paid upgrades

Windscribe lists an iOS app, and its free plan includes servers in 10 countries, including Canada. That makes it the free choice if you are abroad and want your iPhone to appear in Canada. Paid plans were USD 9.00 a month or USD 69 a year when we checked, with unlimited devices. Windscribe Limited is registered in Ontario. We did not find a published audit report on its site.

TunnelBear lists apps for iPhone and iPad. Its free plan gives you 2 GB, enough for a few sessions on café or hotel Wi-Fi, and picking a country is a paid feature. TunnelBear gives a Toronto address and has published Cure53 audits every year since 2016.

Which one to choose

• One iPhone, no budget: Proton VPN Free, for its lack of a data cap.
• You travel and need a Canadian server for free: Windscribe Free.
• A family with iPhones, iPads and an Apple TV: Surfshark, for unlimited devices.
• You want to share as little account information as possible: Mullvad.
• You only connect a few times a month: TunnelBear's 2 GB may be all you need.

Whichever you pick, the app should be from the provider named on the App Store listing, not a look-alike. Check the developer name before you install.

Before you subscribe on your iPhone

• Check where the refund comes from. If you subscribe inside the app, the App Store may handle the payment, and the provider's own refund terms may not apply. TunnelBear's terms, for example, exclude iOS purchases from its money-back guarantee.
• Turn on the kill switch in the app's settings after you install it.
• Use it where it matters most. Get Cyber Safe says that if you often use public Wi-Fi, "using a virtual private network (VPN) can be a safer solution." Our public Wi-Fi safety guide covers the rest.

Common questions