A VPN kill switch is a safety feature that blocks your device’s internet access whenever the VPN connection drops unexpectedly. Without it, your apps can quietly carry on using the regular connection, sending traffic outside the encrypted tunnel and exposing your real IP address and activity to the local network and your ISP.
Why VPN connections drop
An encrypted tunnel is not permanent. It can fail for ordinary reasons, and most of the time you will not notice. Common causes include:
- A weak or unstable Wi-Fi or mobile signal.
- Switching from Wi-Fi to mobile data, or between two Wi-Fi networks.
- The VPN server being overloaded or restarting.
- Your device waking from sleep and the connection not resuming straight away.
- A network that interferes with the protocol being used.
When the tunnel falls, the operating system will usually just use whatever connection is available. Apps that were mid-download, mid-message or mid-page keep going, now unprotected. This is the gap a kill switch is built to close.
How a VPN kill switch works
The basic idea is simple: the app watches the state of the tunnel, and if it ends without you asking, it stops traffic from leaving the device by any other route. Different apps do this in different ways, and the details matter.
Firewall-based blocking
Many desktop apps add rules to the operating system’s firewall. These rules allow traffic only to and from the VPN server, so if the tunnel disappears, nothing else gets through. Because the rules sit at system level, they can keep protecting you even if the VPN app itself crashes.
App-level blocking
Some implementations simply monitor the connection and then close selected apps or cut network access when the tunnel drops. This can be less thorough, since there may be a short delay between the drop and the response, and a crash of the app may leave nothing in charge.
System-level options on phones
Mobile operating systems offer their own always-on and block-connections-without-VPN settings. These are controlled by the operating system rather than the app, which can make them more dependable. The exact names and menus vary by device and version, so look in the VPN section of your network settings.
Two behaviours to know about
Kill switches differ in when they apply, and it is worth reading what your app says.
| Mode | What it does | Good to know |
|---|---|---|
| Standard | Blocks traffic if the tunnel drops while connected | Does not stop traffic before you connect or after you disconnect |
| Strict or always-on | Blocks all traffic whenever the VPN is not connected | Safer, but you cannot go online without the VPN |
The strict mode can be inconvenient. For instance, you may be unable to sign in to a hotel or airport Wi-Fi page until you pause the VPN or the kill switch. That is a trade-off, not a bug. We look at that situation in more detail in our hotel Wi-Fi tips.
Do you actually need one?
It depends on what you are protecting against. If you use a VPN mainly for general browsing on public Wi-Fi, an occasional unprotected moment is a small risk, though still worth avoiding. If you rely on it to keep your IP address or activity away from your ISP or a hostile network, a kill switch becomes much more important, because even a few seconds of leaked traffic defeats the purpose.
It is also worth remembering what a kill switch cannot do. It does not make your VPN anonymous, and it does not guard against malware or phishing. For the bigger picture, read whether a VPN makes you anonymous.
How to test your kill switch
Do not assume the feature works just because there is a toggle. A simple check will show you, and it takes a few minutes.
- Turn the kill switch on in the app settings.
- Connect to the VPN and confirm the connection with an IP address lookup in your browser. It should show the server’s address, not your usual one.
- Start something that keeps a connection open, such as a streaming radio page.
- Interrupt the tunnel without using the app’s disconnect button. On a laptop, you could briefly unplug the network cable or switch Wi-Fi off and on. On a phone, toggle airplane mode.
- Watch whether traffic stops. When you restore the connection, check that the VPN reconnects and the IP address is still the server’s.
A more thorough test is to forcibly close the VPN app while connected and see whether traffic is still blocked. If your normal connection comes back, the protection depends on the app staying alive, which is a weakness.
Settings that help
- Enable automatic reconnection so that brief drops recover on their own.
- Switch on the option to start the VPN when the device starts, if your app has one.
- Turn on any IPv6 leak or DNS leak protection offered, as a complement to the kill switch.
- Keep the app updated, because fixes to these features arrive through updates.
Where to start
Open your VPN’s settings today and see whether a kill switch is available and switched on, then run the test above once so you know it works on your device. If your current app does not offer one, treat that as a point to weigh when you next read how to choose a VPN. And if you want to see how other options in the same menu fit together, our VPN basics category covers them one by one.
Frequently asked questions
Is a kill switch turned on by default?
Not always. Many apps ship with it off or tucked away in the settings, so check and enable it yourself.
Will a kill switch stop me going online?
Only while the VPN is down. In strict mode you will have no internet until the VPN reconnects or you turn the feature off.
Do I need a kill switch on my phone?
It is useful, especially because phones switch networks often. Look for an always-on VPN option in your phone's network settings as well as in the app.
Does a kill switch protect against DNS leaks?
Not necessarily. A kill switch blocks traffic when the tunnel fails, while DNS leak protection is a separate feature that keeps lookups inside the tunnel.
