Android has the most flexible VPN support of any mobile platform — you can use a polished app, import a WireGuard config, or set up IKEv2 manually. The catch is that flexibility creates more ways to misconfigure. This guide walks through every method correctly, with the kill switch and always-on settings that most guides skip.
What changed in 2026
- Android 15 unified the VPN UI. Always-on VPN and the kill switch are now in one screen: Settings → Network & internet → VPN — no more hunting through separate menus.
- WireGuard has a first-class native implementation on Android 12+. Battery usage improved ~20 % compared to the userspace implementation.
- Google Play VPN policy tightened. Apps must declare their logging policy, server ownership, and jurisdiction. Still not perfect, but easier to vet providers.
- Per-app VPN exclusions are stable in Android 14+. You can exclude banking apps that block VPN connections without disabling the tunnel globally.
Method 1: VPN provider app (recommended)
- Download the provider's official app from the Play Store.
- Sign in and tap Connect or pick a server.
- Accept the VPN connection permission dialog.
- Look for the key icon in the status bar — VPN is active.
To enable the kill switch via the app: look for Kill Switch or Block on disconnect in app settings. Always verify with a leak test — app toggles do not always engage Android's system-level kill switch.
Method 2: Android's built-in kill switch (Always-on VPN)
This is the reliable method. It works at the OS level regardless of whether the app is running.
- Go to Settings → Network & internet → VPN.
- Tap the gear icon next to your VPN.
- Enable Always-on VPN.
- Enable Block connections without VPN (the actual kill switch).
When Always-on is enabled, Android reconnects the VPN automatically on reboot and blocks all traffic if the tunnel fails. Use this for any sensitive use.
Method 3: WireGuard manual config
- Install WireGuard from the Play Store.
- Tap + → Scan from QR code (fastest) or Create from file.
- Import the
.conf file your server admin or self-hosted setup provides.
- Toggle the tunnel on.
- Set this tunnel as Always-on in Android Settings → VPN if needed.
| Protocol |
Best for |
Battery impact |
| WireGuard |
Speed, self-hosted, modern clients |
Low |
| IKEv2/IPSec |
Corporate / employer VPNs |
Low–medium |
| OpenVPN |
Legacy servers, maximum compatibility |
Medium–high |
Method 4: Manual IKEv2 configuration
- Settings → Network & internet → VPN → tap +.
- Name the connection. Set Type to IKEv2/IPSec MSCHAPv2 or IKEv2/IPSec RSA.
- Enter server address, username, password (and certificate if required).
- Save and connect.
Use this only if your employer or self-hosted server requires IKEv2 and does not provide a WireGuard config.
Per-app VPN exclusions
Some banking apps and government apps refuse to work over a VPN. Rather than disabling the whole tunnel:
- Open your VPN app → Advanced / Split tunneling.
- Add the problem app to the exclusion list.
- The excluded app routes normally; everything else stays protected.
How to verify no leaks
- Connect to your VPN.
- Open ipleak.net in Chrome — confirm your IP is the VPN server, not your real location.
- Run dnsleaktest.com extended test — all DNS entries should be the VPN provider's, not your ISP.
If your ISP appears in the DNS results, the app is leaking DNS. Enable Android's Private DNS (Settings → Network → Advanced → Private DNS) with a provider like dns.nextdns.io as a fallback.
How to pick the right VPN for Android
| Priority |
Good choices |
| Privacy / no-logs |
Mullvad, ProtonVPN |
| Speed + streaming |
NordVPN, ExpressVPN (~$4–12/month range) |
| Free, trustworthy |
ProtonVPN free tier |
| Self-hosted |
WireGuard with your own server |
| Work / corporate |
App or profile from IT |
Common mistakes
Relying on the app kill switch only. App-level kill switches fail if the app crashes. Use Android's built-in Block connections without VPN for reliability.
Picking a free app by rating. Play Store ratings are gamed. Check the privacy policy for explicit no-logging language and independent audits.
Not testing after setup. The VPN icon being present does not guarantee DNS is protected. Run a leak test.
Forgetting to exclude banking apps. Banks detect VPN IPs and block logins. Add them to split-tunnel exclusions rather than toggling the VPN off manually.
What to skip
- Free VPN apps with 500 MB/day data caps — not practical for any real use.
- "Military-grade encryption" marketing language — AES-256 is standard everywhere; it tells you nothing about logging policy.
- VPN apps bundled with "security suites" that request SMS or call log permissions — those permissions have nothing to do with VPN functionality.
FAQ
Does a VPN work on Android tablets?
Yes, identically. The same methods apply; settings menus may look slightly different on different Android skins.
Does always-on VPN drain battery faster?
WireGuard in always-on mode adds minimal drain — typically under 3 % per day based on third-party tests. OpenVPN in always-on is measurably worse.
Can I use a VPN and mobile data at the same time?
Yes. VPNs work over both Wi-Fi and cellular. For privacy on cellular, a VPN protects data from your carrier.
What if the VPN app gets removed from the Play Store?
Download the APK directly from the provider's website and sideload. Most reputable providers maintain direct downloads.
Where to go next