I stopped using free VPNs after I learned what they do with your traffic

Published Aug 7, 2026, 4:00 PM EDT Maker, meme-r, and unabashed geek, Joe has been writing about technology since starting his career in 2018 at KnowTechie. He's covered everything from Apple to apps and crowdfunding and loves getting to the bottom of complicated topics. In that time, he's also written for SlashGear and numerous corporate clients before finding his home at XDA in the spring of 2023. He was the kid who took apart every toy to see how it worked, even if it didn't exactly go back together afterward. That's given him a solid background for explaining how complex systems work together, and he promises he's gotten better at the putting things back together stage since then. If you type “free VPN” into any search engine, you’ll get a wall of options. They might even sound good, with promises not to log your traffic, to stop your ISP from snooping on your browsing, and other claims of private browsing. The reality is somewhat different, shifting your trust from your ISP to an often unidentified entity in the middle. With most apps, that’s a downgrade, and many free VPN providers have been found to leak data accidentally or even sell your data on the dark side. Some don't even do what they say, and send your data unencrypted across the internet. Your free VPN sees more than you think, even with HTTPS And some apps break HTTPS on purpose When you route your browsing traffic through any VPN, the operator sees your real IP address, every destination IP, your DNS lookups, and the plaintext hostname (SNI) from every HTTPS handshake. It can’t see the contents of encrypted pages, but they don’t need to. The metadata is more than enough to recreate your browsing habits in painstaking detail. This also assumes the app is doing what it’s supposed to be. A CSIRO study from 2016 found that of the 283 Android VPN apps tested, 84% leaked IPv6 traffic outside the tunnel, 66% leaked DNS queries, and 18% didn’t encrypt anything at all. That's a shocking breach of trust on most accounts, and you'd hope things would be better now. A decade later, and the picture is better but not perfect. The recent MVPNalyzer study found that 29 of the 281 free Android VPNs tested still leaked traffic, 61 sent data in plaintext, and over 80% sent data to known ad and tracking domains. Progress is slow when money is at stake. How free VPNs actually make money Congratulations, your PC is now the product Servers and bandwidth cost money, even as it becomes one of the cheaper parts of hosting. A free VPN that doesn’t have a paid tier is immediately suspect, because it’s making money somehow, and you’re probably the product being sold. Hotspot Shield’s free tier has been caught injecting JavaScript and redirecting shopping traffic through affiliate partners, which is what Honey got caught doing too. Facebook bought Onavo mostly to watch which apps you used, and app-analytics firm Sensor Tower hid a bunch of VPN and ad-block apps behind shell companies. And more recently, Urban VPN was caught harvesting AI chats and then selling them as marketing analysis. It even kept collecting data when the VPN was turned off, and uninstalling was the only fix. I'm not saying all free VPN providers are sketchy. They're not. But the industry has a bad reputation, and it keeps being reinforced. What you can use instead Some free VPNs are trustworthy, but there are better options Every trustworthy VPN with a free tier comes with three things. Open source clients, independent audits to back up their no-log claims, and paying subscribers are the reason there’s a free part at all. It’s mind-numbingly boring, and that’s how it should be. Proton VPN Free is an XDA favorite, offering a service for one device with unlimited data, no ads, the same encryption as the paid plans, and a handful of exit node options. The paid options allow you to protect more devices at once, which can be handy. But there are others that are worth considering. Windscribe Free gives you 10GB a month and unlimited devices. TunnelBear has published Cure53 audits every year since 2016, but its tiny data cap makes it more of a taster demo. And you could always use Tailscale or NetBird, or self-host on a VPS. What ‘no-logs’ means when the police show up Marketing claims are one thing, but they don’t hold up in court when the police turn up with subpoenas. Some free VPNs say they don’t log anything, but they really do, and then hand over any metadata to the authorities. One that doesn’t is Windscribe, which was tested in court. Greek prosecutors charged the founder over traffic from a Windscribe server, and the case was dismissed, as the company had nothing to produce. That’s what you want from your VPN provider: an actual auditable architecture that doesn’t log your details. The safest free VPN might be the one you self-host Free VPNs aren’t automatically scams, but you should be wary of them for the most part. That’s not to say you shouldn’t be using a VPN when you use coffeeshop or hotel Wi-Fi, because you should, and be wary of any login pages that show up. You can skip the worrying and self-host WireGuard on a cheap VPS, and then the only person using it is you The only thing there is that you’re trading off the obscurity that commercial VPN providers supply for a VPN that you control. But that’s probably fine; security-by-obscurity is pretty much a meme at this point. WireGuard lets you easily and securely self-host your own VPN.