A free VPN costs you something; the question is what.
Servers, bandwidth and staff have to be paid for, and a service with no subscription pays for them another way: selling browsing data, showing or injecting ads, using your device as an exit point for other customers, or bundling software you didn't ask for. Each of those needs exactly the data a VPN is supposed to protect. There's one honest kind of free VPN: a limited free tier of a paid product, where the paid plans fund the servers and the free tier is a demo. Telling the two apart is the whole skill.
bar length: how often it happens
ads in the app ▇▇▇▇▇▇
selling your data ▇▇▇▇▇
renting your line ▇▇▇
a paid tier beside it ▇▇
malware ▇
└─ only the fourth is honestWhy a free VPN is risky
A VPN server is where your traffic is decrypted before it goes on to websites. Whoever runs it is in the position your ISP was in: it can see every domain you visit, when, and how much. For a paid service the incentive is to keep you as a customer. For a free app with no visible income, the incentive is to make money from what passes through. The position of trust is identical; the incentives are opposite. What the provider can see is laid out in what can my ISP see.
a VPN app sees all your traffic ├─ every site you open ├─ when, and for how long └─ and can alter the answers free means the money comes from somewhere else
How free VPN apps make money
- Selling data. Browsing patterns, app usage, device identifiers, sold to data brokers or ad networks. Policies often say so in vague language.
- Ads and injection. Ads in the app are harmless; ads injected into web pages mean the service is modifying your traffic, which also means it can read it.
- Your bandwidth. Some free apps turn users' devices into exit nodes for a paid "residential proxy" business. Strangers' traffic leaves from your IP address.
- Bundled software. Browser extensions, toolbars, occasionally worse.
- Upsell. Deliberately slow servers and small data caps to push a paid plan. This one is honest as long as the limits are stated.
ads inside the app selling traffic data a subscription after a trial renting your connection to others collecting and reselling emails
Warning signs of an unsafe free VPN
- No paid plan at all. Then where does the money come from? A service that takes money openly, by card or by crypto, has an answer to that question; how a crypto payment gets checked on our side is in why is my crypto transaction pending.
- A policy with no specifics. "We value your privacy" without a list of what is stored and what isn't. How a real policy reads is in what does no logs mean.
- Permissions unrelated to the job. A VPN doesn't need your contacts, messages, or precise location.
- No named company or address. A privacy product from an anonymous publisher is a contradiction.
- Old or unnamed protocols. PPTP, or "proprietary encryption" with no details.
- No kill switch, no DNS protection. Even a well-meaning free app that leaks is worse than nothing, because you believe you're protected.
- Too many five-star reviews saying nothing. Store ratings are cheap.
limited by data or speed the same company sells a paid plan the protocol is documented a real policy and jurisdiction └─ free as a shop window, not as the business model
When a free VPN plan is fine
A free tier attached to a paid product usually has stated limits: a data cap, a handful of locations, one device, lower priority. Those limits are the price, and it's a fair one. The tier runs on the same infrastructure and under the same policy as the paid plans, and the company's income doesn't depend on your data. Check that the free tier states its limits plainly, that the policy is the same for free and paid users, and that the apps are the same builds.
your browsing list sold on ads injected into pages your connection rented to strangers an abandoned app with no security fixes
Free VPN risks in practice
- Your browsing history sold or leaked. The point of a VPN, reversed.
- Your IP used by strangers, sometimes for things you wouldn't want attributed to you.
- Modified pages: injected scripts and ads, occasionally malware.
- A false sense of security on public Wi-Fi, where a leaking tunnel exposes what you thought was hidden. See is public Wi-Fi safe.
asks you to install a certificate asks for admin rights unexplained no protocol named anywhere ads inside the client itself
Free tiers differ enormously. Check the one in front of you rather than the category.
Help me judge whether a free VPN tier is honest.
App: (name). Developer: (as listed).
What the free tier limits: (data / speed / server
choice / time).
Is there a paid plan from the same company:
(yes / no).
Does it name its protocol: (quote it, or no).
Permissions requested: (list them).
Ads inside the app: (yes / no).
Say whether this looks like a shop window for a
paid product or like the business model itself.
Name what is missing that an honest listing would
state.Checklist before trusting any VPN
- A named company and a policy that lists what is and isn't stored.
- Modern protocols: WireGuard, OpenVPN, or VLESS over TLS 1.3.
- Kill switch and DNS inside the tunnel, verified with the WebRTC leak test and IPv6 leak test after connecting.
- Permissions limited to what a VPN needs.
- A visible way the company makes money.
If a service passes all five and is free, it's a free tier. If it fails the last one, assume your data is the product.
404 VPN has a paid subscription that funds the servers, a free tier with stated limits (one device, one location, a daily data cap), the same apps and the same privacy policy for both, VLESS in the apps plus WireGuard configs for Istanbul and Marseille from the dashboard, a kill switch in the Android app and DNS inside the tunnel. Get started here.
