Free VPNs: the hidden risks and when it is worth paying

“Free VPN” is one of the most searched VPN phrases. The appeal is obvious: why pay when app stores are full of free options? Let us look at where a free VPN gets the money for servers, what research shows, and when a free option is acceptable.

Where does a free VPN get its money?

Servers, bandwidth and development cost money every month. A server with a gigabit uplink in Europe costs tens of euros a month, and a single active user can push hundreds of gigabytes. If you are not paying, the service makes money in one of these ways:

• Ads. The most harmless option — banners and videos in the app. But ad SDKs collect data about your device and behavior.
• Selling data. A VPN sees every domain you connect to. For the ad market that is valuable — and it can be sold in “anonymized” form.
• Your device as part of a network. Some free services route other people’s traffic through your phone or computer. If someone does something illegal through your IP address, the questions come to you.
• A free trial. The honest option: a limited version of a paid service so you can try it before buying.

What research shows

283 Android VPN apps

Researchers from Australia’s CSIRO and colleagues analyzed 283 Android apps that use VPN permissions. They found that:

• 38% contained code flagged as malicious by antivirus engines;
• 18% created tunnels with no encryption at all;
• 75% used third-party tracking libraries;
• 84% let IPv6 traffic bypass the tunnel and 66% leaked DNS queries;
• 82% requested access to sensitive data such as accounts and text messages.

The study dates from 2016, but the business model has not changed, and new cases keep confirming its findings.

Data of 20 million users exposed

In July 2020, vpnMentor researchers found an open database belonging to seven free VPN services (UFO VPN, FAST VPN, FREE VPN, SUPER VPN, Flash VPN, Secure VPN, Rabbit VPN). It held about 1.2 terabytes of data — potentially up to 20 million users: email addresses, plain-text passwords, IP addresses, device details and activity logs. All of these services claimed not to keep logs.

A browser extension that took screenshots

In 2025, Koi Security researchers found that FreeVPN.One, a free VPN extension for Chrome with more than 100,000 installs and a featured badge, was secretly taking screenshots of visited pages and sending them to its server. Those screenshots could include passwords, banking details and private messages.

How to vet a VPN app before installing

Even if you go free, check:

1. Who is the developer? Is there a website, a company, support contacts? An anonymous developer with an email on a free site builder is a red flag.
2. Is there a privacy policy? And what does it say about browsing history and sharing data with partners?
3. What permissions does it ask for? A VPN does not need your contacts, SMS, camera or location.
4. Which protocol? If the service does not say how it encrypts traffic, it probably has nothing to brag about.
5. Reviews. Read the recent negative ones, not the stars: that is where people mention surprise ads, drops and charges.
6. Leaks. After connecting, check your IP at ifconfig.me and DNS at dnsleaktest.com — you should see the VPN server, not yourself.

When a free VPN is acceptable

• A corporate VPN from your employer — free for you because the company pays.
• A trial of a paid service with clear terms.
• Free tiers from established companies that earn from paid plans — usually with a data cap and a couple of servers.
• Your own server. If you know Linux, you can rent a VPS for a few dollars a month and run your own VPN. Cheap, but you handle setup, updates and changing the address if it gets blocked.

What a decent VPN costs

A good VPN costs about as much as a cup of coffee a month. For that you get a service that earns from subscriptions, not from your data.

Summary

• Free VPNs make money from ads, your data or your device.
• Research has found malware, missing encryption, trackers and leaks of millions of records in free VPNs — despite “no logs” claims.
• Before installing, check the developer, privacy policy, permissions and leaks.
• If you use a VPN every day, paying a few dollars a month is cheaper and safer.

Read next: How to choose a VPN — 12 criteria and What is a VPN and how does it work.