Are free VPNs safe, or should I pay for one?

Short answer: most free VPNs are not safe in the way you'd hope — many make money by logging, selling, or otherwise monetizing your data, which defeats the entire purpose. A few reputable free tiers (like Proton VPN's) are genuinely trustworthy. But before spending anything, ask whether you actually need a VPN at all — most people need one far less than the ads suggest.

VPN marketing has convinced millions of people they need protection they don't, from threats that barely exist, sold by companies with questionable ownership. Let's cut through it.

What a VPN actually does (and doesn't do)

A VPN encrypts your internet traffic and routes it through the VPN company's servers, hiding your activity from your internet provider and masking your IP address from the websites you visit. That's it. That's the whole product.

What it does not do: protect you from malware, stop phishing, make you anonymous (the VPN company itself can see your traffic), protect your passwords, or secure your accounts. Many VPN ads imply broad "hacker protection" that a VPN simply doesn't provide. Your bank's website is already encrypted with HTTPS — a VPN adds nothing to that.

The legitimate uses are narrower than the marketing: securing your connection on untrusted public Wi-Fi, accessing region-locked content, bypassing censorship in restrictive countries, hiding your browsing from your ISP, and certain work requirements. If none of those apply to you, a VPN is solving a problem you don't have.

The business model problem with "free"

Running a VPN service costs real money — servers, bandwidth, staff, legal compliance. Bandwidth in particular is expensive. So when a VPN is free, you should ask the obvious question: who's paying for the servers?

The uncomfortable answers include:

• Selling your data. Some free VPNs log your browsing activity and sell it to advertisers and data brokers. This is the worst outcome: you installed privacy software that made your privacy worse. Investigations over the years have repeatedly caught free VPN apps doing exactly this.
• Advertising and upsells. The less-bad model: the free tier is limited and ad-supported, existing to convert you to the paid tier. Annoying but not dangerous — if the company is otherwise reputable.
• Injecting ads or tracking into your traffic. Some free VPNs have been caught inserting their own ads or affiliate tracking into users' browsing. You're paying with your attention and your data.
• Selling bandwidth. A few services have turned their free users' devices into exit nodes for other customers' traffic — meaning strangers' internet activity routes through your connection. This is a security and legal risk you don't want.

The pattern is consistent: if you're not paying for the product, investigate very carefully what the product is. With VPNs, the product is often you.

The exceptions: free VPNs that are actually trustworthy

A small number of free VPNs come from companies with real reputations and transparent business models:

• Proton VPN's free tier is the standout. It's from the Swiss company behind Proton Mail, it's genuinely free with no data caps on the free plan (though speeds and server choices are limited), and the company makes money from its paid tiers. It has undergone independent security audits and has a strong track record. If you need a free VPN, start here.
• Windscribe's free tier offers a limited amount of monthly data from a company that's been reasonably transparent about its operations.
• Mullvad doesn't have a free tier, but it's worth mentioning as the gold standard for trust: flat pricing, no accounts tied to email, cash payment options, and regular audits.

The common thread: these companies make their money from paying customers and treat the free tier as a limited sample, not as the product. They're audited, they're transparent about ownership, and they have clear no-logs policies that have been tested.

Red flags that should make you uninstall immediately: a free VPN with no clear company behind it, no published audits, vague or missing privacy policy, ownership hidden behind shell companies, or a history of data incidents. The app stores are full of these. "Free unlimited VPN" with a generic name and 4.8 stars from suspicious reviews is not a deal — it's a trap.

When paying makes sense

A paid VPN from a reputable provider typically costs a few dollars a month when billed annually — cheap enough that the price shouldn't be the deciding factor. Consider paying when:

• You regularly use public Wi-Fi for sensitive work (cafés, airports, hotels). This is the classic legitimate use case.
• You live under or travel to a country with internet censorship. Here, VPN choice matters enormously — you need one with obfuscation technology and a track record of working under censorship, not just any VPN.
• Your threat model includes your ISP. Maybe you don't want your internet provider building a profile of your browsing. Fair enough — that's a coherent reason.
• You need consistent region access for streaming or work, which free tiers usually can't provide reliably.

When choosing a paid VPN, look for: independent security audits (published, recent), a no-logs policy that's been tested in court or by auditors, transparent ownership, open-source apps, and a jurisdiction with reasonable privacy laws. Avoid lifetime subscriptions — they're a sign of a company that needs cash now, and VPN companies with shaky finances get acquired by shadier ones.

The ownership question nobody asks

Here's something that rarely comes up in VPN reviews: who owns the company? The VPN industry has gone through waves of consolidation, with a handful of holding companies quietly acquiring popular VPN brands. A VPN you chose for its independent reputation may now be owned by a conglomerate with a very different approach to data — and the brand name on the app doesn't change when the ownership does.

This matters because a no-logs policy is ultimately a promise, and promises are only as good as the people making them. When ownership changes, the promise technically transfers, but the culture and incentives behind it may not. It's worth checking every year or so whether your VPN is still owned by who you think it is.

Jurisdiction matters too, though less than marketing claims. A VPN based in a "privacy-friendly" country sounds reassuring, but what actually protects you is the company's demonstrated behavior: published audits, transparency reports, and a no-logs policy that has survived real legal pressure. A company in a Five Eyes country with audited no-logs infrastructure is more trustworthy than a company in a privacy haven with no audits and hidden owners. Behavior over geography.

What most people should do instead

Here's the honest advice the VPN industry doesn't want you to hear: for most people, the security basics matter far more than a VPN:

• Use a password manager with unique passwords everywhere, and turn on two-factor authentication on important accounts. This prevents the attacks that actually happen.
• Keep your devices updated. Most real-world compromises exploit known vulnerabilities in outdated software, not unencrypted Wi-Fi.
• Be skeptical of phishing. The email pretending to be your bank is a vastly bigger threat than someone snooping on café Wi-Fi.
• Use HTTPS — which your browser already does by default for virtually every important site. The padlock era made the "unsafe public Wi-Fi" threat much smaller than it was a decade ago.

If you do all of that and still want a VPN for public Wi-Fi or privacy from your ISP, get Proton VPN's free tier or pay a few dollars a month for a reputable provider. That's a reasonable, proportionate decision.

The bottom line

Most free VPNs are either data-harvesting operations or upsell funnels — neither deserves your trust by default. The exceptions (Proton VPN first among them) prove the rule: trustworthy free VPNs come from companies that make money elsewhere and submit to audits.

But the bigger truth is that VPNs are a niche tool marketed as a necessity. The industry spends heavily on ads — including sponsoring half the internet's creators — because fear sells subscriptions. Before you install anything, free or paid, ask what problem you're solving. If the answer is "hackers on public Wi-Fi might steal my bank password," your bank's encryption already handles that. If the answer is "I torrent without protection" or "my government censors the internet," then yes — get a good VPN, and pay for it. Match the tool to the threat, and don't let marketing invent threats for you.

One final note: whatever you choose, revisit the decision occasionally. VPN companies get acquired, policies change, and audits expire. The provider that was trustworthy two years ago may not be the same company today. Trust, in this industry, is rented — not owned. A quick annual check of who owns your VPN and when it was last audited is cheap insurance for the tool that's supposed to insure you.