🛡️
Infrastructure is never free
Every gigabyte you push through a VPN crosses servers someone rents and links someone pays for. A service with millions of users has a large monthly bill, and it has to be covered by something.
Guides
Why free VPNs are risky
A VPN service pays real money for servers, bandwidth and staff. When the app is free and has no visible income, that money usually comes from you in another form: your browsing data, injected ads, or your device being resold as an exit point for other people's traffic.
🌍
You can become the product
The common ways to monetize a free VPN are selling browsing records to data brokers, inserting ads into your sessions, and reselling your connection. All three work against the reason you installed a VPN.
🔑
Free can be legitimate
A trial of a paid service, or a limited free tier from an operator that openly explains its business model, is a different situation. The red flag is unlimited free service with no explanation of who pays.
Who pays for a free VPN
Somebody always pays. A VPN provider rents servers in many countries, buys transit bandwidth, pays developers and support, and covers app store fees. For a popular service this adds up to a serious recurring cost that does not disappear because the download button says free.
A paid provider covers this with subscriptions, which keeps the incentives simple: you pay money, you get a tunnel, and the provider's interest is keeping you as a customer. A free provider with no subscriptions has to find revenue elsewhere, and the only asset it holds is its users, their traffic and their devices.
How free VPN apps actually make money
The business models behind free VPN apps are well understood, and most of them conflict directly with privacy. The app sits in a perfect position to observe everything you do online, and that observation point itself is the product being sold.
None of these models require the app to be technically broken. The tunnel can work exactly as advertised while the logging happens quietly on the server side, where you have no way to see it.
- Selling browsing and connection records to data brokers and advertisers
- Injecting ads or tracking scripts into the pages and apps you use
- Reselling your device's connection as part of a proxy network, so strangers' traffic exits through your IP address
- Bundling third-party SDKs that collect location, device identifiers and app lists
- Upselling a paid tier while monetizing the free users through any of the above
What security reports keep finding
Independent researchers who analyze free VPN apps in bulk tend to find the same categories of problems again and again: privacy policies that permit sharing traffic data with third parties, embedded trackers from advertising companies, requests for permissions a tunnel does not need, and in some cases no working encryption at all.
Another recurring finding is opaque ownership. Many free apps with different names and logos trace back to the same few companies, so a user comparing options in an app store may be choosing between fronts of one operator.
The specifics vary from report to report, but the pattern is stable enough to treat as the default assumption: a free VPN with no clear revenue source should be presumed to monetize its users until it demonstrates otherwise.
The risk is bigger than ads
An ad-stuffed app is annoying; a compromised tunnel is dangerous. A VPN app runs with the ability to see and redirect all of your device's traffic. If the operator is careless or malicious, that position can be abused for credential harvesting on non-HTTPS connections, for redirecting you to lookalike pages, or for installing a root certificate that breaks TLS inspection protections.
Abandonment is a quieter risk. Free apps are often side projects: the tunnel keeps running on old server software with known vulnerabilities, nobody answers security reports, and the app silently changes hands when the original developer sells it. You would have no way to notice the new owner has different plans for your data.
With a paid service you at least know the incentive structure and have a counterparty accountable to paying customers. Aurora, for example, publishes what it does and does not log and gives a 14-day refund window, so trying it costs nothing but is not funded by your data.
When a free VPN is actually fine
Free is not automatically a scam. A time-limited trial of a paid service is free precisely because the provider expects some users to subscribe; the economics are transparent. The same goes for a limited free tier — capped traffic or fewer locations — offered by an operator whose paying customers clearly fund the infrastructure.
The distinguishing feature is a visible answer to the money question. If the provider says plainly that free users get a slice of the paid infrastructure as marketing, the incentives are aligned with yours. If the service promises unlimited free bandwidth forever and never explains its income, the incentives are not.
How to check what a free service earns from
You do not need to be a security researcher to do a basic sniff test. Ten minutes of reading tells you most of what matters, because monetization has to be disclosed somewhere — usually in the privacy policy, in the permissions, or in the company's own marketing to advertisers.
None of these checks needs special tools, and a provider that fails two or more of them has told you enough. Walk away; there is no shortage of alternatives.
- Read the privacy policy for the words sell, share, partners, advertising and affiliates applied to traffic or usage data
- Check what the app asks permission for; a tunnel needs network access, not your contacts or precise location
- Look up who owns the company, where it is registered, and whether the same owner runs many similar apps
- Search for an independent security audit or a published no-logs verification
- Be suspicious of unlimited free bandwidth; bandwidth is the most expensive thing a VPN provider buys
- Prefer a paid service's trial or refund window over a permanently free unknown
Frequently asked questions
Are all free VPNs dangerous?
No, but the burden of proof is on the provider. Trials and capped free tiers from transparent, subscription-funded operators are reasonable. A permanently free, unlimited service with no explained revenue source should be assumed to monetize its users through data collection, ad injection or bandwidth resale until shown otherwise.
How do free VPN apps make money?
The common models are selling browsing and connection records to data brokers, injecting advertising into your sessions, embedding third-party tracking SDKs, and reselling your device's connection as part of a proxy network. Some also use the free tier purely as marketing for a paid plan, which is the benign version.
Can a free VPN steal my passwords?
On properly configured HTTPS sites your password is encrypted end to end, so a VPN operator cannot simply read it. The risk comes from apps that tamper with connections, push you to install root certificates, or redirect you to lookalike pages. A malicious operator sits in a powerful position, which is why trust matters.
Is a free trial of a paid VPN safe to use?
Generally yes, because the economics are transparent: the provider funds the trial from subscription revenue and hopes you will stay. The infrastructure and policies are the same ones paying customers rely on. Check the refund terms and cancellation process before entering payment details, as with any subscription.
What does it mean that my connection can be resold?
Some free apps enroll your device in a proxy network: strangers' traffic exits to the internet through your IP address. You carry the bandwidth cost and, more importantly, the risk that someone else's activity gets attributed to your connection. The details usually sit deep in the terms of service.
What should I look for instead of a free VPN?
A provider with a stated business model, a written logging policy, modern protocols such as WireGuard, and a way to exit cheaply if you dislike it — a short trial or a money-back window. The monthly cost of a paid tunnel is small compared to what your full traffic history is worth to a data broker.
Keep reading
Is VPN legal
In most countries, yes: using a VPN is legal and completely ordinary. Businesses run on VPN connections every day. A minority of countries restrict or license VPN services, and those rules change, so check current local regulation where you live or travel. And a legal tool never legalizes illegal actions done through it.
VPN and speed
Yes, a VPN adds some overhead, but how much depends almost entirely on distance and server quality. Through a nearby, uncrowded server on a modern protocol like WireGuard, the loss is often barely noticeable. Through a distant or overloaded server, latency climbs and throughput drops visibly. Sometimes a VPN is even faster.
Public Wi-Fi safety
The classic scare story — someone in a café stealing your password out of the air — is mostly obsolete, because HTTPS already encrypts the content of nearly all your connections. What remains on public Wi-Fi is subtler: visible metadata like domain names, fake access points, captive portals, and other devices sharing the network with you.