For background, see our recent coverage.

Every month, hundreds of millions of people install a VPN app that costs nothing up front. Few ever ask the two questions that actually determine whether it’s doing what it claims: what protocol is encrypting the tunnel, and what happens to the traffic – and the business – around that tunnel. Both questions have concrete, checkable answers, and this piece walks through both.

Since the piece is partly about telling trustworthy free VPNs from the rest, Planet VPN – whose free tier (6 servers, no data or time cap, no card required) runs alongside a Premium plan on OpenVPN, IKEv2, and WireGuard, backed by RAM-only servers and a stated no-logs policy out of Romania – is naming where it stands on the same checklist this piece sets out below, gap included: no independent third-party audit of that no-logs claim has been published yet.

Free VPNs illustration

How free VPNs actually encrypt your traffic

A VPN is an encrypted tunnel between your device and a provider’s server. What differs is which protocol builds it. Almost every free app uses one of two families.

OpenVPN builds its tunnel with TLS – the same handshake family as HTTPS – via OpenSSL, usually landing on AES-256-GCM. Because it can run over TCP port 443, it can disguise itself as ordinary HTTPS traffic, useful where VPNs themselves get blocked. The tradeoff is size: tens of thousands of lines of code between OpenVPN and OpenSSL, with two decades of public audits to offset it.

WireGuard, merged into the Linux kernel in 2020, hard-codes one modern cipher suite – ChaCha20Poly1305, Curve25519, BLAKE2s – via the Noise Protocol Framework. No negotiation means no downgrade attacks. At roughly 4,000 lines of code, it’s small enough to have been formally verified, and its single 1-RTT handshake makes it noticeably faster. Its weakness is the flip side of that simplicity: without an obfuscation layer, it’s easier for deep packet inspection to fingerprint and block.

Neither is "the encryption" in isolation – both are sound, published designs. Where free VPNs actually fail is almost never the cipher. It’s everything downstream of it.

DNS and IP leak protection: what to check

An encrypted tunnel only helps if everything goes through it. A "leak" is traffic that slips around the tunnel and reaches the open internet in the clear.

DNS leaks are the most common failure: if a provider doesn’t run its own resolver, your device falls back to your ISP’s DNS servers, exposing every domain you visit even while the rest of your traffic looks encrypted. Independent testing by Top10VPN found DNS leaks in 83 of 100 popular free Android VPNs.

IPv6 leaks happen when an app only tunnels IPv4; if your network prefers IPv6, that traffic can bypass the tunnel entirely – found in 15% of free Android VPNs tested, versus 3% for IPv4. WebRTC leaks live in the browser: a legitimate real-time-calling feature can reveal your real IP via STUN requests, independent of your proxy settings – an issue in 18% of the same test set. A kill switch is the backstop for all three: if the tunnel drops, it should cut internet access rather than silently fall back to your unprotected connection – testing shows this fails specifically during server switches even on some well-regarded services.

None of this requires trusting marketing copy. Each is checkable in minutes with any DNS/IP/WebRTC leak-test tool, plus a manual kill-switch test: kill your Wi-Fi mid-session and confirm nothing gets through before reconnecting. If a provider’s own site doesn’t say plainly whether it tunnels IPv6 and DNS by default, treat that silence as an answer.

The real privacy tradeoffs of free VPNs

Running global VPN infrastructure costs real money. If you’re not paying, something else is – usually one of three models: a genuine freemium funnel (a limited free tier subsidizing a paid product); ad-supported, monetizing attention and bundled tracking SDKs; or, in the worst case, monetizing your device itself.

A 2016–2017 CSIRO/ICSI study of 283 free Android apps requesting VPN permissions found 67% embedded third-party trackers, 18% didn’t encrypt traffic at all, and about 8% carried a positive malware detection. The sharpest case study is worse: in May 2024, the FBI and Department of Commerce took down "911 S5," a residential proxy botnet operating since 2014 that had compromised over 19 million IP addresses across 190+ countries. Its distribution mechanism was six free VPN apps – MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN – each with a backdoor that silently turned the installing device into an exit node for someone else’s traffic, documented in uses ranging from financial fraud to child exploitation material. The user got a free VPN; what they installed was proxy infrastructure with their IP attached to it.

A "no-logs" claim is marketing copy until it’s backed by something falsifiable: an independent audit, a stated jurisdiction, or a public track record. That diligence is optional with a paid subscription’s conventional business model – it’s mandatory with a free one.

Sources: FBI 911 S5 PSA · Tripwire/ICSI/CSIRO study · Top10VPN leak testing · WireGuard · OpenVPN