UtilForge.org is a digital inclusion organisation offering free cybersecurity and online safety tools and guides. A 2026 Champion of Cybersecurity Awareness Month. What you check stays on your phone or computer.

Guide · 23 October 2026

Do you need a VPN? What it protects, and what it doesn’t.

Most people do not need a virtual private network (VPN) to stay safe at home, and a VPN is most useful on Wi-Fi you do not control, at a café, hotel, airport or station. A VPN encrypts the traffic between your device and the VPN company and, when it is well built and switched on, hides which websites you visit from the Wi-Fi owner and your internet provider. It does not stop scam messages, fake shops or voice-clone calls, it does not make you anonymous, and it does not change what an artificial intelligence (AI) app’s company receives. It moves your trust from your internet provider to the VPN company, so the company you choose matters more than anything else.

Facts checked on 24 October 2026. Sources are listed at the end, with dates.

Check your own situation, and any VPN app

The free VPN check asks a few plain questions and shows what a VPN would and would not do for you, then reads a VPN app’s store description, permissions list or advert and points out its warning signs. It runs on your own phone or computer, and what you paste stays on your device.

Open the VPN check

What a VPN does, in plain words

When a phone opens a website, its traffic passes through whoever runs the network: the café or hotel that owns the Wi-Fi, then your internet provider or mobile network. A VPN app wraps that traffic in encryption and sends it to a server run by the VPN company, which passes it on to the website. The Wi-Fi owner and your internet provider can see that you are using a VPN, but not which websites you visit. A badly built VPN can still let some of this slip out, for example the website names your phone looks up in the internet’s address book, which researchers call a leak. The website sees the VPN company’s internet address instead of yours.

The VPN company now sits where your internet provider sat. It can see which websites you visit, and its own policies, and the law of the country where it is registered, decide what it records and who it shares that with. The Cybersecurity and Infrastructure Security Agency in the United States made this point in December 2024, in guidance for people in senior government and political roles, when it advised them not to use personal VPNs, saying that a personal VPN shifts risk from the internet provider to the VPN provider.

When a VPN helps

On Wi-Fi you do not control. The Australian Cyber Security Centre advises people who use public Wi-Fi hotspots often to install and use a reputable VPN service, as an extra layer of protection. In guidance written for organisations rather than individuals, the National Cyber Security Centre in the United Kingdom describes a VPN as one way to keep information secure as it crosses a network you do not trust.

That layer matters less than it once did. The Federal Trade Commission in the United States now says that because most websites use encryption, public Wi-Fi is usually safe to use, and it warns that fake websites use encryption too. The padlock and “https” at the start of a web address mean the connection is encrypted, not that the website is honest. On public Wi-Fi a VPN adds a layer on top, and hides which websites you visit from the network’s owner.

For privacy from your internet provider or the Wi-Fi owner. A VPN stops them seeing which websites you visit, and the VPN company sees it instead.

When your work or place of study asks you to use one. Organisations set up their own VPNs so that staff and students can reach internal systems from outside. Use that one, for the work it is set up for, and follow the organisation’s rules.

What a VPN does not fix

Scam messages, phishing links, fake shops, job-fee scams and voice-clone calls. A VPN protects the connection, not the message. A scam text arrives with the VPN on, a fake shop takes payment with the VPN on, and a phone call in a voice that sounds like a relative never passes through it. Checking the message itself is what helps: the scam text check, the delivery text check, the shop check, Before You Pay, the recruiter message check and a family safe word.

What you type into an AI app. An order published in the United States on 20 October 2026 tells federal civilian agencies to remove DeepSeek’s artificial intelligence products from their systems, and it turns attention to where the words typed into an assistant go. A VPN changes the route those words take, not their destination: they still arrive at the company that runs the app, whichever company that is, and its own rules decide how long it keeps them and who can read them. UtilForge’s guide to the DeepSeek federal order and what to keep out of any assistant covers the habits that help, and Hide names from AI takes names and numbers out before you paste.

Flaws on websites’ own servers. On 21 October 2026 the PHP programming language, which runs on the servers behind most websites, released emergency fixes for two critical flaws. Those flaws sit on the website’s side, and the fix belongs to whoever runs the website; a VPN on your phone does not reach their server. UtilForge’s guide to what website owners and visitors should do about PHP2Shell sets out the steps for each.

Being anonymous. The VPN company can see your connection, and every website you sign in to still knows it is you. Strong, separate passwords and two-step login protect accounts in ways a VPN cannot.

When to switch a VPN off

A VPN can get in the way when you need to prove who you are. Criminals use VPNs to hide where they are, so banks, payment services and identity-check companies watch for them: identity-verification companies such as Shufti Pro list “VPN detected” among the warning signals in their reports, and fraud-prevention companies such as Spur describe a VPN as one risk signal among many rather than proof of fraud. In practice, a sign-up, a payment or an identity check can be refused, delayed or marked as suspicious while your VPN is on, even when you have done nothing wrong.

When you open a bank account, pay a new company, verify your identity or register for a service that will hold your post or your money, switch the VPN off for that step, on a network you trust such as your home Wi-Fi or mobile data. Use your ordinary email address too, rather than a hidden or forwarding one, and turn off any private-relay feature such as Apple’s iCloud Private Relay for that step. Switch the VPN back on afterwards if you are on Wi-Fi you do not control. The free VPN check has a question for this moment.

Free VPNs: what researchers and investigators found

Running a VPN costs money, so a free one pays for itself in some other way: a paid tier, adverts, data or, in some cases, your connection.

In 2016 researchers from the Commonwealth Scientific and Industrial Research Organisation, the University of New South Wales, the International Computer Science Institute and the University of California, Berkeley tested 283 Android apps that use the VPN permission. They found that 18 per cent did not encrypt traffic at all, 38 per cent had at least one report of malware (harmful software) from the VirusTotal scanning service, though only 4 per cent were flagged strongly, 82 per cent asked for access to sensitive data such as user accounts and text messages, and 75 per cent of the free apps that promised privacy carried at least one third-party tracking library, a piece of code that records what people do for advertisers (67 per cent of all the apps did).

Ten years on, researchers at the University of Michigan, the University of New Mexico and the Indian Institute of Technology Delhi tested 281 free VPN apps found by searching Google Play. Twenty-nine leaked traffic outside the encrypted connection (often called the tunnel), 61 sent some data unencrypted, 76 sent the phone’s advertising identifier (a number that lets advertisers recognise the phone), and 246 contacted advertising and tracking addresses.

Investigators have also found free VPN apps used by criminal networks. In May 2024 the Federal Bureau of Investigation described a criminal network built from more than 19 million compromised internet addresses, spread partly through free VPN apps, some bundled with pirated games and software. In March 2026 it warned that free VPN services may enrol people’s devices in a “residential proxy” network without asking them clearly, which lets strangers send their own traffic through your connection, often under terms buried in long agreements. It advised caution before downloading free VPN apps, and using only official, trusted app stores.

Some free VPNs are the free tier of a paid service, with the paid tier covering the cost. A free VPN deserves the same questions as any company you trust with your traffic.

How to choose a VPN: a checklist

  • Who runs it? The company’s name and country of registration should be stated clearly, and you can look the company up on that country’s official register.
  • How does it pay for itself? Clear pricing, or a free tier paid for by a paid tier, is a better sign than “free, unlimited, forever” with no explanation.
  • What does it keep? The privacy policy should say what is recorded, for how long, and who it is shared with.
  • Has anyone checked? Look for an independent audit with a published report and a transparency report listing requests from authorities. On Android, Google Play shows a “Verified” badge on VPN apps that have passed an independent security review, the Mobile Application Security Assessment, among other conditions. The badge is only open to apps with at least 10,000 installs, 250 reviews and 90 days on the store, so a newer, honest VPN may not have it yet.
  • Where does it come from? Install from the official app store, and check that the developer name matches the company.
  • What does it ask for? A VPN does not need device administrator rights (which can stop an app being removed), accessibility access (which lets an app read and tap your screen), your text messages, your call log or your antivirus switched off.
  • How is it sold? Walk away from pop-ups that say your phone is infected, from “100% anonymous” or “unhackable” promises, and from any request to pay by gift card.

Built-in options you may already have

Some browsers, phone makers, mobile networks and security software packages include a VPN or a private-relay feature in certain plans, so check your existing subscriptions before paying for another. Apple’s iCloud Private Relay comes with the paid iCloud+ plan; Apple describes it as protecting your privacy when you browse in Safari, so it does not cover every app the way a full VPN does, and it is not offered in every country. Google ended the VPN that came with Google One storage plans on 20 June 2024; recent Google Pixel phones, and Google Fi phone plans in the United States, still include a VPN by Google. Work and school VPNs are set up by the organisation, which may be able to see traffic that passes through them. Plans change often, so read the current terms before you rely on one.

How we tested the VPN check

Before release, UtilForge ran the safety check against 31 written descriptions: ten paraphrased from careful, legitimate VPN listings with no brand names, which must not be marked as a stop sign; thirteen modelled on the warning signs the Federal Bureau of Investigation and the studies above describe, which must be; four that should be marked “take care”; and four edge cases. On 24 October 2026 four independent reviews by other AI systems tested it again, and thirteen more cases were added from what they found: lists that say what an app does not ask for, instructions written with spaced-out or dotted letters, common misspellings, and text in other languages. The check now knows the main warning signs in English and the most common ones in Spanish, French, German, Portuguese and Afrikaans, and when pasted text does not look like English it says so instead of giving an all-clear. The questions in the first part were run through eight combinations of answers, every link to another UtilForge tool was checked, and the page was watched in the browser’s developer tools to confirm it makes no network request while it checks. It reads only the words pasted into it and never names any VPN brand as good or bad.

Questions people ask

Do I need a VPN at home?

Usually not for safety. On your own home Wi-Fi with a password, most websites and apps already encrypt what you send. A VPN at home mainly hides which websites you visit from your internet provider, and the VPN company sees that instead.

Do I need a VPN on public Wi-Fi?

It is a sensible extra layer if you use public Wi-Fi often, and the Australian Cyber Security Centre recommends a reputable VPN service for frequent users of public hotspots. Most websites already encrypt what you send, so also check for the padlock and https, and avoid signing in to banking on networks you do not trust if your mobile data is available.

Does a VPN stop scams?

No. Scam texts, phishing links, fake shops, job-fee requests and voice-clone calls all reach you with a VPN switched on. Checking the message, the shop or the request itself is what helps, and UtilForge has free checks for each.

Are free VPNs safe?

Some free VPN apps have serious problems. Researchers who tested 281 free Android VPN apps in 2026 found that 29 leaked traffic outside the encrypted tunnel and 246 contacted advertising and tracking addresses, and in March 2026 the Federal Bureau of Investigation warned that free VPN services may enrol devices in residential proxy networks. Check who runs the app, how it pays for itself and what it asks for before you install it.

Does a VPN protect me when I use an AI app?

It protects the connection, not what you type. Your words still go to the company that runs the AI app, such as DeepSeek or any other assistant, and that company’s rules decide what it keeps. Take names, numbers and private details out before you paste.

Does a VPN make me anonymous?

No. The VPN company can see your connection instead of your internet provider, and any website you sign in to still knows it is you.

Why was my sign-up or payment refused while my VPN was on?

Banks, payment services and identity checks often treat a VPN as a warning sign, because it hides where you are. Switch the VPN off for that step, on your home Wi-Fi or mobile data, use your ordinary email address, and try again.

How do I know my VPN is on?

Most phones show a small VPN symbol or the word VPN in the status bar while it is connected, and the VPN app shows Connected. You can also look in your phone’s settings under VPN.

Sources

This guide is general information, not professional security advice.

A VPN answers one question well: who can see the path your traffic takes. The questions that keep most people safe online sit with the message, the shop, the request for money and the company behind each app, and those are the questions UtilForge’s free checks are built to help with.

Related guides

Free

If you doubt it,
UtilForge it.

Check what a VPN would do for you, and what a VPN app asks for, on your own phone or computer.

Open the VPN check Read the free book

For the household, the Family Safety Tools pack gathers fifteen checks into files you keep. You pay what you want, including nothing.