Is a Free VPN Safe? What the Research Found

Some free VPNs are safe, but many are not, and the difference comes down to how the provider pays for its servers. A free plan offered as a taster by a company that sells paid subscriptions — Proton VPN is the best-known example — can be trustworthy. A free VPN with no paid product has to make money another way, and the research on what those apps actually do is not reassuring: a study of 283 Android VPN apps found that 75% used third-party tracking libraries, over 38% contained some malware presence according to VirusTotal, and 18% tunnelled traffic without encryption at all.

What the research found

The study is "An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps" by researchers from CSIRO's Data61, UNSW, ICSI and UC Berkeley, presented at the Internet Measurement Conference in 2016. They examined 283 apps using Android's VPN permission, drawn from more than 1.4 million Google Play apps. Its main findings:

The researchers also found two apps injecting JavaScript into users' traffic for advertising and tracking, and four that intercepted encrypted (TLS) traffic. Many of these apps were popular: 37% had more than 500,000 installs.

The study is from 2016 and covers Android apps that use the VPN permission, not only free ones. App stores and apps have changed since. But it shows what a VPN app is technically able to do with your traffic — which is why the provider's business model matters.

How free VPNs pay for themselves

• Upselling a paid plan. The provider gives away a limited version and earns from upgrades. This is the model to look for.
• Advertising and tracking. Ads in the app, or tracking libraries that collect data about you — the 75% figure above.
• Using your connection. Some services route other people's traffic through your device. Hola's own FAQ says free users of its full app get access "in exchange for safely using some of your device's resources", that this applies on Windows and Android when the device is idle, and that the network serves business use by Bright Data. Browser-extension-only users are not part of that network, according to the same FAQ.
• Worse: tampering. Injecting scripts or intercepting traffic, as the study found in a handful of apps.

A five-point safety check for any free VPN

• Does the company sell a paid plan? If not, find out how it makes money before installing.
• Does it publish an audited no-logs policy? An independent audit beats a promise.
• Who runs it, and where? A named company with a real address and jurisdiction you can look up.
• What permissions does the app ask for? A VPN does not need your contacts or text messages.
• Does it leak? After connecting, run a leak test at dnsleaktest.com or ipleak.net to check your DNS and IPv6 traffic go through the tunnel.

Free plans that pass the check

Proton VPN Free. Proton VPN's free-plan page (checked 16 October 2026) says the plan has "no data or time limits", shows no ads, does not log your online activity and covers one device. Free users get the kill switch and the Stealth protocol; P2P, secure streaming and Plus servers are listed as paid features. Proton earns from its paid plans, which is what makes the free tier credible. Our Proton VPN review covers how far the free plan stretches.

Windscribe. Windscribe also offers a free plan alongside its paid Pro plan, which its upgrade page listed at $9 a month or $69 a year, with unlimited data across more than 69 countries. Check the free plan's current data allowance and locations on its site before relying on it.

When paying makes sense

A free plan is fine for occasional use — checking email on hotel Wi-Fi, for example. Pay when you need more devices, streaming, P2P, faster servers or the full server list. Paid VPNs such as NordVPN offer monthly plans, so you can try one without a long commitment; compare current prices and audits in our best VPNs of 2026 and the security-first shortlist in best VPN for privacy and security.

Frequently asked questions

Are free VPNs safe to use?

Some are. A free plan from a provider that sells paid subscriptions, publishes an audited no-logs policy and asks for minimal permissions can be safe. Free VPNs with no visible business model carry real risks: the 2016 CSIRO-led study found tracking libraries in 75% of 283 Android VPN apps and malware presence in over 38%.

How do free VPNs make money?

Through upselling paid plans, advertising and tracking, or using your device and bandwidth for other people's traffic. Only the first model aligns the provider's interests with your privacy.

Is Proton VPN free really free?

Proton's free-plan page says it has no data or time limits, no ads and no activity logging, for one device. Some features, such as P2P and streaming support, are reserved for paid plans.

Can a free VPN steal my data?

A VPN app can see and, if malicious, alter your traffic. The study found apps injecting JavaScript and four intercepting encrypted traffic, which is why the provider's trustworthiness matters more than the price.

Related

For a head-to-head of two privacy-focused providers, see Proton VPN vs Mullvad; for the big three paid services, NordVPN vs ExpressVPN vs Surfshark.

Sources checked 16 October 2026: Ikram et al., "An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps", IMC 2016 (CSIRO-hosted PDF); protonvpn.com/free-vpn; windscribe.com/upgrade; hola.org/faq. Editorial content.