What is a VPN kill switch and why it matters

You have probably seen the kill switch toggle in your VPN’s settings and wondered whether you should turn it on. It is actually one of the most important privacy features a VPN has. In plain terms, a VPN kill switch is a safety toggle that cuts your internet connection the instant the encrypted VPN tunnel disconnects, so no data ever slips out unprotected. Here is exactly what it is, what it really does, its two types, and why you should keep it on.

What is a VPN kill switch, exactly?

A kill switch is a feature built into the VPN app. Its job is simple: constantly watch the state of the encrypted tunnel, and if that tunnel breaks for any reason, immediately block all internet access. Rather than letting your device silently reconnect through your regular internet provider (which would expose your traffic and your real IP address), the kill switch keeps you offline until the VPN is back up. Here is what happens in three steps when the protection kicks in.

In short, the kill switch enforces one strict rule: no VPN, no internet. It is a safety net that acts precisely in the blind spot where most leaks happen.

Why does a VPN kill switch matter?

The problem it solves is real and invisible. A VPN connection is not endlessly stable: it can drop when you move from Wi-Fi to mobile data, when your device wakes from sleep, when the VPN server is congested, or during an automatic switch to another server. During those micro-outages, your operating system does not stop sending requests. It quietly restores the normal connection through your internet provider, using your real IP address.

The result: without a kill switch, for a few seconds, your location, your network identity, and your browsing become visible again, exactly what the VPN was supposed to hide. On a P2P download, a sensitive session, or in a country that filters the web, that brief leak can be enough to expose you.

What are the two types of kill switch?

Not all kill switches work the same way. There are two main levels of action, and good VPNs often let you choose.

1. The system-level kill switch

This is the strictest and safest version. Also called a full or system-wide kill switch, it blocks all of the device’s internet traffic the moment the VPN drops. No app can communicate until the tunnel is restored, not your browser, not background updates, nothing. This is the recommended setting for maximum privacy.

2. The app-level kill switch

More flexible, the app kill switch (sometimes called per-app protection) only cuts off the programs you designate. You could, for example, require that your torrent client and browser stop if the VPN drops, while the rest of the device stays online. It is handy when you only want to protect specific activities, but it is less airtight: any app not on the list keeps transmitting in the clear.

Why (and when) should you enable the kill switch?

Good news: it is a set-and-forget option in the app’s settings. On some VPNs it is on by default, on others it is not, which is why it pays to check. Here are the situations where it is especially recommended:

• On the move and on public Wi-Fi: network changes (Wi-Fi to mobile data, one hotspot to another) cause the most frequent drops.
• For P2P and torrenting: an IP leak, however brief, exposes your real address to every other peer on the swarm.
• In countries that filter the internet: there, an in-the-clear reconnection can reveal that you are bypassing censorship.
• For any sensitive activity: work access, confidential data, or browsing you would rather keep private from your internet provider.

In practice, there is little reason to leave it off. The only downside is that your connection cuts out while the VPN reconnects, which can surprise you if you do not know where it is coming from.

What a kill switch does NOT do

Here is the honesty check. A kill switch is excellent protection, but it does not turn your VPN into a total anonymity tool:

• It does not make you anonymous. It prevents leaks during drops, but your VPN provider still sees your traffic pass through, which is why an audited no-logs policy matters.
• It does not protect you from malware or phishing: that is the job of antivirus software, not a kill switch.
• It does not plug DNS or WebRTC leaks on its own: those are separate protections you should verify individually in the VPN’s settings.
• It does not always turn itself on: on some apps you have to enable it manually, or it does nothing at all.

A kill switch protects against accidental leaks. It replaces neither an audited no-logs policy nor your own vigilance.

How to spot a good kill switch before you buy

Every serious VPN offers a kill switch, but its quality and availability vary by platform. Before you commit, keep these points in mind:

• Availability on your platform: the kill switch is often complete on Windows, macOS, and Android, but more limited on iOS for technical reasons specific to Apple. Check that it exists on your devices.
• Choice of level: the best providers offer both system and app modes.
• On by default: a good sign on the security side, even though you can always adjust it afterward.
• Real-world reliability: this is what we test in real conditions in our reviews, because a kill switch that lets a few packets through is worthless.

Services like NordVPN, Proton VPN, and Surfshark include both a system and an app kill switch on their desktop apps, enabled with one click in the settings. To compare the offers in detail, head to our shortlist.