VPN kill switches
If your VPN drops for a few seconds, your phone or laptop carries on without it. A kill switch stops that. It's the one feature almost everyone should turn on.
Last updated 8 Oct 2026
The short version
- A kill switch blocks your internet connection while the VPN is reconnecting, so nothing leaks out unprotected.
- Check it's on. Some VPNs ship with it on; Proton VPN's is off until you turn it on.
- Phones, TVs and browser extensions are the weak spots. Several VPNs' TV apps have no kill switch, and iPhones work differently.
What a kill switch does
VPN connections drop more often than you'd think: when your phone moves from Wi-Fi to mobile data, when a hotel's Wi-Fi asks you to log in again, when your laptop wakes from sleep, or when a VPN server restarts. For the few seconds it takes to reconnect, your apps keep sending data, and without a kill switch it goes out over your normal connection, showing your real IP address to whatever you're connected to.
A kill switch notices the VPN has gone and blocks traffic until it's back. You'll see pages stop loading for a moment instead.
Two kinds of kill switch
Most VPNs now offer two levels, under different names:
- Standard: blocks traffic only if the VPN drops unexpectedly. If you disconnect it yourself, your internet works as normal.
- Always on: blocks all traffic whenever the VPN isn't connected, even after you switch it off, until you connect again or turn the setting off. Surfshark calls this strict mode (Surfshark), ExpressVPN "Enable at all times" (ExpressVPN), Proton VPN and PIA an Advanced kill switch, and Mullvad Lockdown mode (Mullvad).
The always-on kind is for when a leak would really matter: torrenting, or a journalist on hotel Wi-Fi. It can be a nuisance otherwise, since nothing works when you've switched the VPN off. Mullvad's standard kill switch can't be turned off at all.
NordVPN's Windows app also has an App Kill Switch, which closes chosen apps when the VPN drops rather than blocking everything (NordVPN).
Which VPNs have one
"In every app" means each of the provider's apps for Windows, macOS, iOS, Android and (where it has one) Linux. The notes say what's different on each platform, in the provider's words.
| VPN | Kill switch |
|---|---|
| CyberGhost | Not confirmed |
| ExpressVPN | Yes, in every appCalled Internet Kill Switch (formerly Network Lock), on by default on Windows, Mac, Linux, Android, iOS and routers. Windows, Mac and Linux have an Advanced Kill Switch (Enable at all times); iOS offers Standard and Advanced levels. |
| Mullvad | Yes, in every appBuilt in and always on; it can't be turned off. Lockdown mode also blocks traffic while you're disconnected. |
| NordVPN | Yes, in every appWindows has an Internet Kill Switch plus an App Kill Switch (off by default). Android 8+ and Linux are system-wide. iOS and the App Store macOS app use 'VPN bypass prevention'; the direct-download macOS app has an App Kill Switch. Not on Fire TV Stick. |
| Private Internet Access | Yes, in every appIn the desktop and mobile apps; PIA says Apple's limits mean iOS isn't fully protected on untrusted networks. The Advanced Kill Switch also blocks traffic while the VPN is off. Not in the Apple TV or Android TV apps. |
| Proton VPN | Yes, in every appWindows, macOS, Linux, iOS and Android; off until you turn it on. Windows and Linux also have an Advanced kill switch that blocks all internet when not connected; iOS has it in beta. On Android it uses the system Always-on VPN and Block connections without VPN settings. The kill switch is generally not compatible with split tunnelling except on Windows. |
| Surfshark | Yes, in every appListed for iOS, macOS, Android, Windows and Linux. Two system-level modes: soft (acts only if the VPN drops unexpectedly) and strict (blocks internet whenever the VPN is off, even after a manual disconnect). Not in the browser extension. |
What catches people out
iPhones and iPads
Apple controls how VPN apps run on iOS, and the kill switch there isn't quite the same thing. NordVPN's iOS app uses "VPN bypass prevention" instead. PIA says its kill switch can't fully protect iOS on untrusted networks because of Apple's limits (PIA).
TVs and browser extensions
PIA's Apple TV and Android TV apps have no kill switch, and NordVPN's Fire TV Stick app doesn't either. Browser extensions only cover the browser, and Surfshark's has no kill switch. For a TV it rarely matters; for anything private, use the full app.
Kill switches and split tunnelling
If you've told some apps to skip the VPN (split tunnelling), they aren't protected by the kill switch, by design. Proton VPN says its kill switch generally can't be used with split tunnelling except on Windows (Proton VPN), and Mullvad notes that split-tunnelled apps keep their internet access even in Lockdown mode.
Android's own setting
Android has a built-in "Always-on VPN" with "Block connections without VPN" (under Settings, Network, VPN). Proton VPN's Android kill switch relies on it, and it works with any VPN app. ExpressVPN warns that turning it on stops split tunnelling and blocks devices on your local network.