Android Always-On VPN Explained

Most people think of a VPN as something you switch on, use and switch off. Android also has a second way to run one: the always-on setting, which treats the VPN more like a part of the phone's plumbing than an app you open. Once enabled, the phone starts the VPN by itself after a restart, tries to keep it running, and, if you choose, refuses to send any traffic outside it.

That sounds like a pure benefit, and for some people it is. For others it is the reason the internet suddenly stops working at the airport. This article explains what the setting really does, where to find it, how it differs from an app's own auto-connect, who should switch it on, and how to deal with the side effects.

What always-on VPN means

On Android, a VPN app normally creates its tunnel only when you tap connect. If the phone restarts, or the app is closed by the system, the tunnel is gone until you open the app again. In that gap, your traffic goes out the ordinary way, unprotected.

The always-on setting changes who is in charge. It is a feature of the operating system, not of the app. When you pick an app as the always-on VPN, Android does three things.

1. It starts the VPN automatically, usually when the phone boots and the user unlocks it.
2. It restarts the VPN if it stops, for example after a network change or if the system ended the app's process.
3. Optionally, it blocks traffic outside the VPN. A second switch tells Android to refuse any connection that is not going through the tunnel.

The first two are about convenience. The third is about safety, and it is the one with sharp edges. It is useful to know how the tunnel itself works, which what a VPN is covers, before deciding which parts you want.

Where to find the setting

The menu names vary between Android versions and phone makers, but the route is similar everywhere.

1. Open Settings.
2. Go to Network & internet (sometimes Connections or More connection settings).
3. Tap VPN.
4. Find your VPN app in the list and tap the gear icon beside it.
5. Switch on Always-on VPN.
6. If you also want the strict behaviour, switch on Block connections without VPN.

If the gear icon is missing, the app may not have created a VPN profile yet. Open the app, connect once and allow the system request, then return to Settings. The permission side of that is explained in Android VPN permissions. The official Android Help page on connecting to a VPN shows the system screens for your version.

One caveat is important. The always-on setting only works with apps that support it. If the toggle is greyed out or gives an error, the app does not provide the hooks. In that case a feature inside the app, if it has one, is the alternative.

Always-on versus an app's own auto-connect

Many VPN apps have an option such as "connect when the app opens" or "connect on Wi-Fi". It is easy to confuse these with the system setting, but they behave differently.

Feature	System always-on	App's own auto-connect
Who controls it	Android	The VPN app
Starts after reboot	Yes, handled by the system	Only if the app is allowed to start in the background
Restarts after the app is killed	Yes	Often no, until you open the app
Can block traffic when the VPN is down	Yes, with the block switch	Usually no
Where the switch lives	System Settings, VPN	Inside the app
Can be bypassed by battery saver	Less likely	More likely

Neither is better in every case. If you want a light convenience, such as having the VPN come back after a reboot, either may be enough. If you want a guarantee that nothing leaves the phone outside the tunnel, only the system option with the block switch gives it.

The block switch and the kill switch idea

The strict option, Block connections without VPN, is Android's form of what other platforms call a kill switch. When it is on and the VPN is not connected, Android refuses all network traffic. The phone appears to have no internet, even though Wi-Fi shows connected.

That is the point. If a tunnel drops quietly, a normal phone just carries on, sending your traffic unprotected without telling you. With the block switch, the failure is visible and safe. The longer explanation of the idea is in what a VPN kill switch is, and the Android-specific behaviour is covered in blocking connections without VPN on Android.

The cost is that anything that needs the internet before the VPN is ready will fail. Think of the first seconds after boot, a captive portal, or a network that refuses the VPN. You trade a little convenience for the assurance that nothing leaks.

Who benefits from always-on

Not everyone needs it. Here are the common cases where it earns its place.

• The frequent public Wi-Fi user. Someone who moves from cafe to station to hotel all day gets protection without having to remember to tap connect each time.
• A person who handles sensitive work on the phone. If the phone is used to reach work tools or client files, a silent gap is more serious.
• A family phone that others use. A parent who sets up a phone for a child or an older relative can make protection the default, so it does not depend on remembering.
• Someone who forgets. If you notice that you rarely switch the VPN on, making it automatic fixes the habit.

And here is who may find it more trouble than it is worth.

• People who mostly use home Wi-Fi and mobile data and only need a VPN occasionally.
• People who use many apps that dislike VPN connections, such as some banking and streaming apps.
• Anyone who often connects to hotel or airport Wi-Fi with a login page, if they enable the block switch without understanding what happens next.

Side effects to expect

The strict mode produces a few predictable effects. Knowing them in advance turns surprises into routine.

Captive portals. Hotel, airport and cafe networks often show a login or terms page in the browser before real internet access begins. With the block switch on, the phone may be unable to reach that page, because nothing is allowed outside the VPN, and the VPN cannot connect until the network is open. The fix is to switch the block option off, complete the login, then turn it back on. Some phones handle this smoothly, others do not.

Mobile hotspots. When you share your phone's connection, the phone's own traffic is protected, but devices that connect to the hotspot are a separate matter and may not be covered. See sharing a VPN over a mobile hotspot for the details.

Banking and streaming apps. Always-on makes the VPN visible to every app all the time. Services that dislike VPN connections will react to it every time you open them. If one of your daily apps does this, always-on may be too blunt.

Battery and data. The tunnel is kept alive, which uses a little more battery and a little more data. Poor signal causes more reconnect attempts. If battery drain is your concern, read Android VPN battery use.

Expired passes and bad sign-ins. If the pass has ended or the saved login is wrong, the VPN cannot connect. With the block switch on, the whole phone is offline until you fix it. The symptom looks like a network fault, but it is a VPN fault. Check your My Pass page first.

Setting it up safely, step by step

A cautious order avoids getting locked out.

1. Make sure the VPN works normally first. Install the app, sign in with the details from your My Pass page, connect once and confirm it works. The set up a VPN on Android guide covers this.
2. Turn on Always-on VPN only, without the block switch. Restart the phone and check that the VPN symbol appears after you unlock it.
3. Test on mobile data and home Wi-Fi for a day. See whether anything breaks.
4. Add the block switch if you want the strict behaviour. Test again by turning Wi-Fi off and on, and by switching to airplane mode and back.
5. Practise the escape route. Know where the setting is, so that in a hotel lobby you can turn off the block switch in a few taps.
6. Write down your plan for the expiry date of your pass. A prepaid pass ends on its own, and the day it ends is the day the block switch can take the phone offline.

Troubleshooting always-on problems

Symptom	Likely cause	What to try
No internet after reboot	VPN has not reconnected yet, block switch is on	Wait a minute after unlocking; open the app and connect manually
Wi-Fi connected but nothing loads at a hotel	Captive portal cannot be reached	Turn off the block option, sign in to the portal, turn it back on
Toggle is greyed out	The app does not support the system feature	Use the app's own auto-connect, or pick a different app in the list
VPN keeps dropping and reconnecting	Weak signal or battery optimisation	Check the app's battery setting; see Android VPN disconnects
Everything stopped on the day the pass ended	Pass expired, block switch is blocking	Renew the pass or turn off the block switch
Hotspot clients have no protection	The phone's tunnel does not wrap hotspot clients	Install the VPN app on each client device

For more general steps, how to troubleshoot a VPN on Android walks through the standard checks.

Limits and honest expectations

Always-on does not make a VPN more powerful. It makes it more consistent. It does not make you anonymous, does not stop phishing or fake messages, does not repair a weak signal and does not override the rules of a network, employer or country. The US Federal Trade Commission explains in its guide to public Wi-Fi why open networks deserve care, and a VPN that is always running is one way to respond.

It is also a setting that you can change at any time. Try it for a week, see how it fits your day, and turn it off or loosen it if it gets in the way.

Summary

Android's always-on VPN setting lets the system start and restart your VPN automatically, and, with the block switch, refuse any traffic that is not inside the tunnel. It helps people who use public Wi-Fi often, handle sensitive tasks on the phone or forget to connect. It can also cause trouble with captive portals, hotspots, apps that dislike VPNs and expired passes. Turn it on in stages, test it, and keep the route to switch it off in mind.

If you want to try the setup on a short pass, the pricing page shows what is available.