Alternatives to Free VPNs for Basic Privacy

Plenty of people look at free VPNs, read about the trade-offs, and decide they would rather not hand their traffic to a service with no obvious income. That is a sensible reaction. The follow-up question is harder: if not a free VPN, then what? Leaving everything as it is feels wrong, and paying for a tool you may not need feels equally wrong.

The good news is that most everyday privacy worries have free fixes that do not involve trusting a third-party tunnel at all. They are less glamorous than installing an app, but they reach the actual problems. This guide matches common worries to specific settings and habits, shows what each one cannot do, and ends with a thirty-minute plan you can follow today. It is meant as a companion to how to build a simple privacy threat model, which helps you decide what you are protecting and from whom.

Start with the worry, not the tool

A VPN is one answer to a few specific problems. Before you replace it, check which problem you actually have. The table below lists common worries, a free alternative and the gap it leaves.

Your worry	Free alternative	What it still leaves open
Strangers on cafe or hotel Wi-Fi	Use mobile data or a hotspot for sensitive tasks	Uses your data allowance; your mobile operator still sees destinations
Sites tracking you across the web	Tracker blocking, cookie limits, separate profiles	The site you visit still sees your IP address
The network owner seeing domain names	Encrypted DNS (DoH or DoT)	Network can still see IP addresses you connect to
Passwords stolen or reused	Password manager and two-factor authentication	Does nothing for network snooping
Outdated phone or laptop	Automatic updates	None of the network risks
Apps collecting too much data	Permission review, limiting ad tracking	Apps may still collect what you allow
Wanting browsing not tied to you	Tor Browser for specific sessions	Slow, not for everyday apps, has its own limits

Notice that no row says "make you anonymous." Neither a VPN nor any of these measures does that on its own, which is worth remembering when you read any claim to the contrary.

Take strangers off your network

The strongest answer to public Wi-Fi risk is often not software at all. The US Federal Trade Commission explains in its guide to public Wi-Fi that networks you share with unknown people deserve caution, and that the fix includes where and how you connect.

• Use your phone as the network. A personal hotspot or a local data SIM puts you on a connection you control. Set a strong hotspot password and turn the hotspot off when finished.
• Match the task to the network. Reading news on a cafe network is a low-stakes task. Banking, changing passwords and handling client files are high-stakes, so do those on mobile data or at home.
• Stop auto-joining. On your phone and laptop, turn off automatic connection to open networks, and delete saved networks you no longer use. A device that remembers "Airport_Free" will cheerfully join any network with that name.
• Turn off sharing features. On a laptop, set the network profile to public so file sharing and device discovery are off.
• Look for the padlock, then verify the address. HTTPS protects the content of pages between you and a site. It does not tell you whether the site is the real one, so read the address, as described in our guide to staying safer on public Wi-Fi.
• Switch Wi-Fi off when idle. A radio that is searching for networks is a radio that can be tempted.

These habits cost nothing and remove the risk of strangers on your local network, which is one of the main problems a VPN is bought to solve.

Tighten your browser

Most of what people call "privacy" online is tracking by sites and advertisers, which a VPN barely touches. Your browser can do more here.

1. Turn on HTTPS-only mode where the browser offers it. The browser then warns you before loading a page over an unencrypted connection.
2. Enable tracker and cross-site cookie blocking. Modern browsers have built-in options. Use the strict or enhanced setting and see whether the sites you rely on still work, then loosen it only for those.
3. Create separate profiles. One for work, one for shopping and banking, one for casual browsing. Cookies and logins stay in their own box.
4. Remove extensions you do not use. Each extension is code that can read pages. Keep a short list from publishers you can identify.
5. Review site permissions. Location, camera, microphone and notification permissions often accumulate. Clear the ones you do not need.
6. Check what your browser reveals. The EFF's Cover Your Tracks tool shows how unique your browser fingerprint looks and whether trackers are blocked, and it is free.
7. Pick the search engine and sync settings deliberately. Know whether your history is synced to an account and decide whether you want that.

None of these hide your IP address from the websites you visit, so they are about reducing tracking rather than hiding location. That is a different goal, and often a more useful one.

Encrypt your DNS lookups

Each time you visit a site, your device asks a DNS server to translate the name into an address. On a default setup that question travels in the clear to a server chosen by the network, so the network owner can see which names you look up. Encrypted DNS, called DNS over HTTPS or DNS over TLS, wraps those questions, as the DoH specification in RFC 8484 describes.

You can turn it on in several places: in most major browsers' privacy settings, in recent versions of Android under private DNS, and in modern desktop operating systems. Choose a resolver whose policies you have read. Encrypted DNS hides domain names from the local network. It does not hide the IP addresses you connect to, and it does not encrypt your other traffic. Our comparison of DNS over HTTPS and a VPN explains the difference and why using both can make sense.

Make your accounts hard to take over

Many people who worry about network snooping lose accounts in a much more ordinary way: a reused password leaks from one site and works on another. Protecting accounts is the highest-value free step on this list.

• Use a password manager so every account has its own long, random password. Browsers and phones include free ones.
• Turn on two-factor authentication for email first, then banking, shopping, social and cloud accounts. The CISA page on multi-factor authentication explains why it blocks most simple takeovers, and our guide to two-factor authentication covers the types.
• Prefer an authenticator app or a passkey over text-message codes where you have the choice.
• Check for breaches. Free services will tell you if your email appears in a known data leak. If it does, change that password and any copies.
• Secure your email recovery. Whoever controls your email can reset the rest.

None of this stops someone reading unencrypted traffic, but it makes a stolen password far less useful.

Clean up the device and the apps

Phones and laptops leak more through settings than through the network.

1. Turn on automatic updates for the operating system and your apps. Most attacks use known flaws that patches already fix.
2. Review app permissions. Revoke location, contacts and microphone from apps that do not need them. Many phones show a privacy dashboard of recent access.
3. Limit ad tracking. Reset or disable the advertising ID in your phone settings and opt out of personalised ads where offered.
4. Delete apps you do not use. Each one is a possible source of data collection and a possible flaw.
5. Lock the device with a strong passcode and keep find-my-device enabled so you can wipe it if it is lost.
6. Use full-disk encryption, which is on by default on most modern phones and available on laptops, so a lost device does not expose its contents.

Where Tor fits, and where a VPN still wins

Tor, from the Tor Project, sends browsing through a chain of volunteer relays. It is free and has a clear design goal: hide who is visiting a site from that site and from the network. It is slower than normal browsing, some sites treat its traffic with suspicion, and it only covers the traffic you route through its browser. See our comparison of VPN vs Tor for details.

A device-level VPN still has the edge in a few cases:

• You use several apps, not only a browser, on a network you do not control.
• You want one consistent setting that protects mail, chat and sync together.
• You travel and join many different networks in a short time.
• You need speed that is close to normal for video calls.

These are the moments when a short prepaid pass can make sense. It is paid once, has a fixed number of days and does not renew by itself, so it fits a trip or project better than a long subscription. If you reach that point, it is worth comparing options calmly.

A thirty-minute plan, with three people as examples

Here is a plan you can work through on a single evening.

1. Minutes 1-5: Turn on automatic updates on your phone and laptop.
2. Minutes 6-12: Install or enable a password manager and change the password on your email first.
3. Minutes 13-18: Turn on two-factor authentication for email and banking.
4. Minutes 19-24: Switch on HTTPS-only mode and tracker blocking, and delete unused extensions.
5. Minutes 25-28: Enable encrypted DNS in your browser or phone.
6. Minutes 29-30: Delete saved Wi-Fi networks you do not use and turn off auto-join.

Nina, a university student, follows the plan and decides she needs nothing else. She studies on campus Wi-Fi, keeps banking for her phone's mobile data and has two-factor authentication on her university account.

Omar, a consultant who travels, does the same, then notices that he spends hours on hotel networks handling client documents. For him, the free measures reduce risk but do not replace device-wide protection, so he adds a short pass for the weeks he is away.

Hana, a retiree, is mainly worried about scam calls and fake bank messages. A VPN would do little for that. Her best steps are account security, checking senders carefully and recognising phishing sites, which are about habits, not tunnels.

Common mistakes

• Replacing a free VPN with nothing, and then using open Wi-Fi for banking.
• Installing several privacy extensions at once and creating new risks.
• Trusting a padlock icon as proof that a site is genuine.
• Turning on encrypted DNS and assuming everything is now private.
• Forgetting that mobile operators and home internet providers also see destinations.
• Using the same password in a "safer" new account.
• Treating Tor or a VPN as a way to avoid every kind of tracking when logins and cookies still identify you.

Summary

You do not have to choose between a free VPN and nothing. Taking strangers off your network with a hotspot, tightening browser settings, encrypting DNS, securing accounts with a password manager and two-factor authentication, and keeping devices updated cover the majority of everyday privacy concerns at no cost. They do not hide your IP address or protect every app on shared Wi-Fi, so a short, paid, device-level tool remains the right choice for travel and for work that happens on networks you do not control.

When the free steps are in place and you still need that extra layer, you can compare options on the pricing page whenever it suits you.