Why VPN Upload Speed Drops

You turn on your VPN, run a speed test and the download looks acceptable. Then you try to send a video to a colleague, back up your photos or join a video call, and the upload crawls. Many people report that uploads suffer far more than downloads when a VPN is on. The reasons are a mix of how home internet lines are built, what a VPN adds to every packet, and some tricks of how TCP behaves.

This article answers one question: why VPN upload speed drops, how to tell which cause applies to you, and what you can change. It is about uploads in particular. If you want the general picture of why speed varies, start with why internet speed changes with a VPN.

Start with the shape of your connection

Most home internet plans are asymmetric: the downstream is much larger than the upstream. Cable and older DSL lines are the classic examples, where a plan may offer 100 Mbps down and 10 Mbps up, or even less. Fibre plans are often more balanced, but many still offer a smaller upstream.

That ratio matters for a VPN in two ways.

1. The ceiling is lower. If your raw upload is 10 Mbps, even a perfect tunnel cannot beat 10 Mbps. After overhead, you might see 8 or 9.
2. A fixed loss feels bigger. If the tunnel costs 15 percent of your throughput, you lose 15 Mbps from a 100 Mbps download but you also lose 1.5 Mbps from a 10 Mbps upload. The percentage is the same, yet the small number tends to become the bottleneck for the task you are doing, such as sending a large file.

Therefore the first step in any diagnosis is to know your normal upload number without a VPN. Without that baseline you cannot tell a drop from an ordinary limit.

The overhead every packet carries

A VPN wraps each packet in an extra layer. The wrapper adds headers and some bytes for encryption and authentication. For a typical full-size packet the overhead is a few percent. For small packets it is a larger share. This overhead applies to downloads as well, but with a small upstream it is more noticeable.

Two things follow.

• Raw throughput is slightly higher than what you measure inside the tunnel. Your line may carry 10 Mbps of packets, but 0.5 Mbps of that is the wrapper.
• Packet size matters. If the tunnel's packet size is not matched to the path, packets can be fragmented or dropped, which is costly for uploads. The method for working this out is in how to find the right MTU, and the background to Path MTU is in RFC 1191.

Protocol details also change the numbers a little, but they are not the main reason for a large drop.

Acknowledgements travel the other way

A fact that surprises people: when you download over TCP, your device sends a steady stream of small acknowledgement packets upstream. When you upload, the acknowledgements come downstream instead. This has two consequences for uploads.

• During a big download, your upstream is partly used for acknowledgements. If you are uploading at the same time, the two compete for the thin upstream.
• During an upload, the sender depends on acknowledgements to keep sending. If they arrive late, the upload slows down even though the line has spare capacity.

With a VPN, acknowledgements travel through the tunnel too, so they pick up the extra round-trip time of the longer route. TCP's sending rate depends on round-trip time: a rough rule is that the maximum speed of one TCP connection is the window size divided by the round-trip time. If a longer route doubles the round-trip time from 40 ms to 80 ms, a single connection's top speed can fall to about half, unless the window is large enough to compensate.

A worked example: why one connection crawls

Take a connection with the following numbers.

Item	Without VPN	With VPN to a faraway location
Round-trip time	30 ms	140 ms
Upstream line	20 Mbps	20 Mbps
Typical single-connection window	256 KB	256 KB
Rough single-connection ceiling	about 70 Mbps	about 15 Mbps

The line itself still has 20 Mbps free. But a single TCP connection with the same window can send only about 15 Mbps over the longer route, and loss on a long path pushes it lower. Real uploads often use one big stream, such as a single file to a cloud service, so they feel the effect more than a web page that opens many parallel connections.

This is why uploading the same file to the same service can be much slower through a distant location and noticeably better through a nearer one. It is not a defect; it is how TCP works over distance.

Common causes, in order of how often they matter

1. Wi-Fi uplink

Your phone's or laptop's radio is weakest when sending. A small antenna, a wall and a crowded channel reduce the upload rate more than the download rate. If the VPN test is on Wi-Fi, repeat it on a cable before blaming anything else.

2. Congested or distant route

The path to the VPN server, and from it to the destination, may be crowded in the evening. Uploads suffer because loss triggers TCP to slow down sharply, and each recovery is slow. Try a nearer location and test at different hours. A quick check for loss is described in VPN packet loss: causes and diagnostics.

3. Your device's CPU

Encryption takes processor time. On a modern laptop or phone this is small, but an old phone in power-saving mode, a low-end tablet or a busy computer can run out of headroom, and uploads can be hit because the device must encrypt every outgoing byte. If the CPU graph jumps to 100 percent during the upload, this is a clue.

4. Competing upload traffic

Cloud backups, photo sync, game updates and other devices in the house quietly use upload capacity. A thin upstream fills quickly, then the router queue grows and delay climbs. You will see slow uploads and sluggish calls at the same time.

5. Packet size problems

If packets are too large for the path, they may be fragmented or silently dropped, and uploads stall because the sender keeps retrying. The signs are uploads that start and stop, or that fail at a certain size while small transfers work.

6. Provider traffic management

Some providers manage certain types of traffic during busy hours, and a VPN can change how that traffic is classified. This is hard to prove and hard to change from your side. If you see a pattern of slow uploads only at peak time on every location, discuss it with the provider.

7. The destination's own limits

Many services throttle uploads per connection or per account. The destination might be the limit, whatever your VPN does. Test the same upload to a different service to check.

A measured test routine

You can find the cause in about fifteen minutes with a plan.

Step 1: Baseline without the VPN, on a cable if possible. Run a speed test and note download, upload and latency. Repeat three times and average the upload.

Step 2: Same test with the VPN on, same cable. Connect, wait ten seconds, repeat three times. Note the drop as a percentage.

Step 3: Same test with the VPN on, Wi-Fi. This shows how much of the loss is wireless.

Step 4: Another VPN location. Test a nearer location, then a farther one. If the nearer one is much better, distance and route are the issue.

Step 5: A real upload. Upload a 100 MB file to a service you use and time it. Speed tests may use several parallel connections, while a real upload often uses one, so they can disagree.

Step 6: Watch the device. Open the task manager or activity monitor during the upload. High CPU suggests a processing limit.

Step 7: Stop other uploads. Pause backups and other devices, then repeat. A big improvement means competition for the upstream.

Interpreting the numbers:

Observation	Probable cause
Upload poor even without the VPN	Your line or router; not the VPN
Cable fine, Wi-Fi poor	Wireless link
Near location fine, far location poor	Distance and TCP round-trip time
Poor at night only	Congestion at peak hours
CPU at 100 percent	Device limit
Speed test fine, real upload poor	Single-stream limit, destination throttle or packet size
Uploads stall and restart	Packet loss or MTU

What to change, in order

1. Fix the local link first. Use a cable, or improve the Wi-Fi position and band.
2. Pick a nearer VPN location for large uploads. Save distant locations for tasks where upload is not critical.
3. Pause competing uploads from your own devices, including phone photo sync.
4. Schedule heavy uploads off-peak, such as early morning, when routes are quieter.
5. Close heavy apps on the device and keep it plugged in and cool during long uploads.
6. Keep the VPN app and system updated, since fixes and performance improvements arrive in updates. You can find the official apps from the download page.
7. Leave the VPN's default connection settings alone unless support advises otherwise, and change one thing at a time.
8. Check MTU if uploads stall or fail at a certain size.
9. Consider turning the VPN off for a large, non-sensitive upload on a trusted network. Decide based on what you are sending.
10. Ask your provider about upstream speed if the line is the limit. Some plans offer a much higher upload for a modest change.

Limits and expectations

• Some drop is normal. Overhead and a longer route cost a little, so 5 to 20 percent less than your baseline is not unusual.
• A VPN cannot raise your upload above your line. If your plan gives 10 Mbps up, the tunnel stays below that.
• Speed tests and real uploads differ. The service you upload to and its own limits matter as much as the tunnel.
• Results vary by time and route. Test more than once before drawing conclusions.
• Encryption is not something to trade away for speed. If a particular upload is large and not sensitive, you can decide to send it without the VPN, but do that deliberately and only on a network you trust.

For wider advice on slowness, see why a VPN can be slow, and for how to run a fair comparison see how to speed test a VPN.

Common mistakes

• Comparing VPN upload with the advertised plan speed rather than a measured baseline.
• Testing once, on Wi-Fi, in the evening.
• Choosing a distant location for a large upload because the download looked fast.
• Ignoring background sync from phones and laptops.
• Changing several settings at once.
• Assuming upload must equal download.

Summary

Upload speed drops with a VPN because the upstream is usually the narrower part of your line, because the tunnel adds overhead and a longer route, because TCP uploads are sensitive to round-trip time and loss, and because weak Wi-Fi, a busy device or competing uploads add more. Measure first without the VPN, then with it on a cable, then with another location, and look at CPU and background traffic. Most of the gain comes from fixing the local link, picking a nearer location and pausing competing uploads.

If a short prepaid pass would help you test another location, the pricing page explains how passes work.