What Is a VPN Kill Switch?

A VPN works by sending your traffic through an encrypted tunnel. That protection lasts only as long as the tunnel does. If the connection drops for a few seconds, your device may carry on using your ordinary internet connection without telling you. A kill switch is the feature designed to close that gap.

This article explains the concept in general terms: what happens when a VPN drops, how kill switches typically work, how to test one and where the limits are. It does not describe any specific product feature.

What happens when a VPN connection drops

VPN connections are not permanent. They break for many ordinary reasons:

• Your phone moves from Wi-Fi to mobile data.
• The Wi-Fi signal weakens or the router restarts.
• The VPN server is busy or restarts.
• Your device wakes from sleep and the old tunnel has expired.
• A network blocks or interrupts the type of traffic the VPN uses.

When the tunnel breaks, the operating system usually falls back to the normal route. Apps that were mid-download, a chat app or a browser tab then keep running, but now over your regular network. Websites see your real IP address, and anyone who can see traffic on that network, such as the owner of a public Wi-Fi hotspot, sees the connection details again. You may not notice anything, because pages keep loading.

A plain example

You are using café Wi-Fi to log in to a work portal, with the VPN on. The café's router glitches for four seconds. The VPN drops and reconnects, but during those four seconds your laptop sent a background sync to a cloud service over the café network, using your real address. Nothing dramatic happened, but the protection you thought was constant was not. A kill switch would have blocked that sync until the tunnel returned.

How a kill switch works

The principle is simple: if the VPN is expected to be on, any traffic that does not go through it gets blocked. There are two common ways to do this.

Type	How it behaves	Typical trade-off
App-level	The VPN app watches the connection. If the tunnel drops, the app closes selected applications or blocks their network access until the VPN returns.	Easier to build, but there can be a short gap between the drop and the reaction.
System-level (firewall rules)	The app or operating system sets rules so that only traffic through the VPN interface is allowed out. When the tunnel is down, nothing else can leave.	Stronger and usually faster, but can feel like "the internet is broken" until you reconnect.

Some systems add a third behaviour, often called "always-on" VPN. The operating system itself keeps the VPN connected and, optionally, blocks any connection that is not using it. Android and several desktop operating systems offer settings in this style. See Android's own help page on connecting to a VPN for the general idea of how the system handles VPN connections.

For more background on how tunnels carry traffic, the Cloudflare overview of VPNs and our article on how a VPN works cover the basics.

When a kill switch matters most

• Public Wi-Fi. Hotspots are the places where an unprotected moment is most visible to other people on the network. See public Wi-Fi safety.
• Remote work. If you reach company systems or sensitive documents, an accidental fallback to an open connection could expose more than a casual browser tab would. Guidance such as NIST's telework publication stresses secure remote access as an ongoing requirement, not a one-time step.
• Long downloads and background apps. Apps that reconnect automatically keep using whichever network is available.
• Frequent network changes. Commuting, walking between Wi-Fi zones or toggling between mobile data and Wi-Fi all create reconnections.

How to test a kill switch

Testing a kill switch takes only a few minutes and teaches you what your setup really does.

1. Turn the kill switch on in the app or system setting, if your setup has one.
2. Connect the VPN and confirm your address has changed using an IP-check page.
3. Open something that keeps running, such as a video or a large download.
4. Interrupt the VPN safely. Switch off the VPN server connection from another window, or toggle airplane mode on briefly. Do not unplug anything you rely on.
5. Watch what happens to the traffic. With a working kill switch the video or download should stop or stall. If it carries on, your device has fallen back to the normal connection.
6. Restore the VPN and confirm the traffic resumes only after it is connected.

If a test shows traffic leaking, check app permissions, update the app and read the official instructions for your setup. If you want a general routine for verifying a connection, see how to check if your VPN is working.

Limits and what to watch for

• It is a safety net, not a fix for unstable connections. If your VPN drops often, find out why. The guides on reconnecting when the VPN disconnects and improving connection stability are the right next step.
• It only covers what it is configured to cover. An app-level switch that closes only certain apps leaves others running. A system-level rule is broader.
• Reaction time is not zero. Even a good kill switch may allow a very short leak between the moment the tunnel fails and the moment the block takes effect.
• It does not repair other leaks. A DNS leak or WebRTC leak can happen while the tunnel is up.
• It can look like an outage. If you block everything and forget the VPN is off, you will wonder why nothing loads. Check the VPN status first.
• Behaviour varies by system. Settings and wording differ between Windows, macOS, Android and iOS, and not every protocol or app supports the same options.

Summary

A VPN kill switch blocks traffic when the VPN tunnel fails, so your device cannot quietly continue on an unprotected connection. App-level versions react to a drop, while system-level rules prevent anything leaving outside the tunnel. Whichever you use, test it deliberately, understand its limits and treat it as a backup rather than a replacement for a stable connection.

If you are choosing a way to get a VPN with a fixed number of days and no automatic renewal, the pricing page explains how a prepaid pass works, and the Help Center has setup and troubleshooting guides.