Wednesday, October 14, 2026
Tech

What Is a VPN Kill Switch and Why It Matters

Rive News Research Desk

Published · 9 min read

Key takeaways

  • A VPN kill switch blocks your internet traffic the instant your VPN connection drops, so your real IP address never leaks out.
  • System-level switches block everything, while app-level switches close only the apps you pick.
  • Turn it on if you use a VPN for privacy, and check whether your provider offers a stricter always-on mode.
A laptop on a desk connected to the internet
A laptop connected to a VPN still needs a backup plan for the moment the connection dropsPhotograph: Ahmed brens, via Wikimedia CommonsImage: Wikimedia Commons

A VPN hides your real IP address by routing your traffic through an encrypted tunnel. That protection lasts only as long as the tunnel stays up. If the connection drops for even a few seconds, your device can quietly fall back to your normal connection, and your real IP address goes out in the open.

A VPN kill switch exists for exactly that moment. It watches your VPN connection and blocks your internet traffic the instant the tunnel fails. This article explains what a kill switch is, including how it works, the two types, how to turn one on, and the limits worth knowing.

What is a VPN kill switch?

A VPN kill switch is a safety feature that cuts your internet access when your VPN connection drops. CyberInsider defines it plainly: it disconnects your device from the internet if your VPN connection suddenly drops, so your real IP address does not get exposed while the VPN is not working.

Proton VPN describes the same idea from the provider side. Its kill switch blocks all external network traffic to and from your device until the app automatically re-establishes a connection to the same VPN server. The block stays in place until the tunnel is back.

Think of it as a circuit breaker for your privacy. The VPN is the circuit. When the circuit breaks, the switch trips, and nothing flows until the circuit is repaired.

How a kill switch works

The process runs in three steps. First, the VPN app monitors the connection to the server. Second, the moment it detects a drop, it applies a block.

Third, it tries to reconnect, and it lifts the block only after the tunnel is live again.

Under the hood, the block uses your operating system's own tools. Proton VPN explains that on Windows its kill switch uses the Windows Filtering Platform, the same technology behind Windows Firewall, to deploy filters that block connections outside the VPN interface. On Linux, it creates a dummy network interface and redirects all outgoing traffic there, which blocks it.

Drops happen more often than people expect. Proton VPN lists switching WiFi networks and technical issues as common triggers. A phone moving between a home router and a coffee shop network, or a laptop waking from sleep, can both break the tunnel for a moment.

Without a kill switch, that moment is exactly when your traffic leaks.

The two types of kill switches

Kill switches come in two forms, and the difference matters. CyberInsider calls them system-level and application-level switches.

A system-level kill switch blocks all traffic from leaving the device when the VPN drops. CyberInsider notes that because it stops everything, it is a sure way to prevent your IP address from leaking. The trade-off is blunt: your whole internet connection stops, including browsing, syncing, and gaming, until the VPN reconnects.

An application-level kill switch is more selective. It lets you pick which apps get stopped when the VPN drops, while other apps keep working. CyberInsider warns that this raises the odds of a leak, since some apps will still talk to the internet unprotected.

People typically use it to cover their browser, email, chat apps, and torrent clients.

Some providers offer both. CyberInsider points to NordVPN, whose Windows app provides a system-level switch and an app-level switch side by side. ExpressVPN takes a different route with its Network Lock feature, a system-level switch that works alongside split tunneling, so apps you deliberately route outside the tunnel are not killed.

Why the kill switch matters

Your IP address reveals more than most people realize. CyberInsider cites a Newsweek report that more than 15 billion stolen logins, meaning usernames and passwords, are available for sale on the internet. Combined with information from an IP address, that data can help an attacker break into accounts or steal an identity.

A VPN hides your IP address by replacing it with the VPN server's address. When the tunnel drops, that shield drops with it. Websites, trackers, and your internet provider can suddenly see your real address again.

If you were torrenting in a country that prosecutes copyright violations, CyberInsider notes, that leak could create real problems.

The kill switch closes that gap. It makes the VPN a set-and-forget service instead of one you must watch constantly. You do not need to notice the drop yourself, because the switch notices it for you.

A public WiFi hotspot sign in a shared space
Public WiFi is one of the places a dropped VPN connection matters mostPhotograph: Ardhan Febriansyah, via Wikimedia CommonsImage: Wikimedia Commons

Standard vs advanced kill switches

Not every kill switch behaves the same way when you disconnect on purpose. Proton VPN draws a useful distinction between its regular kill switch and its Advanced kill switch.

The regular kill switch only engages when you start a VPN connection. It switches off when you manually disconnect the VPN or shut down your device. That is fine if you want protection only while the VPN is running.

The Advanced kill switch goes further. Proton VPN says it prevents all outgoing and incoming connections outside the VPN interface, including when you manually disconnect and when your device is shutting down and starting up. With it enabled, your device cannot reach the internet at all unless it connects to a Proton VPN server.

Which one you want depends on your habits. The regular switch suits people who sometimes browse without a VPN, for example to reach a local streaming service. The advanced switch suits people who never want unprotected traffic, and who are willing to accept that the internet simply stops if the VPN is off.

Restart tests show why the distinction matters. Gizmodo tested four VPNs on a Windows 11 PC in October, pulling the Ethernet cable, ending the VPN process, and restarting the machine. All four passed the cable and process tests.

On restart, though, the default settings of Proton VPN, ExpressVPN, and CyberGhost leaked traffic before the VPN reconnected. Proton's Advanced mode and ExpressVPN's always-on setting fixed it. CyberGhost had no stricter setting, so its restart leak had no fix inside the app.

How to turn on a kill switch

Most VPN apps bury the kill switch in settings, and it is often off by default. That catches people out. They assume the VPN protects them, not realizing the safety net needs switching on.

Start in your VPN app's settings or connection section. Look for "kill switch" or a provider-specific name like Network Lock. Turn it on, then check whether the app offers a stricter mode and pick the one that fits how you browse.

Android users have a second option built into the operating system. CyberInsider notes that current Android versions, 7.0 and later, include a kill switch in the device settings, under the VPN options. This system-level control works with your VPN app and blocks connections without a VPN.

On iPhone, there is no single system switch, so you rely on your VPN app's own feature.

After enabling it, test it. Disconnect the VPN manually and confirm your internet stops. Reconnect and confirm it returns.

A two-minute test beats discovering a leak months later.

Limits worth knowing

A kill switch is a safety net, not a guarantee. First, it only works on platforms where your provider built one. CyberInsider notes that some providers skip it on certain apps, so check whether your operating system is covered before you rely on it.

Second, it does not protect traffic that never enters the tunnel. If you use split tunneling to route some apps outside the VPN, those apps stay outside. ExpressVPN's Network Lock handles this gracefully by leaving split-tunneled apps alone, but the point stands: the switch guards the tunnel, not your whole device.

Third, it cannot fix a VPN that leaks in other ways. A DNS leak, where your domain name lookups bypass the tunnel, is a separate problem that needs its own fix. A kill switch also does nothing if you never connect the VPN in the first place, unless you use an always-on mode.

A padlock symbol representing locked-down network security
A kill switch works like a padlock on your connection: when the VPN fails, nothing gets outPhotograph: MarkJFernandes, via Wikimedia CommonsImage: Wikimedia Commons

Frequently asked questions

Does a kill switch slow down my internet?

No. A kill switch does nothing while the VPN is connected. It only acts after a drop, when it pauses your traffic until the VPN reconnects.

Should I leave the kill switch on all the time?

Yes, in most cases. It costs nothing while the VPN is up, and it only matters in the exact moment something goes wrong. If you sometimes browse without a VPN, use the standard mode rather than an always-on mode.

Does a kill switch work after I restart my computer?

A standard kill switch turns off at shutdown, so it does not cover the boot-up period. An advanced or permanent mode keeps blocking until the VPN connects, which covers that gap.

Do VPN browser extensions have a kill switch?

No. Browser extensions are proxies that cover browser traffic only, and they cannot block traffic across the whole device. For a real kill switch, use the desktop or mobile app.

Is a kill switch enough on its own?

It is one layer. Pair it with a trustworthy provider, DNS leak protection, and the habit of actually connecting the VPN. The switch covers the failure case, not every threat.

The bottom line

A VPN kill switch is a simple idea with real value. It blocks your internet traffic the moment your VPN connection drops, so your real IP address never slips out during a gap you did not notice. System-level switches block everything, app-level switches close only the apps you pick, and advanced modes keep blocking even when you disconnect on purpose.

If you use a VPN for privacy, turn the kill switch on. Then test it once, so you know the safety net is actually there.

Tags: vpn, kill switch, online privacy, tech explained

Latest in Tech

Subscribe to the Rive News newsletter for one plain-English tech explainer each week.

Taggedvpnkill switchonline privacytech explained

Related stories