Free VPNs: which are safe and which are spyware

A free VPN sounds like a free lock for public Wi-Fi. Some are. Many are the opposite. The app that promises to hide your traffic is the one app that can see all of it. This guide explains how free VPNs pay their bills, which free tiers we would use, and how to spot a bad one. Every source was opened on October 19, 2026.

The short answer

Use a free tier from a company that also sells a paid VPN and publishes audits. Proton VPN Free, Windscribe Free, PrivadoVPN Free and TunnelBear Free all fit. Skip any free VPN you found by searching an app store.

How free VPNs make money

Servers and staff cost money, so a free VPN with no paid plan gets paid somehow. There are four common ways.

Selling your browsing data. The clearest documented case is a “free” security tool, not a VPN, but it shows the model. In February 2024 the Federal Trade Commission said Avast collected browsing data through its free antivirus and browser extensions, then sold it through a subsidiary called Jumpshot. The FTC said Jumpshot sold data to more than 100 third parties from 2014 to 2020. Avast had marketed the same products as privacy tools. The FTC order bans Avast from selling browsing data for advertising and requires it to pay $16.5 million. A free VPN sees even more, since it carries all your traffic.

Ads and trackers inside the app. In 2016, researchers led by CSIRO Data61 studied 283 Android apps that used the VPN permission. They found that 75 percent used third-party tracking libraries and 82 percent asked for access to sensitive data. Over 38 percent had some malware presence according to VirusTotal.

Not actually encrypting. The same study found that 18 percent of the apps ran tunnels with no encryption. About 84 percent leaked IPv6 traffic and 66 percent leaked DNS requests outside the tunnel. On public Wi-Fi, that means the hotspot still sees where you go.

Hijacking your traffic. The study found two apps injecting JavaScript into web pages for ads and tracking, and four that installed their own root certificate to read encrypted traffic.

The paper is ten years old. The incentives have not changed. A free app with no paid product still has to sell something, and the only thing it has is you.

Free tiers that are safe

The safe free VPNs share one trait. They are a marketing cost for a paid product. The company wants you to upgrade, so it has a strong reason not to get caught selling your data.

Proton VPN Free

This is the one we recommend first. Proton says the free plan has “no data or speed limits,” no ads, and is free forever. The catch is one device, medium speed, and no choice of country. The app picks from ten. The free plan includes the kill switch, which matters on public Wi-Fi. Securitum has audited Proton’s no-logs policy five years in a row. See Proton VPN.

Windscribe Free

Windscribe gives 10 GB a month once you confirm an email, or 2 GB with no email. It covers unlimited devices and says it never throttles. Windscribe is open about being based in Canada, a Five Eyes country. It cites two server seizures that found no user data. Packetlabs audited its server stack in June 2024. See Windscribe.

PrivadoVPN Free

PrivadoVPN’s pricing page says the free plan gives 10 GB every 30 days on one device with “only a handful” of locations. The company is Privado Networks AG in Zug, Switzerland. We did not find an independent audit on its site, which is why it ranks below Proton and Windscribe. See PrivadoVPN.

TunnelBear Free

TunnelBear gives 2 GB, which it labels “testing and limited usage.” Cure53 did its 2023 audit covering the apps, website and infrastructure. TunnelBear has been owned by McAfee, a US company, since 2018, and says it runs as a separate team. See TunnelBear.

How we chose

These picks compare what each company publishes. They are not hands-on tests. We did not install or try any of these apps. We compared the free-plan limits, the company behind each one, and its audit summary, as each site showed them on October 19, 2026. Here is the deciding reason for each pick.

• Proton VPN Free is our first choice. It is the only free tier here with no data cap. The others stop at 10 GB or less. It also includes the kill switch, and Securitum has audited Proton’s no-logs policy five years in a row.
• Windscribe Free is the pick for more than one device. It covers unlimited devices, with 10 GB a month once you confirm an email. Packetlabs audited its server stack in June 2024.
• PrivadoVPN Free ranks below those two. It gives 10 GB every 30 days on one device, but we did not find an independent audit on its site.
• TunnelBear Free is for a quick test. Its 2 GB is the smallest cap here, and TunnelBear labels it “testing and limited usage.”

Warning signs of a bad free VPN

Any one of these means uninstall.

• No paid plan at all. If nobody pays, you are the product.
• No company name or address. The safe ones above all name a legal entity and a city.
• No audit, ever. Every vendor in our table except PrivadoVPN links to a third-party audit.
• It asks for more than it needs. A VPN needs the VPN permission and little else. Contacts, text messages, call logs and precise location are red flags.
• It wants to install a certificate. A root certificate lets the app read your encrypted traffic, including banking.
• Unlimited free data with no catch stated. If the limit is not data or speed, the limit is your privacy.
• Ads inside the VPN app. An ad network inside a privacy tool is a tracker inside a privacy tool.
• A privacy policy that sends usage data to “partners.” That is the Jumpshot model in writing.

When a free VPN is fine

A free tier from the table above is fine for the ordinary public Wi-Fi case. You want to check email, read news and log in to a few sites at an airport or hotel without the hotspot seeing it. Proton’s no-cap plan handles this on one device. Windscribe’s 10 GB covers a week of light use. If you want more, our best VPN for public Wi-Fi guide compares the paid plans.

When a free VPN is not fine

Do not use any free VPN you found by searching an app store for “free VPN.” The top results are often the kind of app the CSIRO study was about.

Do not use a free VPN to feel safe while banking on a hotspot you have not checked. First read how to tell if a Wi-Fi hotspot is fake and is online banking safe on public Wi-Fi.

What we did not verify

We did not install or test any of these apps. We did not read the full audit reports, only each vendor’s own summary. PrivadoVPN’s free-plan speed, ads and audit status are not stated on the pages we opened, and its location count differs between its pricing page and its home page. TunnelBear’s free device limit and locations are not stated. Windscribe’s free kill switch is not stated. hide.me’s site would not load, so it is not here. The Avast case involved antivirus and browser extensions, not a VPN. We use it because it is the clearest documented example of the free-tool data-sales model.

Verdict

A free VPN is fine when it is a loss leader for an audited paid service and you stay inside its limits. Proton VPN Free is the best choice because it has no data cap and a kill switch. Windscribe Free is the best choice if you need more than one device. A free VPN is not fine when it has no paid plan, no named company and no audit. In that case the app is the threat, not the hotspot.

Back to the Wi-Fi safety hub. For travel, see how to use airport Wi-Fi safely. To skip public Wi-Fi, a low-cost phone plan with hotspot data or a free phone program may be the cheaper fix.