Free VPNs aren't automatically unsafe, but running a VPN costs money, so a free one has to be paid for somehow: ads, data, upselling, or a paid tier. A 2016 study of 283 Android VPN apps found 38% flagged for malware, 18% with no traffic encryption, and 75% using third-party tracking libraries. Reputable free plans exist (Proton VPN, Windscribe) as limited versions of paid services. If you can't tell how a free VPN makes money, assume it's your data.
By Team Boycat
A VPN routes all your internet traffic through someone else's servers. That's a lot of trust to give an app that costs nothing. Here's what the research says, the real cases behind the warnings, and how to decide between free and paid.
Servers and bandwidth cost real money. A free VPN covers that cost in one of five ways:
Only the first is clearly aligned with your privacy.
In 2016, researchers from CSIRO and partner universities analyzed 283 Android apps that use the VPN permission (CSIRO paper, ACM). They found:
The study is from 2016, and app stores have tightened rules since. But it shows what "free VPN" can mean when nobody checks.
The lesson: it's not free vs paid. It's whether the company's business depends on your data.
| Unknown free VPN | Reputable free plan | Paid VPN | |
|---|---|---|---|
| How it's funded | Often ads or data | Paid users | Your subscription |
| Speed | Often crowded | Limited | Full |
| Locations | Varies | A few | Many |
| Devices | Varies | Usually 1 | 3-10+ |
| Streaming | Rarely | Rarely | Often |
| Support |
Both are funded by their paid plans, so the free tier is a demo, not the product.
Some browsers include a free VPN or proxy. Opera has offered a built-in free browser VPN for years, and Microsoft Edge offers a limited free "Secure Network" mode in some regions. These are different from a full VPN:
They're fine for quick, low-risk use. They're not a replacement for a device-wide VPN on public Wi-Fi.
Free VPN extensions in the Chrome Web Store and other add-on stores vary widely. Many are proxies, not VPNs, and some request permission to "read and change all your data on all websites". That's a lot of access for an unknown developer. Check the publisher, the permissions and the privacy policy before installing, and remove extensions you don't use.
Pay if you:
Paid doesn't have to be expensive. Buycat VPN web plans start at $37.69 a year for 3 devices, with a 30-day money-back guarantee, so you can test it on your own network and get a refund if it's not for you. It's independently owned by Boycat and funded only by subscriptions.
Some are. Reputable free plans from paid providers, like Proton VPN and Windscribe, are reasonable. Unknown free apps carry real risk: a 2016 study found 38% of Android VPN apps flagged for malware.
Through a paid upgrade, ads, selling data, reselling your bandwidth, or serving a parent company's other business.
No. PureVPN was paid and still handed over records. Check the logging policy, ownership and track record either way.
Proton VPN's free plan is widely considered the strongest free option because it's funded by paid users and has no ads.
If you use public Wi-Fi, travel, or want several devices covered, yes. Look for a money-back window so you can test first.
BuycatVPN
A no-logs VPN built around your privacy.
AES-256 encryption on iOS, Android, Mac, Windows and Linux. 30-day money-back guarantee.
Get BuycatVPN| None |
| Basic |
| Yes |
