A free VPN costs you something; the question is what. Servers, bandwidth and staff have to be paid for, and a service with no subscription pays for them another way: selling browsing data, showing or injecting ads, using your device as an exit point for other customers, or bundling software you did not ask for. Each of those needs exactly the data a VPN is supposed to protect. There is one honest kind of free VPN: a limited free tier of a paid product, where the paid plans fund the servers and the free tier is a demo. Telling the two apart is the whole skill.

Why free is a problem for a VPN specifically

A VPN server is where your traffic is decrypted before it goes on to websites. Whoever runs it is in the position your ISP was in: it can see every domain you visit, when, and how much. For a paid service the incentive is to keep you as a customer. For a free app with no visible income, the incentive is to make money from what passes through. The position of trust is identical; the incentives are opposite. What the provider can see is laid out in what can my ISP see.

How free apps make money

  • Selling data. Browsing patterns, app usage, device identifiers, sold to data brokers or ad networks. Policies often say so in vague language.
  • Ads and injection. Ads in the app are harmless; ads injected into web pages mean the service is modifying your traffic, which also means it can read it.
  • Your bandwidth. Some free apps turn users' devices into exit nodes for a paid "residential proxy" business. Strangers' traffic leaves from your IP address.
  • Bundled software. Browser extensions, toolbars, occasionally worse.
  • Upsell. Deliberately slow servers and small data caps to push a paid plan. This one is honest as long as the limits are stated.

The warning signs

  1. No paid plan at all. Then where does the money come from?
  2. A policy with no specifics. "We value your privacy" without a list of what is stored and what is not. How a real policy reads is in what does no logs mean.
  3. Permissions unrelated to the job. A VPN does not need your contacts, messages, or precise location.
  4. No named company or address. A privacy product from an anonymous publisher is a contradiction.
  5. Old or unnamed protocols. PPTP, or "proprietary encryption" with no details.
  6. No kill switch, no DNS protection. Even a well-meaning free app that leaks is worse than nothing, because you believe you are protected.
  7. Too many five-star reviews saying nothing. Store ratings are cheap.

When a free tier is fine

A free tier attached to a paid product usually has stated limits: a data cap, a handful of locations, one device, lower priority. Those limits are the price, and it is a fair one. The tier runs on the same infrastructure and under the same policy as the paid plans, and the company's income does not depend on your data. Check that the free tier states its limits plainly, that the policy is the same for free and paid users, and that the apps are the same builds.

What you risk in practice

  • Your browsing history sold or leaked. The point of a VPN, reversed.
  • Your IP used by strangers, sometimes for things you would not want attributed to you.
  • Modified pages: injected scripts and ads, occasionally malware.
  • A false sense of security on public Wi-Fi, where a leaking tunnel exposes what you thought was hidden. See is public Wi-Fi safe.

Checklist before trusting any VPN

  1. A named company and a policy that lists what is and is not stored.
  2. Modern protocols: WireGuard, OpenVPN, or VLESS over TLS 1.3.
  3. Kill switch and DNS inside the tunnel, verified with the WebRTC leak test and IPv6 leak test after connecting.
  4. Permissions limited to what a VPN needs.
  5. A visible way the company makes money.

If a service passes all five and is free, it is a free tier. If it fails the last one, assume your data is the product.

404 VPN has a paid subscription that funds the servers, a free tier with stated limits (one device, five locations, a daily data cap), the same apps and the same privacy policy for both, VLESS and WireGuard, a kill switch and DNS inside the tunnel. Get started here.