- Running a VPN costs money every month, so a free VPN is paid for somehow.
- Common free models: selling browsing data, ads, and reselling your connection.
- Researchers found malware in 38% of 283 Android VPN apps they tested.
- Check how any VPN makes money before you trust it with your traffic.
A VPN sees everything you do online. Every site you visit, every app that connects, every DNS lookup passes through its servers. That's the point: you're moving your trust away from your Wi-Fi network and internet provider and handing it to the VPN instead.
So the most important question about any VPN isn't speed or server count. It's who runs it, and how they pay for it. For a free VPN, that second question is where the problems start.
Free VPNs still have to pay the bills
Running a VPN is expensive. Servers, bandwidth, and the engineers who maintain them cost money every single month, and the more users a VPN has, the more it costs. A free VPN with millions of users has a large bill to cover. If the users aren't paying it, the money has to come from somewhere else.
Here are the most common ways free VPNs make money.
1. Collecting and selling your data
The VPN can see which sites you visit and when. That browsing data is valuable to advertisers and data brokers, and some free VPNs log it and sell it, or share it with partners through tracking tools built into the app. Buried in a long privacy policy, this can be completely legal.
2. Showing you ads, or injecting them
Some free VPNs fill the app with ads. Others go further and insert ads or tracking code into the web pages you load. Either way, the service is paid for by your attention and your data.
3. Selling your connection to other people
This is the one most users never suspect. Some free VPN apps turn your device into an exit point for other people's traffic, reselling your home internet connection as a proxy network. Someone else's activity then appears to come from your IP address. One of the best-known free VPN browser extensions was found doing exactly this back in 2015, selling its users' bandwidth through a paid proxy service.
4. Upselling you to a paid plan
Not every free VPN is a trap. Some are limited free tiers of a paid service, where the free version comes with a small data cap, fewer locations or slower speeds, and paying customers cover the cost. This is the most honest model, and it's the one to look for if you truly need something free.
What researchers found when they tested free VPN apps
Researchers from Australia's CSIRO and UC Berkeley analyzed 283 VPN apps on Google Play and published what they found:
- 38% contained some form of malware
- 75% included third-party tracking libraries
- 18% used tunneling protocols without encryption, so traffic wasn't actually protected
- 16% routed users' traffic through other users' devices
- 82% requested access to sensitive data such as contacts or text messages
The study is from 2016, and app stores have tightened their rules since then. But the business pressures behind those results haven't changed: a free app still needs a way to cover its costs.
The real risks of a free VPN
Put together, here's what a bad free VPN can cost you:
- Your browsing history, logged and sold or shared.
- Weak or missing encryption, which leaves you exposed on exactly the public Wi-Fi you were trying to protect.
- Malware or spyware bundled into the app.
- Leaks: DNS or IPv6 traffic that skips the VPN and exposes your real IP. (Our guide on how to check if your VPN is working shows you how to test for this in five minutes.)
- Your IP address used by strangers, if your connection is resold as a proxy.
- Crowded shared servers, which mean slow speeds, constant CAPTCHAs and blocked sites. (More on that in why your VPN keeps showing CAPTCHAs.)
How to check any VPN before you trust it
Whether it's free or paid, run through this checklist first:
- How does it make money? If you can't find a clear answer, assume the answer is your data.
- Who owns it? Look for a real company name and a way to contact it. A VPN app with no identifiable owner is a red flag.
- What does the privacy policy actually say? "No logs" means little on its own. Look for specifics about what is and isn't recorded, such as sites visited, IP addresses and DNS queries.
- What permissions does the app ask for? A VPN has no reason to read your contacts or text messages.
- Does it pass a leak test? Connect and run the five quick tests from our VPN leak testing guide.
- Is it built on a modern protocol? WireGuard is fast, well studied and uses modern encryption. See WireGuard vs OpenVPN for a full comparison.
Free VPN vs paid shared VPN vs dedicated VPN
| Free VPN | Paid shared VPN | Dedicated VPN (NorexVPN) | |
|---|---|---|---|
| Who pays for it | Often your data or ads | Subscribers | Subscribers |
| Your IP address | Shared with many users | Shared with many users | Yours alone |
| Speed | Often slow and capped | Varies with server load | Not split with other users |
| CAPTCHAs and blocks | Frequent | Common | Rare, since nobody else uses your IP |
| Data caps | Common | Usually none | None |
Is a free VPN ever okay?
Sometimes. If you need a VPN for a few minutes on hotel Wi-Fi and a trusted paid provider offers a limited free tier, that's a reasonable choice. The risk comes from free VPNs that have no visible way to make money, ask for permissions they don't need, or come from companies you can't identify.
For anything you do regularly, such as banking, work, or everyday browsing on your phone, a VPN you pay for is almost always the safer choice, because the business model is simply you paying for a service.
Frequently asked questions
Can a free VPN steal my passwords?
Most sites use HTTPS, which encrypts your login even from the VPN itself, so a VPN can't simply read your passwords off the network. The bigger risk is a malicious app with broad permissions on your device, or one that tracks your activity and sells it. Stick to reputable apps and check their permissions.
Are free VPNs illegal?
No. Using a VPN is legal in most countries, free or paid. The concern with free VPNs is privacy and security, not legality.
Is a free trial the same as a free VPN?
No. A free trial is a paid service you can try before you're billed. NorexVPN's 7-day free trial gives you the full service, including your own dedicated server. A card is required to start it, and you won't be charged if you cancel before the trial ends.
Does a paid VPN hide who I am?
No VPN hides who you are on its own. A good VPN hides your traffic from your local network and your internet provider and gives websites a different IP address. Websites can still recognize you through accounts, cookies and browser fingerprinting. What you're choosing is who you trust with your traffic, which is why that choice matters so much.
Why NorexVPN is built the way it is
NorexVPN is paid for by subscribers, and that's the whole business model. There are no ads, no data sales, and no reselling of your connection.
Every member gets their own dedicated WireGuard server instead of a slot on a crowded shared one. Your IP address is yours alone, your bandwidth isn't split with strangers, and your server blocks ads, trackers and malware for every device you connect. It doesn't record the sites you visit, the addresses you connect to, or your DNS queries. We keep only what we need to run your account, like your email and billing status.
A VPN paid for by you, not your data
NorexVPN is funded only by subscriptions: no ads, no data sales, no reselling your connection. You get your own dedicated server and IP. Try it free for 7 days. A card is required, and you won't be charged if you cancel before the trial ends.
