What is a VPN kill switch and how does it work?

A VPN kill switch is a fail-safe built into your VPN app that blocks all internet traffic the moment the encrypted tunnel drops. It stops your real IP address and DNS requests from leaking onto an unprotected connection, then restores normal access once the VPN reconnects. Without one, brief disconnects expose you.

Every VPN connection drops eventually. A Wi-Fi handoff, a laptop waking from sleep, a crashed app, a busy server — each one opens a short gap where your device would quietly fall back to its regular, unprotected connection. The kill switch exists for that gap: instead of letting traffic leak, it blocks everything until the encrypted tunnel is back.

It is also easy to miss. The setting is not always on by default — PCMag calls it a hidden safety button for a reason — so it is the first thing to check after installing any app from our full VPN rankings. And if the tunnel itself is still new territory, start with what a VPN is and how it works.

How does a VPN kill switch work?

The VPN app watches its own tunnel constantly. The moment that tunnel fails — the server stops responding, the network changes, the app crashes — the kill switch blocks your device’s internet access. Once the connection is re-established, traffic flows again through the encrypted tunnel and you carry on. Proton VPN’s support documentation describes the cycle plainly: block on drop, restore on reconnect.

Under the hood this is firewall logic, not magic. Cybernews’ explainer describes kill switches built on the operating system’s own packet filters — Windows Filtering Platform on Windows, iptables on Linux, pf on macOS. The rule amounts to: only traffic through the VPN interface may leave this device. When the tunnel interface disappears, nothing matches the rule, so nothing leaves.

Without that rule, your device does exactly what it was built to do: reconnect through your ISP as fast as possible. Your real IP address is then visible to every site, tracker, and peer you are connected to, and your DNS requests travel outside the tunnel — until you notice, which may be never.

The two kinds of kill switch

Providers ship two designs, and some apps offer both.

Type	What it blocks	Best fit
System-wide	All internet traffic on the device until the tunnel returns	Public Wi-Fi, travel laptops, any always-protected setup
App-level	Only the apps you choose; everything else stays online	Locking a torrent client or browser to the VPN without cutting off the whole device

Experte’s kill-switch comparison draws the same line: system-wide switches shut down the device’s entire connection, while app-level switches block only selected programs. The app-level design suits torrenting — if the tunnel dies, the torrent client loses its connection instantly while the rest of the device carries on. If that is your main use, start from our torrenting VPN rankings, because the strictness of this one feature matters more there than almost anywhere else.

What a kill switch won’t do

A kill switch is a software fail-safe, not a guarantee. Two limits are worth knowing.

First, strictness varies by provider and platform. RTINGS maintains a dedicated kill-switch robustness test precisely because implementations differ — behavior under a forced disconnect is not identical from app to app. A long-running Privacy Guides forum thread collects the same caution from users: reboots, system updates, and app startup order can each create a moment where traffic moves before the kill switch is armed.

Second, blocking the internet is not the same as proving zero leaks. A kill switch stops general traffic when the tunnel drops. Background services, DNS behavior during quick reconnects, and captive portals — the hotel and airport login pages that need a working connection before the VPN can even start — are edge cases where apps and operating systems behave differently.

Neither limit makes the feature pointless. A kill switch turns a guaranteed leak into a rare one. It just means “enabled” should not become “forgotten”.

How do you turn it on and test it?

Find the setting first. Look under Privacy, Connection, or Security in your VPN app. Not every provider calls it a kill switch — some apps label it Network Lock or Network Protection. NordVPN, ExpressVPN, Surfshark, and Proton VPN each publish documentation for their own implementation, so a search for the provider’s name plus “kill switch” finds the exact toggle.

Then run a two-minute check. TechRadar publishes a beginner’s guide built on the same idea:

Connect the VPN and load an IP-check page. It should show the VPN server’s address, not yours.
Break the tunnel on purpose. Force-close the VPN app, or switch from one network to another mid-session.
Try to load a new page. With a working system-wide kill switch, nothing loads until the tunnel is back. If pages open over your normal connection, the switch failed and your traffic was exposed for that window.

Repeat the check after major OS updates — the Privacy Guides reports above include updates among the moments where leaks appear.

When a kill switch matters most

Ordered by stakes:

Torrenting. A drop mid-download hands your real IP address to every peer in the swarm. This is the classic kill-switch use case.
Public Wi-Fi. Café, hotel, and airport networks drop and re-authenticate constantly — exactly the reconnect churn a kill switch exists for. More on the underlying risk in is public Wi-Fi safe without a VPN.
Phones and laptops that move. Switching between Wi-Fi and cellular tears the tunnel down and rebuilds it many times a day.
Remote work with sensitive data. A brief leak of client traffic is a real problem, not an inconvenience.
Anywhere VPN use itself is sensitive. If the connection drops, the kill switch keeps your traffic off the open network entirely.

And the honest inverse: for casual streaming on home Wi-Fi, a dropped tunnel mostly means a paused video. The kill switch costs you nothing there, but it is saving you little either — the feature earns its keep the moment you leave the house or open a torrent client.

Frequently asked questions

Does a VPN kill switch block all internet access?

A system-wide kill switch blocks all internet traffic on the device until the VPN tunnel is restored. An app-level kill switch is narrower: it blocks only the apps you selected, and the rest of the device stays online.

Is a VPN kill switch the same as a firewall?

No. A firewall filters traffic by rules all the time, while a kill switch is a VPN-specific fail-safe that blocks traffic only when the encrypted tunnel drops. Many kill switches are built on the operating system's firewall, but the two do different jobs.

Do all VPNs have a kill switch?

Most reputable providers include one, but it is not always enabled by default, and some apps use their own name for it, such as Network Lock or Network Protection. Check your app's settings before relying on it.

Can I still use the internet if the VPN disconnects?

Not while a system-wide kill switch is active — blocking access is the point. Websites stop loading and downloads pause until the tunnel is re-established. If you need to get online without the VPN, disable the kill switch deliberately instead of working around it.

Should I leave the kill switch on all the time?

If you use a VPN for privacy, yes. Disconnects rarely announce themselves, and the switch only acts when the tunnel actually fails. The one real cost: a VPN server outage takes your connection down with it until you reconnect or turn the switch off.