Kill Switch

A kill switch is a VPN safety feature that blocks all internet traffic the moment the encrypted tunnel fails. Without one, your device does something quietly dangerous: it notices the VPN is gone and simply carries on over your normal connection, exposing your real IP address and unencrypted traffic without any warning.

Think of it as a circuit breaker. When something goes wrong it cuts the power rather than letting the fault spread. You lose connectivity for a few seconds — which is inconvenient, and precisely the point.

Why VPN connections drop in the first place

This is not a rare edge case. Tunnels break routinely when you move between Wi-Fi and mobile data, when a laptop wakes from sleep, when a VPN server restarts or gets congested, or when the app updates in the background. Each of those creates a window — sometimes a second, sometimes minutes — where traffic would otherwise flow unprotected.

How it works

A kill switch is essentially a firewall rule. The VPN app tells your operating system to refuse any traffic that is not travelling through the VPN network interface. When the tunnel is up, traffic matches the rule and passes. When the tunnel disappears, nothing matches, so nothing leaves the device until the VPN reconnects and the rule can be satisfied again.

Two kinds, and they are not equal

• A system-wide kill switch blocks everything on the device. It is the safer option and what you want if privacy is the reason you run a VPN at all.
• An application kill switch only closes the apps you nominate — a torrent client, say, or a browser. Everything else keeps working normally, which is more convenient but leaves other apps exposed.

Some providers also offer an always-on or block-outside-VPN mode, which goes further: traffic is blocked even before the VPN connects, so there is no unprotected moment during boot.

Test yours — do not assume it works

Kill switch quality varies far more than the marketing suggests. Some only react after several seconds; some fail to cover IPv6 traffic; some do not engage if the app itself crashes rather than the connection dropping. Checking takes a minute:

1. Connect the VPN and start something continuous, like a video stream.
2. Force the tunnel to fail — quit the VPN process outright, rather than clicking Disconnect, since a clean disconnect is often treated differently.
3. Watch what happens. The stream should stall and pages should fail to load. If browsing carries on as normal, the kill switch is not doing its job.

What it does not protect against

A kill switch only guards against the tunnel failing. It does nothing about DNS requests leaking outside the tunnel while the VPN is up, about browser fingerprinting, or about being identified through accounts you are logged into. It is one specific safeguard, not blanket privacy.