Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a laptop on a desk at night, its screen showing a glowing tunnel of light that suddenly breaks mid-air, while a firewall-like barrier of translucent panels slams shut across the gap, stopping small light-particles from escaping past it, deep blue-grey palette with one muted amber desk-lamp accent

VPN Kill Switch Explained: What It Does and How to Test It

by

VPN Kill Switch Explained: What It Does and How to Test It

In brief

  • A VPN kill switch cuts your internet the moment your VPN drops, so your real IP never leaks. System-wide vs app-level, and the 2-minute test that proves yours works.
  • A kill switch is not a feature that makes your VPN faster or stronger. It is a safety net for the moment the VPN fails: it blocks traffic until the tunnel is back, so nothing travels over the open connection in between.
  • There are two kinds, and the difference decides your real protection. A system-wide switch blocks the whole device. An app-level switch closes only the apps you pick and leaves everything else exposed.
  • Most kill switches are off by default, or cover less than their name suggests. The two-minute test in this article shows, on your own device, whether yours actually works.
  • A kill switch does not fix DNS leaks, WebRTC leaks, or malware. It covers one failure mode: the dropped tunnel. The other checks still matter.

What a kill switch actually does

A VPN hides your traffic by routing it through an encrypted tunnel to a VPN server. Everything depends on that tunnel staying up. When it drops — a flaky café Wi-Fi network, a server that goes away, a laptop waking from sleep — your device does the obvious thing: it reconnects to the internet directly, on your real IP address, with no encryption. The gap may last seconds. That is long enough for a download to continue, a sync to fire, or a peer to log your address.

A kill switch exists for that gap. While you are connected, the VPN app watches the tunnel. The moment it detects the tunnel has failed, it blocks internet traffic from leaving the device. Nothing goes out on the open connection. When the VPN reconnects, the block lifts and traffic resumes through the tunnel. The mechanism is usually firewall rules the app writes to your operating system: only traffic through the VPN interface is allowed, and when that interface disappears, everything else is denied by default.

Two details matter more than the marketing suggests. First, a kill switch does nothing until the tunnel drops, so leaving it on has no speed cost while you are connected. Second, what counts as a “drop” varies by provider. Most switches trigger on an unexpected connection failure. Some do not trigger when you disconnect the VPN yourself on purpose. That distinction is the whole reason to test yours rather than trust the toggle.

System-wide vs app-level: the distinction that decides real protection

A system-wide kill switch blocks internet access for the entire device when the VPN drops. No browser tab, background sync, or chat app gets through. This is the protection most people picture when they hear the term, and it is the one to choose if your goal is never leaking your real IP.

An app-level kill switch closes only specific apps you choose when the VPN drops. NordVPN’s App Kill Switch on Windows works this way: you pick the programs, and only those are shut down. Everything else on the device keeps using the open connection. That is useful if you only care about one app — a torrent client, for example — but it is not device protection, and it should never be described as if it were.

A third variant is worth knowing about because it changes behavior at startup. Standard kill switches turn off when the device shuts down, so a fresh boot with no VPN running leaves the internet open. Permanent or strict modes close that hole: Proton VPN’s Advanced kill switch and NordVPN’s Internet Kill Switch both block traffic from startup until the VPN connects. If you want protection you cannot forget, this is the mode to look for.

What the major providers actually offer

The details below reflect provider documentation and independent testing as of October 2026. Providers change defaults, so check your own app’s settings rather than trusting any article, including this one, a year from now.

NordVPN offers two separate switches on Windows. The Internet Kill Switch blocks all internet access when the VPN connection drops, with a stricter mode that blocks whenever there is no active VPN connection at all. The App Kill Switch closes only the apps you select. Both are disabled by default — you must turn them on in settings before they protect anything.

ExpressVPN calls its switch Network Lock. It runs on Windows, macOS, and Linux, and it ships enabled by default — the opposite of NordVPN’s default. It can also be set to stay on at all times, which blocks traffic even when you disconnect the VPN on purpose. On iOS, its Network Protection is always on and cannot be disabled.

Proton VPN’s kill switch is system-wide and user-enabled. It triggers on connection failures and server switches, but not on manual disconnects. Its Advanced kill switch — sometimes called the permanent kill switch — blocks internet access even before the VPN connects or after a manual disconnect. That is the mode that survives a reboot.

On Android, the operating system itself provides a kill switch that works with any VPN app. The Always-on VPN setting, combined with the option to block connections without a VPN, stops the device connecting to the internet unless the selected VPN is up. It functions like a permanent kill switch and is available on Android 7 and later. On iPhone, there is no system-wide equivalent: protection depends on the VPN app’s own settings, such as NordVPN’s VPN bypass prevention. Browser extensions are a separate case entirely — the NordVPN and Proton VPN extensions are proxies that cover browser traffic alone, and they cannot block traffic across the whole device.

The 2-minute test: prove yours works

Reading a settings page is not a test. Run this on the device you actually use, with the apps you actually care about open.

On desktop, first connect your VPN and confirm it is working: open an IP-check page and confirm it shows the VPN server’s location, not yours. Then start something visible and continuous — a large download, a video stream, or a page that auto-refreshes. Now force the tunnel to fail. The cleanest way is to quit the VPN app entirely, or to switch the VPN off at the system level; switching servers also works for switches that trigger on server changes. Do not just disconnect politely inside the app if your switch ignores manual disconnects — that tests nothing.

Watch what happens in the next few seconds. With a working system-wide switch, the download stalls and pages stop loading, and they stay stopped until the VPN reconnects. That is a pass. If the download resumes or pages load on your open connection, the switch failed or was never on — check the toggle, check whether you are in app-level mode, and check whether your provider only triggers on unexpected drops.

Then test the restart case, because it is where most switches quietly stop protecting you. Reboot the device with the VPN set not to auto-connect, and try loading a page before opening the VPN app. If it loads, your switch is standard mode and your boot window is unprotected. If it is blocked until the VPN connects, you are running a permanent or strict mode. Decide which of those two you want, and set it deliberately rather than discovering it later.

On mobile, the test is shorter. Connect the VPN, confirm the IP change, then toggle airplane mode on and off, or switch from Wi-Fi to mobile data mid-session. With Android’s Always-on VPN plus block-without-VPN enabled, traffic stays blocked until the VPN is back. On iPhone, check your provider app’s own kill-switch setting first — there is no system setting to fall back on — and run the same airplane-mode toggle to see what actually happens.

If any step fails, the fix order is: first, confirm the switch is actually enabled in the app; second, confirm you are in system-wide mode rather than app-level; third, confirm you are not testing a manual disconnect that your provider deliberately ignores; fourth, check for a permanent or strict mode if the failure is at startup. If it still fails after those four, the problem is the provider’s implementation, not your settings — and that is information worth having before you renew.

What a kill switch does not protect

A kill switch covers exactly one failure: the dropped tunnel. It does not stop DNS requests leaking outside the tunnel, WebRTC exposing your real IP in the browser, or IPv6 traffic bypassing the VPN. Those need their own checks, and a device can pass the kill-switch test while failing all three. It does not protect against phishing, malware, or account takeover, and it does not make a logging provider private. It also does not help if the VPN itself is the problem — a provider that logs or leaks is not fixed by a switch that keeps you connected to it.

The honest way to think about it is as one layer in a short checklist: VPN on, kill switch on and tested, DNS and WebRTC checks passed, and a provider whose audit record you have actually read. The kill switch is the layer that catches the accident. The other layers catch everything else.

Before you buy: the kill-switch questions

If you are choosing a VPN and the kill switch matters to you, ask four questions before paying. Is the switch system-wide or app-level? Is it on by default or must you enable it? Does it cover manual disconnects and device restarts, or only unexpected drops? And does it exist on every platform you use — desktop, Android, iOS — or only some? A provider that answers all four clearly is a better bet than one whose support page only says “kill switch included.”

Then run the two-minute test on day one, inside the refund window, not month three. A switch you have never tested is a claim, not protection.

Sources

Last verified: October 28, 2026.

Related reading: How to Test Your VPN for Leaks: DNS, WebRTC, IPv6 (15-Minute Check)

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment