Best VPN for Android (2026): Six Picks, Free Tiers Included

The best VPN for Android is ExpressVPN, based on what providers document about their Android apps. It has per-app split tunneling and an in-app kill switch that is on by default and covers IPv4, IPv6 and DNS. Its Lightway protocol has post-quantum protection, and its Android TV app runs on Android 5.0 or newer.

Proton VPN is the pick if you want an open-source app and a free plan with no data cap. NordVPN, Private Internet Access (PIA), CyberGhost and Surfshark follow. They stand out on TV coverage, open source, refund length and unlimited devices.

Android gives VPN apps more room than iOS. It allows per-app routing, an always-on setting with a system-level kill switch, and sideloading. Sideloading means installing an app from a file, outside Google Play. We rank the providers on what their official pages say about those features, verified 31 October 2026. We also cover Google Play’s refund rules and which free tiers are worth installing. We have not tested speed on Android yet, and no speed figure on this page is ours.

What matters on Android, and why

Per-app split tunneling. Android lets a VPN app route some apps outside the tunnel. Your banking app can then see your home IP address while the browser goes through the VPN. Almost every provider we track documents it on Android:

• ExpressVPN: per app, on Android 7.0 and above
• NordVPN: on Android and Android TV
• Surfshark: Bypasser, for apps and websites
• Proton VPN: apps and IP addresses, on paid plans only
• Private Internet Access and CyberGhost
• Windscribe, and hide.me in normal and inverse modes
• Mullvad, IVPN, IPVanish and PrivadoVPN

NordVPN’s help center adds a warning. When its Kill Switch and split tunneling are both on, the excluded apps lose internet access. So you have to pick one or the other.

A kill switch that holds. A kill switch blocks your internet if the VPN connection drops. Android 7.0 and later can start a VPN when the phone boots and keep it running, which Android calls always-on VPN. The VPN settings panel also has a “Block connections without VPN” switch. It makes the system drop any traffic outside the tunnel. Android’s developer documentation describes both.

Providers use this in two ways. ExpressVPN, NordVPN, PIA, CyberGhost, Surfshark, hide.me and PrivadoVPN ship an in-app kill switch. NordVPN says its switch “works just like a system-wide Kill Switch” on Android 8.0 or later. ExpressVPN’s is on by default and still allows split tunneling.

Proton VPN and Windscribe point you to the system setting instead. Proton says its Android kill switch uses Android’s built-in settings and is not available on Android 7.x or earlier. Windscribe says the system’s Always On VPN “has the same effect” as its desktop firewall. Whichever app you use, the system switch is the strongest option. ExpressVPN notes that it also blocks traffic to devices on your local network.

Android TV. The same account should cover the TV. ExpressVPN, NordVPN, Proton VPN, PIA, CyberGhost, Surfshark, hide.me, IPVanish, PrivadoVPN and Windscribe list Android TV apps. Mullvad and IVPN do not. IVPN’s help center says its app is not compatible with Fire OS or Nvidia Shield.

Open source. Proton VPN, PIA, Mullvad, IVPN and Windscribe publish the code of their Android apps. Proton VPN, Mullvad and Windscribe also ship on F-Droid, an app store for open-source Android apps. An APK is the install file for an Android app. Mullvad offers a GPG-signed APK, Proton VPN publishes a signing-certificate fingerprint for its GitHub APK, and PIA hosts an official APK. ExpressVPN, NordVPN, Surfshark, CyberGhost, IPVanish, hide.me and PrivadoVPN do not publish their Android code. hide.me publishes code only for its Linux client.

Google Play refunds. Google’s policy is short. Within 48 hours of a purchase, “you may be able to get a refund depending on the details of the purchase.” After 48 hours, you contact the developer. Every provider here says Google Play subscriptions follow Google’s terms, not its own guarantee. The one exception is NordVPN. Its refund article says NordVPN support can also refund Google Play payments within its 30-day terms.

Free tiers. Four providers we track have real free plans that run on Android: Proton VPN, Windscribe, hide.me and PrivadoVPN. They get their own section below.

Always-on VPN and the kill switch on Android

Both settings live in the same place. Open Settings, then Network and internet, then VPN, then tap the gear icon next to the VPN. Always-on VPN restarts the tunnel when the phone boots and keeps it up. Android’s developer documentation says the feature has existed since Android 7.0.

The “Block connections without VPN” switch is the real kill switch. With it on, the system blocks every packet that would leave outside the tunnel. That means no internet at all until the VPN connects. It also cuts you off from printers, Chromecasts and other devices on your home network. Mullvad’s FAQ notes that its local-network sharing does not work with the switch on. ExpressVPN says the same about its own setting.

An in-app kill switch is more convenient, because it can let split-tunneled apps through. But it only works while the app is running. If you need the stricter guarantee, use the system switch and accept the trade-off. If you want convenience, the in-app switch from ExpressVPN, NordVPN, PIA, CyberGhost or Surfshark is enough for a dropped Wi-Fi connection.

NordVPN’s help center says plainly that its kill switch is not available on the Fire TV Stick app. That app runs Fire OS rather than standard Android. The Fire TV Stick page covers that platform.

Pick by pick: what the verified data says

We checked every price and plan below on 5 November 2026.

ExpressVPN’s Android page documents these features:

• per-app split tunneling, to “choose which apps use the VPN and which connect directly”
• an Internet Kill Switch that “pauses all internet traffic on your Android device until the tunnel is back up” and covers IPv4, IPv6 and DNS
• Lightway, rewritten in Rust, with post-quantum protection on by default

The app is on Google Play, and ExpressVPN’s site offers it as an APK. The Android TV app is for Android 5.0 or newer. It installs from Google Play or by APK, and you sign in with an activation code or a QR code. Obfuscation is automatic on every server. It disguises VPN traffic, which helps on networks that block VPNs.

The pricing page shows only 28-month terms. Basic costs $2.99 a month, or $83.72, and renews at $99.95 a year. Basic covers 10 devices and Express Pro 14. The Android app also offers a 3-day free trial. The 30-day guarantee covers website purchases, and Google refunds Google Play purchases. The apps are closed source, apart from the Lightway core and the browser extension.

Proton VPN’s Android app is open source and audited. It is also the easiest to get without Google. You can install it from Google Play or F-Droid, or as an APK from GitHub with a published SHA256 signing fingerprint. Split tunneling covers apps and IP addresses on paid plans. The kill switch uses Android’s built-in settings and needs Android 8 or later. The Android TV app is on Google Play, F-Droid and GitHub, and it is designed for a remote.

The free plan has no data cap, one device and servers in 10 countries. It has no streaming, P2P, NetShield or split tunneling, and it needs no card. VPN Plus costs $3.49 a month on the 2-year plan, or $83.76, and renews at $83.88 a year. The 1-year plan is $4.49 a month, or $53.88, with the same renewal. The monthly plan is $9.99. Post-quantum encryption is still on the roadmap.

NordVPN documents split tunneling on both Android and Android TV. It also documents a system-wide kill switch on Android 8.0 or later, and the Always-on VPN route for Android 7.0 or later. The Google Play version offers a 3-day trial. NordVPN says this version does not block ads because of store policy, but the APK from its website does.

Its help center lists Android 9 and up as supported. A sideloaded build covers Android 7 and 8. Android 6.8 or older has not been supported since 20 November 2024. The Android TV app installs from Google Play or by APK and signs in by QR code. NordVPN’s Android page notes that the Fire TV Stick has its own app.

The network is 7,229 servers in 150 countries. The Basic 2-year plan costs $3.49 a month, or $94.23, and renews at $139.08 a year. The monthly plan is $14.99. Refunds are 30 days, including Google Play purchases through NordVPN support. The Android app is closed source.

Private Internet Access needs Android 7.0 or later. It is open source, and PIA says “our app code is completely open-source.” It documents these features:

• per-app split tunneling
• a kill switch
• automatic connection on untrusted Wi-Fi
• WireGuard and OpenVPN
• an official APK, version 4.0.26, with a warning against modded APKs from third-party sites

The Android TV app is in Google Play, so you do not need to sideload it. PIA says a TV without the Play Store can use a router instead. Connections are unlimited. The 3-year plan costs $2.03 a month, or $81.20 up front for 40 months, and renews at $81.20 every three years. The 1-year plan is $47.88 and renews at the same price. Monthly is $11.95. PIA documents no post-quantum encryption and has no free tier. The company is based in the US and owned by Kape Technologies.

CyberGhost supports Android 7.0 and up. It documents per-app split tunneling, so you can “choose which apps bypass the encrypted VPN tunnel.” It also documents an automatic kill switch, WireGuard and OpenVPN, and automatic Wi-Fi protection. The 3-day Google Play trial needs payment details. If you cannot use Google Play, you can ask support for the official APK. The Android TV app is in Google Play, for Android TV 7.0 or newer. Samsung and LG TVs are not covered.

The 28-month plan costs $2.19 a month, or $61.32, and renews at $61.32 a year. The 45-day guarantee covers plans of six months or longer bought on the website. Google Play subscriptions follow Google’s terms. There is no obfuscation and no post-quantum encryption. Plans cover 7 devices, and the apps are closed source.

Surfshark runs on Android 6.0 or later. The Google Play version needs 7.0, and an APK covers older devices. Surfshark documents Bypasser for apps and websites, a kill switch, WireGuard with post-quantum protection, and an Android TV app. It notes that Android TVs and boxes on Android 9 cannot use an Ethernet connection with the app. Connections are unlimited.

The Starter plan costs $2.49 a month for 27 months, or $67.23. The pricing page does not state the renewal amount. The monthly plan is $18.95. No app is open source.

Free VPNs for Android that are worth installing

These four free plans from providers we track are funded by paid upgrades, not by ads or data sales. All four run on Android without a card.

• Proton VPN Free: no data cap, one device, servers in 10 countries and medium speed. No streaming, P2P, NetShield, Secure Core or split tunneling. The app is open source and on Google Play, F-Droid and GitHub.
• Windscribe Free: 10 GB a month if you confirm your email and stay subscribed to its promo emails, or 2 GB otherwise. Servers in 10 countries and unlimited devices. The Android app is open source and on F-Droid. The R.O.B.E.R.T. blocker runs only its malware and ad lists on the free plan.
• hide.me Free: no data cap, since hide.me says “we never cap your data,” but speeds are not unlimited. It has 8 locations and 1 connection, with no sign-up or registration. It needs Android 6.0 or later. There are no streaming-optimized servers, Multihop or SmartGuard.
• PrivadoVPN Free: 10 GB every 30 days on unlimited devices, with servers in 10 free countries. You need a verified email but no card. The free page claims streaming support, and Android TV and Fire TV apps exist.

NordVPN’s Android page gives a warning that applies to everything else in Play Store search results. Avoid free apps that fund themselves with ads or by harvesting data.

What to avoid

Modded APKs. A modded APK is an altered copy of an app. PIA’s page puts it plainly: “Modded .APK files from third-party websites may contain malware, request unnecessary permissions, or alter the privacy and security protections provided by the official app.” Install from Google Play, F-Droid or the provider’s own site. Check the signature where one is published.

Assuming the in-app kill switch is the system one. It is not. NordVPN’s Fire TV Stick app has no kill switch at all. Use Android’s “Block connections without VPN” if you need a guarantee.

Buying through Google Play if you want the provider’s guarantee. Google’s refund window is 48 hours. After that, the provider’s policy applies. Every pick except NordVPN says Google handles refunds for Google Play purchases.

Old Android versions. Check the minimum version before you buy:

• NordVPN: Android 9, or a sideloaded build for 7 and 8
• PIA and CyberGhost: 7.0
• Surfshark and hide.me: 6.0
• Mullvad: 9.0
• IVPN: 7.1
• Proton VPN’s kill switch: Android 8

Judging by the first-term price. First-term prices on this page run from $2.03 to $3.49 a month. Renewals run from $81.20 every three years at PIA, about $2.26 a month, to $139.08 a year at NordVPN, about $11.59 a month. Surfshark does not state its renewal at all. The comparison hub lists both.

Setup notes

1. Install the app from Google Play. If you avoid Google services, use F-Droid or the provider’s APK. Proton VPN publishes a SHA256 fingerprint and Mullvad a GPG signature, so you can check the download.
2. Sign in and pick the modern protocol: Lightway, NordLynx or WireGuard. Turn on the in-app kill switch or an auto-connect rule.
3. For the strict option, open Settings, then Network and internet, then VPN. Tap the gear icon next to the app. Turn on Always-on VPN and then “Block connections without VPN.” Local devices are unreachable while it is on.
4. If your banking app refuses VPN connections, add it to the split-tunnel exclusion list.
5. On Android TV, install the app from Google Play and open it. Sign in with the QR code or activation code shown on screen. NordVPN and ExpressVPN document this.
6. IVPN’s Android page warns of an Android security flaw that can cause DNS leaks on any VPN connection. So finish by checking with our VPN check and IPv6 leak test.

If your phone is an iPhone instead, the iPhone page covers the different rules there.

How we chose

We rank the picks by our score, which is shown above. We include only providers whose official pages document three things:

• per-app split tunneling on Android
• a kill switch, in the app or through the Android setting
• a native Android TV app

The criteria at the top of the page break ties. That filter removes Mullvad and IVPN, which have no Android TV app. IVPN says its app is not compatible with Fire OS or Nvidia Shield.

hide.me, Windscribe, IPVanish and PrivadoVPN meet the filter but rank below the six picks on the overall score:

• Windscribe has published no no-logs audit and refunds for only 7 days.
• IPVanish carries a 2016 logging incident under a previous owner.
• hide.me’s last no-logs audit was in 2024, and no app audit is on record in our data.
• PrivadoVPN has no audit at all.

A no-logs audit is an outside check that a provider does not keep logs of what you do. Windscribe and hide.me do earn places in the free-tier section above.

Scores come from our published methodology. In it, apps count for 10 percent of the weight and security for 15 percent. Prices are the lowest effective monthly price on each pricing page on 5 November 2026. Every pick lists its renewal price or says that it is not stated.

Affiliate relationships do not influence anything on this page. ExpressVPN, Proton VPN, NordVPN and Surfshark pay us a commission on some purchases. Private Internet Access and CyberGhost currently do not, and both are on the list. See how we make money and the rest of the best-of hub.