What Is a VPN Kill Switch? Meaning, Types, How to Test

A kill switch is a VPN feature that cuts your internet the moment the VPN connection drops. Nothing leaves over your normal connection until the VPN is back. Without one, a brief drop shows your real IP address to every site, app and torrent user you were connected to. Your IP address is the number that identifies your connection.

What a kill switch does

When a VPN connects, it builds an encrypted connection to the VPN server. This connection is called the tunnel. To build it, the app creates a virtual network interface. That is a software network connection that the operating system treats like a real one. The app then tells the operating system to send everything through it.

The tunnel can fail for ordinary reasons:

• Your Wi-Fi handed you off to another access point. An access point is the device that sends out a Wi-Fi signal.
• Your laptop woke from sleep.
• The server went down for maintenance.
• The app switched protocols. A protocol is the set of rules a VPN uses to build its tunnel.

When the tunnel fails, the operating system does what it is built to do. It falls back to the ordinary connection and keeps sending your data. For a few seconds, or until you notice, you are online with no VPN at all.

A kill switch stops that fallback. In most apps it is a firewall rule. A firewall is the part of a system that decides which traffic may enter or leave a device. The rule only allows traffic to the VPN server and through the tunnel. When the tunnel is gone, nothing matches the rule, so nothing gets out.

The better kill switches cover every path your data could take. ExpressVPN, for example, documents that its Network Lock blocks IPv4, IPv6 and DNS traffic outside the tunnel. We verified this on 31 October 2026. IPv4 and IPv6 are the two versions of internet addresses. DNS is the system that turns website names into those addresses. Our how a VPN works explainer shows in more detail how a VPN routes your traffic.

System-level vs app-level kill switches

There are two designs. They behave differently when the tunnel drops, and some apps offer both.

A system-level kill switch blocks all internet traffic from the device. It is usually built on the operating system’s own firewall. IVPN’s Firewall, for example, uses the Windows Filtering Platform on Windows, pf on macOS and iptables on Linux. These are the firewall tools built into each system. IVPN’s Firewall also has always-on and boot-time options. A boot-time option turns the block on as soon as the computer starts.

Windscribe calls its version the Firewall and describes it as failing closed. Failing closed means that when something goes wrong, traffic is blocked rather than let through. The hide.me desktop kill switch is firewall-based too, with a custom network driver on Windows. A driver is low-level software that controls how the system handles a piece of hardware, here the network.

Mullvad goes furthest. Its kill switch is built in, on by default and cannot be disabled. A system-level switch also stops your email, your messaging apps and everything else until the VPN reconnects. That is intended: nothing can leak while the VPN is down.

An app-level kill switch closes or blocks only the apps you list and leaves the rest of the device online. People typically list a torrent client or a browser. A torrent client is the app that downloads and shares files with other users. Our provider data recorded these versions on 31 October 2026:

• NordVPN’s Windows app offers both an Internet Kill Switch and an App Kill Switch.
• NordVPN’s macOS app from its own website has an App Kill Switch. The App Store version uses what NordVPN calls VPN bypass prevention.
• PrivadoVPN’s Windows app can be set to work system-wide or per app.
• hide.me’s StealthGuard ties selected apps, or the whole connection, to the VPN.
• Surfshark’s apps offer soft and strict modes.

If you only ever run one sensitive app through the VPN, an app-level switch is convenient. For privacy on a network you do not trust, use the system-level switch. It also covers the apps you did not think to list.

Why it matters for torrenting and public Wi-Fi

A torrent swarm is the group of people sharing the same file. Everyone in the swarm, and anyone monitoring it, sees the IP address your torrent client announces. Seeding means uploading the file to others. If the VPN drops for ten seconds while the client keeps seeding, your real address is announced to the swarm. A kill switch that stops the client, or stops all traffic, keeps your session hidden. Without one, anyone logging the swarm can record your real address. Our best VPNs for torrenting page treats a working kill switch as a requirement, not a bonus.

Public Wi-Fi is the other case. There, tunnel drops are routine. They come from captive portals, weak signals and moving between access points. A captive portal is the sign-in page a public network shows before it lets you online. You turned the VPN on because you do not trust the network. With a kill switch, a dropped tunnel means no internet rather than unprotected internet.

A kill switch does not protect traffic you chose to send outside the tunnel with split tunneling. Split tunneling is a setting that lets chosen apps skip the VPN. Those excluded apps stay exposed by design.

Platform differences

The same brand can behave differently on each operating system, because each system gives apps different tools. The table summarizes what our provider records showed on 31 October 2026.

Two platform notes explain the mobile rows. Google documents an Always-on VPN switch in Android’s network settings. It also documents a notification that stays on screen if that connection stops working. Several providers rely on this setting instead of a firewall inside their own app.

Apple documents Always On VPN as an IKEv2 feature that is installed through device management. IKEv2 is one of the protocols a VPN can use. Device management is the system organizations use to control the phones and tablets they hand out. The feature turns on without any action from the user and stays on after restarts. That is why consumer iPhone apps build their own methods. It is also why provider descriptions for iOS vary more than for desktop.

Our data has less detail for TV devices. NordVPN’s record shows no kill switch on the Fire TV Stick. IPVanish offers a separate TV Kill Switch companion app for Fire TV and Android TV. A companion app works alongside the main VPN app.

Every one of the twelve providers we track has a kill switch on desktop. On mobile, eleven do. IVPN’s record shows none for current iOS or Android versions, so our data marks it as absent there.

How to test your kill switch

Test the kill switch yourself instead of trusting the setting. A test takes five minutes.

1. Connect to the VPN. Open our VPN check tool and note the IP address and location it shows. They should belong to the VPN server, not to you.
2. Start something that keeps traffic flowing, such as a large download or a video stream. You can also run a continuous ping from a terminal. A ping is a tiny test message sent to a server. A terminal is the window where you type commands.
3. Break the tunnel on purpose. Switch servers during the transfer, or turn Wi-Fi off and on. You can also force the VPN to quit in Task Manager on Windows or Activity Monitor on a Mac, instead of pressing Disconnect. A crash is the case you are testing.
4. Reload the check tool. With a working kill switch, the download stalls. The page either fails to load or still shows the VPN address. If your home address appears, even for a moment, the kill switch failed.
5. Run the IPv6 leak test and the WebRTC leak test while connected. WebRTC is a browser feature for voice and video calls. IPv6 and WebRTC are separate paths that a kill switch may not cover. Surfshark’s help center, for example, says it does not support IPv6 and recommends turning IPv6 off on the device.

Repeat the test after major app updates and on each device you rely on. If the switch fails, look for a strict or always-on mode in the app’s settings before you change provider.

What a kill switch does not do

A kill switch protects you from your VPN disconnecting. It does not hide anything from the VPN provider itself, which still sees your traffic. So a provider’s no-logs policy and audits matter as much as the switch. A no-logs policy is a promise not to keep records of what you do. An audit is a check of that promise by an outside firm.

A kill switch does not stop DNS leaks unless it also blocks DNS outside the tunnel, as ExpressVPN documents for Network Lock. A DNS leak happens when your device looks up website names outside the VPN. A kill switch also does nothing for apps you have excluded with split tunneling. And it cannot help if you forget to turn the VPN on in the first place. An always-on mode helps with that.

Whether any of this is worth paying for depends on what you use the VPN for. For torrenting and public Wi-Fi, a kill switch is the feature we would not go without. Every provider’s record is linked from our reviews hub, and more explainers are in the Learn hub.

Related

• What is split tunneling?
• How does a VPN work?
• What is a VPN?
• WireGuard vs OpenVPN
• Is my VPN working? (check tool)
• Best VPNs for torrenting
• Best VPNs for privacy
• Mullvad review