What Is a VPN Kill Switch? (And Why It Matters)

A VPN kill switch is a safety feature that instantly blocks your device's internet connection if the VPN link drops, so no traffic escapes over the ordinary, unprotected connection. Its whole job is to close the split-second gap between a VPN disconnecting and reconnecting — the moment when your real IP address and DNS requests would otherwise leak.

No kill switch, dropped VPN, still browsing: your real IP and the sites you're visiting are exposed until the tunnel comes back. With a kill switch, the connection simply stops until it's safe again.

Why a kill switch matters

A kill switch matters because VPN connections don't stay up perfectly — they drop when you change networks, when a server hiccups, when your device wakes from sleep, or when a mobile signal wavers. In each of those moments your apps keep trying to talk to the internet, and without protection they'll happily do so over the exposed connection, undoing the reason you turned the VPN on. The diagram shows the fork in the road:

The leak is small in duration but not in consequence: even a few seconds is enough for a background app to phone home, for a torrent client to reveal your address to a swarm, or for a DNS request to tell your ISP exactly which site you were on. If you want the detail on what those two things reveal, see IP addresses and DNS explained.

The two kinds of kill switch

There are two broad designs, and they protect different amounts of your traffic. Knowing which one you've got explains why some kill switches feel stricter than others.

System-level (firewall) kill switch

A system-level kill switch blocks all internet access at the operating-system or firewall level whenever the tunnel isn't up. It's the stricter, safer option: nothing on the device reaches the internet unless it's going through the VPN. The trade-off is that you'll notice it — when the VPN is off or connecting, you have no internet at all.

App-level kill switch

An app-level kill switch only closes the apps you nominate — say, your browser and a torrent client — while leaving everything else online if the VPN drops. It's more convenient but leaks anything you forgot to add to the list, so it's best treated as a targeted tool rather than blanket protection.

When a kill switch triggers (and the trade-offs)

A kill switch triggers any time the app can't confirm the tunnel is healthy: a server drop, a network change, a device waking from sleep, or the VPN app crashing. The upside is airtight; the trade-offs are real and worth knowing so they don't surprise you.

• Your internet can appear "broken" when the VPN is off or reconnecting — that's the kill switch doing its job, not a fault.
• Some kill switches don't run before you log in, so a device rebooting can briefly connect before the VPN starts.
• On phones, "always-on VPN" plus a kill switch is the most reliable combination, because the operating system helps enforce it.

Should you leave it on?

For most people the answer is yes: leave the kill switch on, and prefer the system-level version if your app offers both. The minor inconvenience of losing internet during a reconnection is a small price for closing the exact leak a VPN is meant to prevent. A kill switch is one of the handful of features worth insisting on when you're deciding what a VPN is and whether you need one — alongside a real no-logs audit and DNS-leak protection.

The leaks a kill switch prevents, concretely

It helps to picture the specific moments where a dropped connection bites, because they're more common than people expect. The classic case is peer-to-peer file sharing: a torrent client announces your address to everyone in the swarm, so if the VPN drops for even a moment, your real IP is broadcast to strangers and can end up in the logs of monitoring firms. A kill switch stops the client dead until the tunnel is back.

The quieter cases are just as important. Background apps and your operating system phone home constantly — checking for mail, syncing files, updating — and they don't wait politely for the VPN to reconnect. If the tunnel blinks while you're asleep or your laptop lid is shut, those requests can slip out over the open connection, revealing your address and the services you use. And on the move, phones drop and re-establish connections every time you walk out of Wi-Fi range onto mobile data; without a kill switch (and ideally always-on VPN), there's a gap on every hand-off.

None of these leaks lasts long — often just seconds — but privacy doesn't grade on a curve. A single exposed request can be the one that ties your identity to an activity, and you'd never know it happened. That's the whole argument for a feature that most of the time does nothing at all.

How to find and turn on your kill switch

Most reputable VPN apps include a kill switch, but it isn't always on by default, so it's worth checking. In the app's settings, look for a toggle labelled "kill switch," "network lock," or "always-on protection" — the wording varies by provider, but the concept is the same. If the app offers a choice between blocking all traffic and blocking only chosen apps, the whole-system option is the safer default for most people.

On phones, pair the VPN's kill switch with your operating system's own "always-on VPN" setting where it exists, because the OS can enforce it more reliably than an app alone. On a computer, be aware of the boot gap: if the kill switch only activates once the app has launched, there can be a brief window at start-up before it kicks in — some apps close this with a setting that blocks traffic until the VPN connects. And if you run the VPN on your router, the coverage is different: the router protects the whole home network, but a device-level kill switch is what protects a laptop the moment it leaves the house.