Free VPNs: Catch, Then Fix

It is 3 a.m. The my phone is awake on the charger, MTN down to one bar, and the bank app has decided you are a stranger again.

You are on the couch with two free offers glowing on the screen, doing the plan-math in your head. Ten gigabytes costs real money here, and the meter does not care how urgent the app feels.

I test on my phone and Android 15, and every megabyte count printed here came from the phone's own counters. Rankings live in our best free VPN guide. If you are not sure you need one, our VPN decision guide calls it.

The price tag nobody prints

No VPN is free to run. Servers and engineers cost money, so every free app on Play pays for itself one of four ways:

• Data-selling: your profile is the product. The ads know too much about you.
• Adware-funded: ads pushed into your traffic. Pop-ups, silent scripts.
• Breach-leaky: no security budget, then the dump. Your logs surface in plain sight.
• Freemium-audited: you upgrade, or paying users cover the lights. The free tier keeps its caps, and the claims get audited.

The newest finding came via ZDNet, 12 September 2025. The paper is called Hidden Links, by Mixon-Baca, Knockel of Citizen Lab, and Crandall. It went through the top 100 free VPNs on Play and found three families, 18 apps, 700M+ combined downloads, near-identical code, hard-coded Shadowsocks passwords.

A hard-coded key lets an attacker decrypt your traffic. The researchers asked Play to demand a security-audit badge and verified developer identities.

The older finding is a 2017 study of 283 apps, by Ikram et al. It came out of CSIRO, ICSI, UC Berkeley and UNSW, and bitlaunch printed it on 24 September 2025. It said 67% carried tracking libraries, and 16% ran proxies injecting JavaScript. Then 84% failed to tunnel IPv6, and 66% failed to tunnel DNS. One VirusTotal detection hit 38% of them. Scanners flag false positives, so treat that number gently.

Free leaked plenty without any paper's help. In 2020, seven linked free VPNs out of Hong Kong leaked 1.2TB. In 2023, SuperVPN leaked 360M records. Paid gets burned too: bitlaunch names the 2018 Nord incident and an ExpressVPN RDP bug.

The graded table

Bitdefender's free tier states 500 MB a day, printed 17 March 2026. That is the daily-cap model, and a lot of free offers work the same way.

Axis	Free category	The audited two	Paid category
Logging	Sold, or unclear	Published no-logs, audited	Published no-logs, audited
Data cap	Megabytes a day	Proton: unlimited · Windscribe: 10 GB	Unlimited
Servers	Few, random	Proton: ten, random · Windscribe: ten, your pick	100+ countries
Speed	Throttled at peak	Proton managed · Windscribe full to 10 GB	Fast, 10 Gbps class
P2P, streaming	Blocked or throttled	Proton: no · Windscribe: not promised	Offered and expected
Audits	Rare to none	Both audited, stated publicly	Usually audited
Support	None worth naming	Help pages and guides	Priority support

A cell earns its place the moment a named source prints it. Free fails that check everywhere; the audited two pass on quoted audits; paid passes with money attached.

Antivirus suites bundle VPNs too. Our antivirus guide grades that bundle.

The two worth trusting, honestly

Proton leads with this on its plan comparison page, read 12 November 2026:

• "the only free VPN that doesn't limit your bandwidth, spy on you, show you privacy-invading ads, or sell your data."

Windscribe publishes audits too: no logs, open-source code, unlimited devices.

Proton's server list names ten free countries, from the Netherlands to Japan, Canada and the United States. Its own words: "We will randomly choose your next server." First change cools down 45 seconds. After that, ten minutes between changes.

Tom's Guide, 14 July 2026, watched speeds fall to around 8 Mbps under heavy load. After a wait, they returned near 1,000 Mbps. The review calls that likely throttling for too much data. No P2P, no streaming, no server choice. Unlimited describes the allowance, not the speed. That is the limit neither audit can erase.

Windscribe's page, read 12 November 2026, prints:

• "Give us an email and get 10 GB a month, or don't and get 2 GB."

Same page: 10 country servers, unlimited devices, no card. Confirm the email or you drop to 2 GB.

Install from Play: Proton VPN, 100M+ downloads, and Windscribe, 10M+, both checked 12 November 2026.

Limits drift. It was five countries on 30 September 2026; it is ten today. Check the vendor page on install day.

The full tier list for the free options lives in our best free VPN guide.

Trial vs guarantee: the honesty box

A free plan is free forever. A trial is free until the clock runs out, and the card stays on file. A money-back guarantee is a paid month with an exit door.

ExpressVPN runs a 3-day trial on iOS and Android. Surfshark runs a 7-day trial plus a 30-day money-back guarantee (12 November 2026). A card on file means a subscription with a deadline.

Proton and Windscribe carry no trial because their free tiers are real. Free is the trial; paid is the product. Read the card line in the terms first.

Nigeria math: megabytes to months

Opera Mini's free data page, built for MTN and Airtel users in Nigeria, hands out 50 MB a day and 1.5 GB a month. That page was checked 12 November 2026. Opera's daily drip needs 200 days to fill a 10 GB cap; its monthly grant, nearly seven months.

MTN's data page, read 12 November 2026: 10 GB plus ten minutes for ₦4,500, printed at ₦0.35 per MB. My division says ₦0.45. Nobody asked the calculator's opinion before printing the label. Windscribe's 10 GB is the same 10,000 MB, priced at zero.

Proton's unlimited allowance is the prize on a metered plan, with the catch attached: a random country and a managed speed. Opera's grant is browser data, and Opera's own VPN is browser-only. Device-wide traffic needs the app or another provider.

No source I trust prints a per-hour WhatsApp or streaming rate, so none prints here. Open Settings, then Data usage, and trust that counter.

Surfshark's own blog prints $2.49 a month on two years, $2.99 for one year and $15.45 for a single month. The numbers were up 12 November 2026. Its pricing page warns the renewal price kicks in later. No other paid figure survived my check today, so none prints here.

When paid wins, stated plainly

Paid buys all three: data, choice and privacy. Streaming and P2P sit behind the paid door; neither free page promises them.

Ten countries is the free ceiling. Above it sits throughput, priority support and the 10 Gbps tier. Windscribe's unlimited devices on one free account is the exception.

Pay for a published no-logs policy you can audit, not a discount banner. Our NordVPN vs Surfshark and ExpressVPN vs Proton VPN matchups run the paid duels.

Five install checks, five minutes

1. The audit badge. The paper's remedy: a Play security-audit badge and a verified developer identity. Look for both.

2. The developer. A verified organisation and a readable privacy policy. A hundred million downloads prove distribution, not safety; the families passed 700 million.

3. Permissions. A VPN needs network access. Contacts, SMS, microphone or location are not its job.

4. Kill switch. Turn it on in the app settings. It cuts traffic the moment the tunnel drops.

5. Leak test. After connecting, confirm the IP shown is the VPN's, not yours.

Five minutes, before the first connect.

What was checked on my phone

Here is the honest part. No VPN was installed for this one: no limits screen photographed, no permissions counted, no speed pair timed on this phone. The house device is my phone and Android 15.

Verified live, 12 November 2026: Proton's two pages, Windscribe's free page, Opera's Nigeria page, MTN's data page, Surfshark's blog, both Play listings.

HiOS labels move between builds, so search the words, not the path. Anything I could not verify this week is not printed here. If screenshots land later, they will come from my phone with their own dates.

The bottom line

Free costs data, choice or privacy. The two audited exceptions cost only choice. Paid buys all three.

Count your megabytes, check the audit badge, then install. The rest of the common Android faults sit in our Android problems hub.