VPN Kill Switch Explained

Last updated: September 2026

Disclosure: LeakCheck currently has no affiliate relationships and earns nothing from any link on this page. Provider links below are non-affiliate placeholders (marked #AFFILIATE-PLACEHOLDER-* in our code) until we join programs — at which point every affected page gets a clear, conspicuous disclosure. Full disclosure.

What a kill switch is

A kill switch is a VPN feature that blocks all internet traffic on your device the moment the VPN connection drops. Without one, a dropped connection fails open: your traffic silently continues over your regular, unprotected connection — exposing your real IP address — and you may never notice (Tom's Guide, Macworld).

VPN connections drop more often than you'd think: server congestion, switching between Wi-Fi and mobile data, laptop sleep/wake cycles. The kill switch exists so those ordinary hiccups never become privacy incidents (CyberInsider).

How it works: two designs

System-level (firewall-based). Uses OS firewall rules so that no traffic can leave your device except through the VPN interface. Nothing to "detect" — if the tunnel isn't up, nothing gets out. This is the reliable design, and a well-built one also blocks IPv6 and DNS leaks (Proton VPN).
Reactive (monitor-based). Watches the VPN connection and cuts internet access when it detects a drop. Works, but there's a small window between the drop and the cut — and if the monitoring itself fails, so does the protection (Proton VPN).

Most major providers now use system-level designs on desktop platforms. Mobile is patchier — iOS in particular constrains what VPN apps can do, so kill-switch behavior varies by platform (Macworld).

Why it matters

Torrenting: your real IP is visible to every peer in a swarm. A drop mid-download without a kill switch exposes you instantly. Pair the kill switch with binding your torrent client to the VPN interface for defense in depth — see best VPN for torrenting.
Public Wi-Fi: flaky hotel and airport networks drop connections constantly — exactly when a kill switch earns its keep.
Sensitive work: journalists, activists, and researchers can't afford a silent exposure. A kill switch is baseline equipment (Macworld).

Which providers have a kill switch?

Availability below is from the cited sources, September 2026. Kill switches are common among reputable providers — treat a missing kill switch as a red flag, not a premium feature.

Provider	Kill switch	Notes (source)
NordVPN	Yes — all platforms	Windows, macOS, Android, iOS, Linux. Desktop apps also offer an app-level kill switch that kills selected apps rather than all traffic (Tom's Guide; Macworld).
ExpressVPN	Yes — "Network Lock"	Windows, macOS, Android, iOS, Linux, and routers. Blocks all traffic on a drop; TechRadar notes its settings live under General → Network Lock (Tom's Guide; TechRadar).
Surfshark	Yes — all platforms	Windows, macOS, Android, iOS, Linux; setting lives in the app's Connectivity menu (Tom's Guide; TechRadar).
Proton VPN	Yes — all platforms, incl. free tier	System-level kill switch on Windows, macOS, iOS/iPadOS, Linux, Linux CLI, and Android. Even the free iOS tier includes it (Proton VPN; Macworld).
CyberGhost	Yes — automatic	Automatic kill switch on all desktop and mobile apps; found in Privacy Settings (Fahimai; TechRadar).
Mullvad	Yes — always on, can't be disabled	Unique among providers: the kill switch is permanently enabled. No off switch, no accidental exposure (Fahimai; VPNOverview).

Three caveats before you rely on it:

It's often off by default. Open your VPN app's settings and turn it on now — don't assume (Macworld, TechRadar).
Manual setups usually lack one. If you configured your VPN via raw WireGuard/OpenVPN config files (router, manual setup), there's no app-level kill switch unless you build firewall rules yourself.
Test it. Force a drop (switch networks, disconnect the server) and confirm your internet actually stops. See how to check if your VPN is working.

FAQ

Does a kill switch slow down my connection?

No. When the VPN is up, the kill switch does nothing — it only acts when the connection drops. There's no performance cost during normal use.

Kill switch vs. "always-on VPN" — what's the difference?

Always-on VPN (built into Android 8+, for example) automatically reconnects the VPN. A kill switch blocks traffic during the gap before reconnection. You want both: reconnection to restore service, kill switch to cover the gap (Proton VPN).

Can a kill switch protect against TunnelVision-type attacks?

Partially. Macworld notes a system-level kill switch can block attacks like TunnelVision on macOS, because rogue-DHCP traffic never leaves the device outside the tunnel. It's not a complete fix for every network-level attack, but it's meaningful defense.

Sources

Tom's Guide — What Is a VPN Kill Switch, and Why Do You Need One? (provider availability: NordVPN, Surfshark, ExpressVPN, Proton VPN)
Proton VPN — What Is a VPN Kill Switch and When Should You Use One? (system-level vs. reactive designs; all-platform availability)
TechRadar — VPN Kill Switches Explained (where settings live per provider; often off by default)
Macworld — Why Your VPN Should Have a Kill Switch (iOS limitations, off-by-default, TunnelVision)
CyberInsider — VPN Kill Switch: What It Is and Why You Need One in 2026 (drop causes, updated Feb 2026)
Fahimai — Mullvad vs CyberGhost 2026 (Mullvad always-on kill switch; CyberGhost automatic kill switch)
Comparitech — ProtonVPN vs CyberGhost (both offer kill switch on every platform)