How to set up a VPN on Android and use always-on protection

Android gives you two decisions when setting up a VPN. Which app will handle the connection? What should the phone do if that app loses contact with its server? Start with an ordinary connection on your home Wi-Fi. Once that works, try the stricter settings so you recognise their effect before you need them away from home.

Connect the app on your personal profile

1. Install the Android app linked from the provider’s website through Google Play. If the phone has a separate work profile, use your personal Play Store for a personal subscription. A briefcase badge usually marks work apps.
2. Open the app and sign in if your plan requires it. Start with the provider’s automatic server choice. For example, Proton VPN offers Fastest country → Connect. Its first connection opens Android’s system request to set up a VPN. Check the named app and approve the request.
3. Wait for the app to show that it has connected. Open Settings → Network and Internet → VPN. Phone makers arrange these settings differently. Search Settings for “VPN” if you cannot see that path. Find the service you just connected.
4. Open a new webpage with mobile data switched off and Wi-Fi connected. Use the browser exposure checker to compare the observed network with the one you saw before connecting. Record the difference before changing any more settings.

A successful browser check describes that browser on that profile. Check the provider’s split-tunnelling screen if you expect other apps to take the same route. An exclusion sends the selected app down another path. A work profile can also have a VPN managed by your employer.

Choose what happens between connections

For an app that supports Android’s system controls, use its kill-switch instructions to reach the right VPN settings screen. In Proton VPN’s Android procedure, open the system settings from the app, tap the cog beside Proton VPN, then enable Always-on VPN and Block connections without VPN if you want both behaviours. Other apps and managed phones can expose different controls. If a switch is missing or grey, consult the instructions for that app and device before assuming it is active.

Test the behaviour you selected

With the phone on home Wi-Fi and no sensitive apps in use, connect, lock the phone and unlock it again. Read the connection status. Then disable Wi-Fi to move onto mobile data, wait for reconnection and refresh the browser check. If you enabled blocking, a brief spell with no internet is an expected possibility while the app finds its server. A downloaded page sitting on screen tells you little. Load something fresh.

If nothing loads afterwards, open the VPN app and reconnect. If it still fails, check that mobile data is available, that a data limit has not been reached and that the app can reach another server on the same plan. A hotel network may instead be waiting for you to complete its welcome page. In that case use the hotel's sign-in process with sensitive apps closed, or switch to a trusted mobile connection.

Replace a VPN without stranding the phone

Before uninstalling a VPN you personally configured, visit its system settings and turn off blocking and always-on for that entry. Disconnect, confirm you have internet and set up the replacement. Re-enable the protection you want for the new app. If a workplace controls the settings, contact IT. For travel, see how a VPN works with a travel eSIM.

Android instructions

• Google’s Android VPN settings guide
• Proton’s Android app walkthrough
• Proton’s kill-switch instructions by operating system