"Free VPN" is one of the most-searched phrases in the Play Store, and in 2026 a team of researchers finally measured what those apps do at scale. Using a system called MVPNalyzer, researchers from the University of Michigan, the University of New Mexico, and IIT Delhi tested 281 free Android VPN apps. The results were presented at the NDSS security conference and covered widely in July 2026. Apps with at least one problem had been installed more than 2.4 billion times. We make a free Android VPN, so we read the study closely. Here's what it found, without spin, and how to check the app on your own phone.
Table of Contents
The Headline Findings
61 apps
- Sent cleartext (unencrypted) data across 10,552 observed flows
29 apps
- Leaked user traffic outside the encrypted tunnel, including DNS lookups
5 apps
- Downloaded their server configuration without encryption
246 apps
- Contacted advertising or tracking URLs; 76 sent Android Advertising IDs
Not every finding is equally serious. An app that loads an ad is very different from an app that lets someone hijack your connection. But taken together, the numbers show that "free VPN" covers a huge range of quality, from genuinely protective to actively harmful.
Cleartext Data: The Basics, Failed
Encryption is the whole point of a VPN. Yet 61 apps sent some data in plain text, including web content, JavaScript, JSON files, and VPN-related resources. Usually this is the app's own traffic (loading server lists, ads, or settings) rather than your tunnelled browsing. That still matters: anyone on the same WiFi can read or tamper with it. Our explainer on how VPN encryption works covers what should be protected.
Traffic and DNS Leaks
Twenty-nine apps let traffic escape the tunnel. The most common leak is DNS: the lookup your phone does to turn "example.com" into an IP address. If DNS leaks, your ISP or the WiFi operator can see every site you visit even while the VPN says "Connected." See our guides to DNS leak protection and IPv6 leaks.
The Worst One: Unencrypted Config Files
Five apps downloaded their configuration file, the file that tells the app which server to connect to, without encryption. That's the most dangerous finding in the study. Anyone on the same network, such as a public WiFi operator or someone running a fake hotspot, could rewrite that file in transit and point your VPN at a server they control. You'd see the key icon and feel safe while all your traffic went to the attacker.
Ad IDs and Trackers
246 of the 281 apps contacted ad or tracking domains, and 76 sent the Android Advertising ID, a persistent identifier that lets ad networks link your activity across apps. Ads by themselves aren't a betrayal; plenty of free apps run on them. The problem is when a privacy app sends identifiers that follow you everywhere. That defeats the point of using it.
How to Check Your VPN Today
- Run a leak test. Connect, then check your IP and DNS servers with our VPN leak test guide. You should see the VPN's IP and DNS, not your ISP's.
- Turn on Android's "Block connections without VPN." Settings › Network › VPN › gear icon. This is the OS-level Always-On VPN lockdown and catches many leaks.
- Check the protocol. WireGuard® has a small, audited codebase and encrypts every packet by design. See what WireGuard is.
- Check permissions and the Data Safety label on the Play Store listing. Look at what's collected and what's shared.
- Avoid VPNs from unknown publishers with no website, no privacy policy, and no company name.
The study didn't publish a list of named apps in the coverage we reviewed, so treat any "top 10 dangerous VPNs" lists citing it with caution. Testing your own app is more reliable than trusting a list.
Frequently Asked Questions
Does this mean all free VPNs are unsafe?
No. The study found problems in many apps, not all of them. A free VPN that uses a modern protocol, passes leak tests, minimises trackers and publishes a clear no-logs policy can be safe to use.
What is MVPNalyzer?
MVPNalyzer is the measurement system researchers from the University of Michigan, University of New Mexico and IIT Delhi built to test Android VPN apps for cleartext traffic, leaks and tracking. It was presented at NDSS in 2026.
How do I know if my VPN leaks DNS?
Connect to the VPN and run a DNS leak test. If the DNS servers shown belong to your ISP rather than the VPN provider, your VPN is leaking.
Free, and Built to Pass the Test
CarrotVPN runs on WireGuard®, routes DNS through the tunnel, includes a kill switch and needs no account. Run a leak test yourself.
Download CarrotVPN Free