Best Free VPN Apps for Android in 2026: What Free Actually Costs

A VPN is not software. It is a fleet of servers in datacentres that someone pays rent and bandwidth on, every month, forever.

That single fact is missing from almost every "best free VPN" list, and it decides everything. Because if the servers cost money and you are paying nothing, there are only three honest answers to who is covering it:

1. Paying subscribers are. The free tier is a sample of a real product, deliberately limited so that some people upgrade.
2. It isn't really a VPN. The app is a proxy client with no servers of its own, or a network accelerator that was never about privacy.
3. You are. Your traffic, your attention or your device's spare bandwidth is the product being sold.

Every app below falls into one of those three. Which one it falls into is more useful than any feature list, so that is how this is ordered.

The one with a genuinely free tier

1. Proton VPN — free, uncapped, and funded by people who pay

• Version: v5.19.78.0 · Size: 58.7 MB · Android: 8.0+ · Licence: open source

Proton VPN is the answer for most people reading this, and the reason is structural rather than technical. Proton sells a paid VPN, a paid mail service and a paid drive service. The free VPN tier exists as the shop window for those, which means the company has a direct commercial reason not to monetise your traffic — doing so would destroy the product it actually sells.

The free tier applies no data cap, which is genuinely unusual. What it limits instead is choice: a small set of countries, one device at a time, and no say in which server inside a country you land on. At busy hours it is slow, because everyone on the free tier is sharing that small set.

The apps are open source and the company publishes independent audits of them. Swiss jurisdiction gets mentioned constantly in marketing; treat it as a mild positive rather than a shield, because no jurisdiction protects data a company chose to collect.

Install this one if: you want a VPN today, for nothing, from an organisation whose business model does not depend on reading your traffic.

Not free — but it is what you are actually asking for

2. Mullvad — the one that does not ask who you are

• Version: v2026.8 · Size: 36.2 MB · Android: 8.0+ · Licence: open source

Mullvad is a flat few euros a month with no annual discount, no tiers and no upsell. It is in this list because it is the honest end point of the question "what does a private VPN look like", and because knowing that end point tells you what the free options are trading away.

You do not create an account. The signup generates a 16-digit number, and that number is your entire identity to Mullvad — there is no email address, no username and no password to leak. You can pay in cash by post if you want to, which sounds theatrical until you notice it is the only way a VPN can genuinely not know who you are.

The client is open source under GPLv3, uses WireGuard, and includes DAITA — a traffic-shaping mode that pads packets to blunt the size-and-timing analysis that can identify a site even through an encrypted tunnel. That feature exists in very few consumer clients.

The honest downside is that it costs money and there is no free tier at all, so it cannot be the answer to the question in the title. It is the answer to the question underneath it.

Install this one if: privacy is the actual goal rather than a nice-to-have, and a few euros a month is affordable.

Not a VPN, whatever the app store says

3. Cloudflare WARP — a speed layer wearing VPN clothes

• Version: v6.36 · Size: 35.2 MB · Android: 7.0+ · Licence: freeware

WARP grew out of Cloudflare's 1.1.1.1 DNS resolver, and it is best understood as that resolver plus an encrypted tunnel to Cloudflare's edge network. On a bad mobile connection it often makes browsing measurably faster, because Cloudflare's network is closer to most of the web than your carrier's route is.

What it is not is an anonymity tool, and Cloudflare has never claimed it is. Your traffic is not hidden from Cloudflare, you cannot choose an exit country, and the point of the product is performance and encryption on untrusted Wi-Fi.

That makes it excellent at a job most people actually have — stopping the coffee shop network and your mobile carrier from reading your DNS queries — and useless at the job the word "VPN" implies.

Install this one if: you want your phone's traffic encrypted on public Wi-Fi and you do not care where the internet thinks you are.

4 and 5. v2rayNG and NekoBox — empty tools you supply the server for

• v2rayNG: v2.2.6 · 27.3 MB · Android 5.0+ · open source
• NekoBox: v1.4.2 · 14.5 MB · Android 6.0+ · open source

These two are the most commonly misunderstood apps in the category. v2rayNG and NekoBox are proxy clients. They ship with no servers, no accounts and no network. Open either one fresh and it will connect to nothing, because there is nothing to connect to until you paste in a configuration.

They exist because they speak protocols — VMess, VLESS, Trojan, Shadowsocks and others — designed to look like ordinary encrypted web traffic, which is why they matter in places where recognisable VPN protocols are blocked outright. Both are open source, both are small, and both are configuration tools rather than services.

If you have a config from a provider or you run your own server, they are the right apps and they are very good. If you do not, they will appear broken, and no amount of tapping the connect button will change that.

Install these if: you already have a server config in hand. Otherwise skip them; they are not what you are looking for.

The paid service with a trial, not a free tier

6. NordVPN — large, fast, and not free

• Version: v6.28.2 · Size: 48.6 MB · Android: 7.0+ · Licence: freeware

NordVPN is a competent commercial VPN with a very large server fleet, and the app is free to download in the same sense that a supermarket is free to walk into. There is no free tier. Beyond a trial period you are paying, and the headline monthly price you see advertised is almost always the multi-year rate.

The service itself is fine — fast servers, a well-built Android app, split tunnelling that lets chosen apps bypass the tunnel. It appears on lists like this one because people search for it after seeing it sponsored, not because it belongs in a free roundup.

It is worth naming one structural difference from Mullvad: NordVPN requires an account tied to an email address and a payment method, so the company necessarily knows who each subscriber is. That is normal for the industry and it is still a real difference from a service built not to know.

Install this one if: you have decided to pay for a mainstream VPN and want a large country list. Compare it against Proton first — we put those two side by side.

The category to avoid

7. Turbo VPN — free, unlimited, and paid for somehow

• Version: v4.1.2 · Size: 26.8 MB · Android: 5.0+ · Licence: freeware

Turbo VPN represents the largest group in this category by install count: standalone free VPNs with no meaningful paid product behind them, promising unlimited data at no cost.

Go back to the arithmetic at the top. Servers cost money every month. If there is no subscriber base paying for them and the app is still running, the revenue is coming from somewhere else — advertising, analytics, or bandwidth resale. Independent researchers have repeatedly examined this class of app and repeatedly found tracking libraries, weak or absent encryption, misleading no-log claims and, in some cases, ownership structures deliberately obscured behind shell companies.

None of that is an accusation about a specific build in this catalogue. It is the base rate for the category, and the base rate is the right thing to reason from when you cannot audit the app yourself. Choosing a free unlimited VPN to protect your privacy is choosing an unknown party to route all of your traffic through, which is precisely the risk you installed a VPN to reduce.

Install this one if: nothing here applies. Use Proton VPN's free tier instead — same price, known funding.

The seven side by side

Two columns carry the whole table. Who pays tells you whether the app's interests are aligned with yours. Licence tells you whether anyone outside the company can check whether it does what it claims — four of these seven can be read by anyone, and that is not a small thing in software whose entire job is handling traffic you cannot inspect.

What a VPN does not fix

This gets oversold badly enough to be worth stating plainly.

A VPN moves your traffic's exit point. That is all it does. Your ISP stops seeing which sites you visit; the VPN operator starts seeing it instead. You have not removed the observer, you have chosen a different one. Every other benefit follows from that single change, and any claim that does not follow from it is marketing.

It does not make you anonymous to sites you log into. Signing into an account identifies you far more precisely than an IP address ever did. Browser fingerprinting works the same through a tunnel as outside one.

It does not stop tracking. Cookies, advertising identifiers and fingerprinting are all above the network layer. If tracking is the problem, a content blocker and a privacy-respecting browser do far more than a VPN — the Android privacy apps guide covers those.

It does not protect against malware, whatever the security-suite branding on some of these apps suggests.

"No logs" is a promise, not a mechanism. Nothing in the protocol prevents an operator from recording connections. What varies is how much a given provider has structurally arranged not to be able to — Mullvad not asking for your name is a mechanism; a sentence in a privacy policy is not.

One practical note: several of these arrive as APKs rather than through the Play Store. Sideloaded packages do not update themselves, and a build that refuses to install over an existing one is usually a signing-key conflict rather than a broken download — the "App not installed" guide has the fix. Before installing any of them, check the SHA-256 of the file against the publisher's published value.

The five-minute version

Want a VPN right now, for nothing? Proton VPN. Accept the country limits and the peak-hour slowness; they are what "free and honestly funded" costs.

Want the real thing and can spend a few euros? Mullvad. Nothing else here declines to learn your identity.

On dodgy public Wi-Fi and want it encrypted? Cloudflare WARP, which is the best tool listed for that specific job and not a privacy service.

Already have a server config? v2rayNG or NekoBox, whichever interface you prefer.

Tempted by free unlimited? Re-read the arithmetic. Servers cost money every month, and if you are not paying, you need to know who is.

Every app named here resolves to a page in the FileCobra catalogue — the build fails if one does not. Versions, package sizes and system requirements are read from that catalogue rather than written by hand. Where our ingestion worker has fetched a release itself, it records a SHA-256 of the exact file we serve and publishes it on the app’s page. We do not run an antivirus lab: where a VirusTotal report exists we link it, and where none exists we say so rather than imply one.