A VPN kill switch is a feature that cuts your device off from the internet the moment your VPN connection drops. If the tunnel disappears — because the app crashed, the server rebooted, or your Wi-Fi hiccupped — a kill switch blocks every app from reaching the network until the tunnel is back.
Without a kill switch, when the VPN drops your traffic silently falls back to your real connection. Sites you were opening see your ISP address, not the VPN’s. For a few seconds, or a few minutes, everything leaks.
The two common kinds
Not every “kill switch” toggle in a VPN app is the same thing. There are two implementations, and it matters which one your app uses.
System-wide kill switch
Blocks all internet traffic from every application until the tunnel is back. Turn on the VPN — everything works. VPN drops — nothing works, everywhere on the device, until the tunnel reconnects.
This is the safer default. If you are relying on the VPN to hide anything, this is the setting that means what it says.
App-level kill switch
Blocks specific apps you nominate. Your browser stops sending traffic when the VPN drops; your background music keeps streaming, and your email keeps checking. Useful if the reason you have a VPN is one specific app — say, a workflow that must appear from a specific country — but weaker on privacy.
How the kill switch actually works
Most kill switches use one of two mechanisms under the hood:
- Firewall rules. The VPN app writes system-level firewall rules that only allow outbound traffic through the tunnel’s virtual network interface. When that interface goes down, no traffic can leave. This is how most modern apps do it.
- Route table swap. The app changes the OS’s default route so that all traffic is directed at the VPN’s interface. If the interface disappears, the packets have nowhere to go. Older, less reliable — some apps mixed this with firewall rules for belt-and-braces.
You do not need to know which one your VPN uses, but the firewall-rule approach is more robust. If you are choosing between apps, most now ship with firewall-based kill switches by default.
When the kill switch actually saves you
- Your laptop is on hotel Wi-Fi. The VPN app crashes silently while you sleep. Without a kill switch, everything you have open — synced folders, email clients, browser tabs polling in the background — starts talking to the hotel’s network directly. With one, the moment the VPN goes down, so does your outbound connectivity.
- You are on mobile data with roaming enabled. The VPN reconnects every time the tower hands off. During those handoffs, traffic can leak. A kill switch catches it.
- Your device switches Wi-Fi networks (home → café). The VPN reconnects to the new network. During the switch, the tunnel is momentarily down. A kill switch pauses everything until it is back up.
When it does not
A kill switch is not a privacy feature by itself. It only limits leaks when the tunnel drops. Everything else — what the destination site sees when you sign in, what your VPN provider chooses to log, what your browser fingerprint reveals — is unchanged.
If your threat model is “I want no gaps in my VPN protection while it is meant to be running,” turn on the kill switch. If your threat model is “I do not want any specific site to know it is me,” a kill switch does nothing for that.
For a proxy, this doesn’t apply
Web proxies like AnyProxy do not need a kill switch. There is no persistent tunnel — the browser tab is either connected to us or it is not, and the URL bar tells you. When you close the tab, the session ends. There is nothing to fall back to and no silent leak surface.
That is one of the reasons a proxy is the lighter tool for the smaller job: fewer moving parts, fewer failure modes to protect against.
The one-line answer
A VPN kill switch blocks internet traffic when the VPN tunnel drops, so nothing leaks in the seconds it takes to reconnect. Turn it on if you have a VPN. If you are using a browser-tab proxy instead, you do not need one.