What Is a VPN Kill Switch? How It Works and How to Test It

A VPN kill switch is a safety feature that automatically blocks all internet traffic on a device the moment its VPN connection drops, then releases that traffic again only once the encrypted tunnel reconnects. The point is simple: without a kill switch, a dropped VPN connection can silently fall back to your regular, unprotected internet connection, exposing your real IP address, your DNS requests and whatever browsing you are doing in that window. With a kill switch enabled, that fallback never happens — your device goes offline instead of going naked.

What is a VPN kill switch?

A VPN routes a device's traffic through an encrypted tunnel to a VPN server, which is what hides a user's real IP address and ISP-assigned DNS servers from the sites they visit. That protection only exists while the tunnel is up. If the VPN app crashes, the connection drops because of a network change, the chosen server becomes unreachable, or the device switches between Wi-Fi and mobile data, the operating system will typically try to keep the device online by routing traffic over the regular, unencrypted connection — even if only for a second or two.

A kill switch closes that gap. According to NordVPN's own support documentation, its Kill Switch feature "helps prevent unprotected access to the internet when your traffic doesn't go through a NordVPN server." ExpressVPN describes its equivalent feature, Network Lock, as something that "automatically blocks all internet traffic if your VPN connection is interrupted," with traffic resuming only once the tunnel is restored. Proton VPN frames it the same way: a feature that "protects your IP address in case you unexpectedly lose the connection to a Proton VPN server."

In practice, the feature works as an on/off switch for the device's network access, governed entirely by the state of the VPN tunnel. When the tunnel is up, traffic flows normally. When it is down — for any reason other than a connection you intentionally end, in most implementations — the kill switch engages and nothing gets through until the VPN reconnects.

How a kill switch actually works under the hood

Kill switches are typically built on top of a device or operating system's own firewall layer, not inside the VPN tunnel itself. ExpressVPN's Network Lock page explains that the feature applies firewall-based rules that "block all unencrypted traffic" the moment the VPN disconnects, and that this containment "covers IPv4, IPv6, and DNS requests" — the three channels most commonly responsible for VPN leaks. When the encrypted tunnel comes back, those blocking rules are lifted automatically.

NordVPN's support article describes a similar cycle: the app continuously monitors the VPN connection's status and IP address, detects the moment the tunnel drops, blocks outbound traffic, and restores normal internet access once the tunnel is re-established. Some vendors implement this at the application layer (blocking specific apps), others at the system layer (blocking the device's entire network stack), which is the key distinction covered next.

App-level kill switch vs. system-wide kill switch

Not all kill switches work the same way, and the difference matters for what gets protected.

• System-wide (network-level) kill switch: Blocks all internet traffic from the device — every app, every background process, every browser tab — whenever the VPN is not connected. NordVPN's Windows "Internet Kill Switch" and its Android "system-wide Kill Switch" (available on Android 8.0 and later) both work this way, as does ExpressVPN's Network Lock on Windows, macOS and Linux.
• App-level (per-app) kill switch: Instead of cutting off the whole device, it closes or blocks only the specific applications a user selects when the VPN drops. NordVPN calls this the "App Kill Switch" on Windows (its documentation gives Steam as an example) and offers a comparable per-app option in its macOS website build. This is useful when a user wants other apps — say, a music player — to keep working normally if the VPN disconnects, while still guaranteeing that a torrent client or browser never leaks real traffic.

Some providers let both coexist. NordVPN's support documentation on Kill Switch and Split Tunneling notes that the network-level Kill Switch "cannot be bypassed" by split tunneling settings — if the VPN connection drops, apps that were excluded from the tunnel can still be blocked, because the kill switch's security function takes priority.

How to find and enable a kill switch on Windows

On Windows, most major VPN apps surface the kill switch as a toggle inside the app's own settings menu rather than as a Windows system setting. According to NordVPN's support documentation, the Windows app offers two separate controls: the Internet Kill Switch, which by default blocks internet access only when an active VPN connection is lost due to an error, with a stricter mode that blocks access whenever there is no active VPN connection at all; and a separate App Kill Switch that closes specific programs you choose when the VPN drops. ExpressVPN's Network Lock, by contrast, ships enabled by default on its Windows app and can additionally be set to "Enable at all times," which blocks internet traffic even when a user intentionally disconnects from the VPN — useful for anyone who wants zero exceptions.

How to find and enable a kill switch on macOS

macOS implementations vary by how the VPN app was distributed. NordVPN's support article explains that its Mac App Store version uses "VPN bypass prevention," which works at the network routing level to force covered traffic through the tunnel and persists through app restarts and sleep/wake cycles, while the website-distributed version uses an App Kill Switch that ends a chosen app's connection if the VPN drops. ExpressVPN's Network Lock is enabled by default on its macOS app as a system-wide block. Proton VPN's support page notes one macOS-specific caveat: enabling the kill switch on some Intel-based Macs with the T2 security chip "can cause problems," so affected users should check Proton's dedicated troubleshooting article before relying on it.

How to find and enable a kill switch on iPhone and iPad

iOS is the trickiest platform for a true kill switch, because Apple's VPN framework does not give third-party apps the ability to fully cut a device's network connectivity the way a desktop firewall can. Proton VPN's own documentation states this plainly, explaining that "the Apple VPN framework doesn't come with the ability to shut down the network connectivity on an Apple device, making it impossible to build a true Kill Switch," which is why its iOS app instead uses an "Always-on" mechanism that automatically re-establishes the secure connection if the device gets disconnected. ExpressVPN's iOS app takes a similar approach but calls it Network Protection: it is always on and cannot be disabled, with a "Standard" level that blocks traffic only during interruptions and an "Advanced" level that also blocks traffic whenever the VPN is manually switched off, aside from essential Apple DNS lookups. NordVPN's iOS app uses the same routing-level "VPN bypass prevention" as its macOS App Store build, managed from Settings under the VPN connection screen inside the app.

How to find and enable a kill switch on Android

Android offers kill switch protection at two levels. First, most VPN apps have an in-app toggle: NordVPN's support documentation describes a system-wide Kill Switch on Android 8.0 and later that blocks all internet access whenever there is no active VPN connection (it is not available on Amazon Fire TV Stick devices), plus an "Always-on VPN" option for Android 7.0 and later whose availability depends on the device manufacturer's software. Second, Android itself has a built-in system setting independent of any specific VPN app: in the device's Settings, under the VPN section, tapping the gear icon next to a configured VPN profile exposes an "Always-on VPN" toggle and, on Android 8.0+, a further "Block connections without VPN" option — Android's own version of a lockdown kill switch that blocks all network traffic until the VPN reconnects. NordVPN's support article gives the in-app path as Settings > Connections > More connection settings > VPN, then the cog icon next to the VPN app, then enabling Always-on VPN.

NordVPN's kill switch, specifically

Because "vpn kill switch nordvpn" is one of the most common searches on this topic, it's worth isolating what NordVPN's own support article says: the feature is not a single universal toggle but a family of platform-specific implementations — Internet Kill Switch and App Kill Switch on Windows, VPN bypass prevention on the Mac App Store build and on iOS, an App Kill Switch on the Mac website build, a system-wide Kill Switch plus Always-on VPN on Android, and a command-line toggle on Linux (nordvpn set killswitch on, checked with nordvpn settings). NordVPN's separate feature page states the Kill Switch is "not activated by default" on most of these builds, so checking the app's own settings menu after installation is the only reliable way to confirm it is actually on.

How to test that your kill switch actually works

A kill switch that silently fails is arguably worse than having no kill switch at all, since it creates a false sense of protection. The core test is the same regardless of provider: deliberately break the VPN connection while watching for any leak of your real IP address or DNS traffic.

1. Confirm your VPN IP first. Connect to the VPN, then load an IP-checking tool and note the IP address and location it shows — it should match the VPN server's country, not your own.
2. Run a DNS leak check while connected. NordVPN publishes its own DNS leak test tool, which checks whether your traffic is routed through your chosen DNS servers or is leaking out through your ISP's DNS instead. ExpressVPN maintains a broader, open-source set of checks — including IP address, WebRTC, DNS and BitTorrent leak tests — through its Digital Security Lab leak testing tools, with the underlying code published for inspection.
3. Force the VPN connection to fail with the kill switch on. This can mean toggling Wi-Fi off and back on, disconnecting from one VPN server to force a switch, killing the VPN app's process, or disabling your network adapter for a moment — the scenarios that most realistically mirror what happens on an ordinary unstable connection.
4. Immediately re-check the IP and DNS tools. With the kill switch working correctly, the page should simply fail to load at all while the tunnel is down, since no traffic should leave the device. If it loads and shows your real IP address or your ISP's DNS servers — even briefly — the kill switch did not hold for that scenario.
5. Repeat for your platform's actual failure modes. A kill switch that passes a simple manual VPN disconnect may behave differently during a system reboot, an app crash, or a network change, since these trigger different code paths. Testing more than one scenario gives a more honest picture than a single manual disconnect.

Because kill switch behavior differs by exactly how the connection is interrupted, no single test — including the ones above — can certify a kill switch as leak-proof in every circumstance. Treat these checks as a way to confirm the feature is switched on and functioning for common cases, not as a guarantee against every possible edge case.

Limitations worth knowing before you rely on one

A kill switch is not a universal guarantee, and the vendors' own documentation flags several caveats worth knowing in advance:

• Manual disconnects aren't always covered. Proton VPN's support page states its standard Kill Switch "can't protect you if you intentionally disconnect from a VPN server" — only its separate "Permanent" or "Advanced" kill switch modes cover deliberate disconnections.
• Restarts and reboots can behave differently. Several vendors document platform-specific quirks, such as Chromebook settings that do not persist after a restart, per Proton VPN's documentation.
• iOS has structural limits. As Proton VPN's documentation notes, Apple's own VPN framework does not give any app full control over device-level connectivity, so no iOS VPN app can offer a true, OS-independent kill switch — only an "always reconnect" approximation.
• Hardware-specific issues exist. Proton VPN warns that some Intel Macs with the T2 chip can run into problems when the kill switch is enabled.

None of this means kill switches don't work — it means the protection is scenario-dependent, which is exactly why testing your specific platform and provider combination, rather than assuming any kill switch behaves identically everywhere, is worth the five minutes it takes.

How a kill switch fits with other privacy tools

A kill switch is one layer in a broader privacy setup, not a replacement for the others. If you're still deciding whether you need a VPN at all, our guide on what a VPN is and how it works covers the basics first. iPhone and iPad users sometimes confuse Apple's own traffic-relay feature with a VPN kill switch — our explainer on iCloud Private Relay vs. a VPN breaks down why they are not interchangeable. And since account security and network security are separate problems, it's worth pairing a properly tested kill switch with account-level protections like the ones covered in our guide to passkeys.

What to do next

Open your VPN app's settings menu today and confirm, by name, whether a kill switch or network-lock-style feature is present and switched on — don't assume it's on by default, since several major providers ship it off until a user enables it. Then run the DNS and IP leak checks above once while connected normally to establish a baseline, and again immediately after forcing a disconnect, so you know exactly what "normal" and "protected" look like on your own device before you ever need the kill switch to work for real.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage