Free Windows VPN: The Best Free VPN for Windows 10 and 11 (2026)

The best free Windows VPN in 2026 is Proton VPN Free: no data cap, no ads, a no-logs policy and a kill switch on Windows 10 and 11. Hotel Wi-Fi is the classic job for a free Windows VPN. A café network. A co-working space with a router nobody ever updated. That’s where a free Windows VPN earns its place, and in 2026 the best one is Proton VPN Free.

• Proton VPN Free: unlimited data, for daily use.
• Windscribe Free: 10 GB and European IPs.
• Hotspot Shield Basic: speed over privacy.
• TunnelBear: 2 GB for short sessions.
• hide.me: a per-app kill switch.

It has no data cap. Outside auditors have checked its no-logs policy. The apps are open source, and the kill switch actually cuts traffic.

Windscribe is the better pick for a European country or for torrenting. Three more services fill narrower gaps. All five run on Windows 10 and Windows 11.

We cover what each free plan really gives you and how to install one safely. Then how to prove it works, and what to do when it breaks.

The best free Windows VPN plans in 2026 at a glance

Every service below passes the same bar. No browsing logs, no injected ads, a working kill switch on Windows.

Free plans change often. Treat the limits as a snapshot from late 2026, and we’d confirm them on the provider’s own pricing page before installing.

Hotspot Shield is the outlier. Its free plan records your IP and device information. Read its section before you install it.

Proton VPN Free: the daily choice

Proton earns the top spot because its trust claims can be checked. The Windows client is open source. An outside firm has audited the no-logs policy. The free plan has no data cap and no ads.

It’s built for video calls, large downloads and hotel networks alike. The leak tests further down show whether the real IP really stays hidden.

The open code matters more than any speed chart. Nobody outside can audit a company’s servers. Anyone can see that the app has no obvious tracking code, though, and someone independent has checked the policy.

Most VPN companies, paid ones included, publish nothing.

The free countries

You don’t choose a server or a city. The app picks one. The “Change server” button gives you another at random, with a wait that grows after the first switch.

Nobody explains that cooldown clearly in the app. For privacy it makes no difference. For a specific geo-locked site, it can be annoying.

Speed and streaming

Speed on the free plan is usually fine for everyday loads: 4K YouTube, calls, game downloads. Streaming services are another story.

The big streaming platforms block the free IPs most of the time. Proton itself reserves streaming support for paid plans. If streaming is the reason you want a VPN, a free plan is the wrong tool.

The kill switch, checked the crude way

A crude check: kill the Proton process mid-session. The connection should drop at once, with no request leaving through the real IP. When the app comes back, so should the tunnel.

Windscribe Free: when it beats Proton

Three cases. You need a server in the UK, France or Germany. You’d like torrenting on a free plan. Or you sit behind a network that blocks VPNs.

It gives 10 GB a month after you confirm your email, and 2 GB without. Windows users also get a firewall-level kill switch. Stealth mode is free too.

Proton’s free list has no UK, French or German IP. Windscribe’s does. Data is the trade-off.

Ten gigabytes is plenty for email, browsing and the occasional call. Not for regular video.

The Firewall kill switch

Windscribe calls its kill switch Firewall. It works at the operating system’s network level, not inside the app. So if the VPN process crashes or gets force-closed, traffic still can’t escape.

Two crude checks: pull the Ethernet cable mid-session, or kill the process. Neither should leak. Kill switches that only work at the application layer can fail in edge cases like these.

Stealth mode

Stealth wraps VPN traffic so it looks like ordinary HTTPS. That gets you through corporate, school and hotel networks that block VPN connections at the router.

Proton now lists its own Stealth protocol among the free features too. Worth a try on the same networks.

One non-obvious detail. The browser extensions for Chrome and Firefox have unblocked BBC iPlayer in cases where the desktop app couldn’t.

Hotspot Shield Basic: fast, weak on privacy

It’s safe from malware and weak on privacy. The free plan logs your IP address, your device type and some session details. Its own privacy policy says so.

It suits people who want a quick, simple connection on public Wi-Fi and don’t mind the provider keeping connection data. For real privacy, we’d choose Proton or Windscribe.

The app is as simple as VPNs get. One button, no settings, a connection in seconds. Speed is generally good on its servers.

Hydra is the default protocol. Switching to WireGuard in the settings helps during busy evening hours.

The free tier has shrunk over the years, though. Recent reviews disagree on how much data the desktop app gets, and on which locations are open. Most agree the choice is mostly US servers.

Check the current terms on Hotspot Shield’s site before relying on it. And remember why it sits third: the logging. Most people never read a VPN’s privacy policy. This one is worth reading.

TunnelBear: 2 GB for short sessions

Enough for short sessions only. Two gigabytes a month covers roughly an evening of browsing, or a short stretch of HD video. So it works as an emergency VPN for airports and cafés.

The service itself is trustworthy. It has published an independent security audit every year since 2017, and it ships a working kill switch.

The app is polished, WireGuard is the default protocol, and there’s a public transparency report.

Older reviews that praise the wide choice of free countries describe a plan that no longer exists.

A sensible use for it today: a backup on a second laptop. Switched on for twenty minutes, when you log in to something on a network you don’t trust.

hide.me: per-app kill switch and split tunneling

Two free features here that nobody else on this list matches. StealthGuard, a kill switch you can apply per app. And split tunneling on the free plan.

Most kill switches act like a fuse. The VPN drops, and all internet stops. StealthGuard lets you choose which programs get cut.

Browser and email offline when the tunnel drops, while a chat app stays connected. Or the other way round. Few other free plans offer that.

Split tunneling is useful by itself. Route Windows Update or a game launcher outside the VPN and keep the browser inside. You save free-tier bandwidth and skip the speed penalty on large downloads.

Confirm the data limit on the provider’s pricing page. Free terms move.

Which free Windows VPN for which job

Two VPN apps installed side by side is asking for trouble. Pick one as the main app. Keep a second one on another PC, if you want a backup.

How to install a free Windows VPN

For Proton VPN the whole process takes about three minutes and needs no payment card. The other four install the same way.

1. Go straight to the provider’s official site. For Proton that’s protonvpn.com/free-vpn/windows. Fake installers that bundle adware circulate on download portals.
2. Create a free account. An email address is enough, with no card. The same Proton account works for Proton Mail and Proton Drive.
3. Pick the right build. On an Arm PC, choose the ARM64 installer where the provider offers one. The x64 version runs under emulation and is slower.
4. Run the installer. Approve the User Account Control prompt when it asks to install a network driver. That’s normal for any VPN.
5. Sign in and click Quick Connect. The app shows the server country once the tunnel is up.

Right after installing, open the app settings and turn on the kill switch. On some providers it’s off by default. Without it, a dropped tunnel sends traffic out through your normal connection.

After setup, check where DNS goes: Settings, Network & internet, Advanced network settings.

If you had custom DNS servers set in Windows 11, the VPN should override them while connected. In most cases it does. The leak test further down tells you for certain.

The built-in VPN client in Windows

Windows 10 and Windows 11 have a built-in VPN client. Not a VPN service. It does nothing by itself.

You still need a VPN server, an address and credentials. Those come from your employer, from a provider, or from your own server.

Adding a VPN connection in Windows 11, step by step

Got a server address and a login from work or from your own server? Then this.

1. Settings, Network & internet, VPN. Click Add VPN.
2. VPN provider field: the built-in Windows entry.
3. Connection name: anything you’ll recognise, “Office VPN” for example.
4. Server name or address, and the VPN type your provider uses.
5. Type of sign-in info. User name and password, a one-time password, a certificate or a smart card.
6. Save. Then Connect next to the new entry.

Done? “Connected” under the name, a small shield on the taskbar. Next time, one click on the VPN tile in Quick Settings. Not on Windows 11 SE, though: that edition has no such option.

Microsoft’s guide to connecting to a VPN in Windows walks through the fields.

Where it shines: work VPNs and self-hosted servers. With company credentials, or a server you run on a VPS, no third-party app is needed.

Administrators who reach office machines this way will find the connection side in our guide to accessing and connecting to Windows Server.

For personal privacy without a server, you need one of the five apps above. And we’d avoid PPTP when there’s a choice. Its encryption is outdated.

Is a free Windows VPN safe

Only when the provider is known, audited and open about how it makes money. The trustworthy ones fund their free tiers through paid plans.

Many other free VPN apps earn differently.

• They log and sell browsing data.
• They inject ads.
• They route other people’s traffic through your connection.

That sounds dramatic. It isn’t. Search “free VPN” in any app store. A large share of the results come from companies with no address, no audit and a privacy policy that says data “may be shared with partners”.

Some have been caught sending DNS queries outside the tunnel. The ISP still sees every domain you visit, while the app shows “Protected”. Privacy theatre.

Hola is the best-known example. Its free version used members’ devices as exit nodes for other users’ traffic. Whatever someone else did through that connection came from your IP address.

Red flags worth checking before you install any free VPN:

• No independent audit mentioned anywhere.
• A privacy policy that’s missing, vague, or permits sharing with “partners”.
• Requests for location, contacts or other permissions a VPN doesn’t need.
• No named company with a real address behind the app.
• Installers offered only through download portals, not on the provider’s site.

None of the five services on this page shows these warning signs. Hotspot Shield’s logging is disclosed. That’s why it’s listed with a warning and not left out.

Free vs paid: what you give up

Server choice, streaming, multiple devices and peak-hour speed. Free plans cover a handful of countries and usually one device.

For three jobs the free tier is enough.

• Protection on public Wi-Fi.
• Hiding your IP from your ISP.
• Getting past network blocks.

Our rule: stay on the free tier until you hit a limit that actually costs you something. On the road that rarely happens. For a household that streams, it happens in a week.

Checking that your free Windows VPN works

Run three tests with the VPN connected. The whole check takes about two minutes.

It’s worth doing even when the app says “Protected”. An unknown free app can send DNS straight to the ISP for weeks. Only a leak test shows it.

Proton and Windscribe run their own resolvers. Those are the only ones you should see in the DNS test.

If the WebRTC test shows your real IP, the browser is leaking it.

Run all three on your own Windows laptop, whichever app you picked. We’d repeat them after any big app update, too.

Which protocol to use

WireGuard by default. It’s faster, and it reconnects more reliably than OpenVPN on most networks.

Switch to OpenVPN over TCP port 443 when a network blocks VPN traffic. It looks like normal HTTPS.

When even that fails, use an obfuscation mode such as Windscribe Stealth. That happens on networks with deep packet inspection.

What a VPN doesn’t protect

A VPN encrypts traffic between your PC and the VPN server. It hides your IP from websites. That’s the whole job.

Windows sends diagnostic data to Microsoft whether or not a VPN runs.

DNS outside the VPN is the second gap. With the VPN off, queries go to your ISP’s resolvers. Our guide to changing DNS servers in Windows 10 shows how to set a public resolver. That cuts the exposure even when you’re not connected.

Then there are updates. No VPN patches a hole in Windows itself. If your hardware can run Windows 11, upgrading to Windows 11 matters more than any VPN choice.

For that move, our Windows 11 Pro key comes as a genuine license. We email it instantly after payment.

VPN apps don’t check whether Windows is activated, by the way. They install the same on any copy. Activation works separately, and our guide to free Windows 10 and 11 keys covers it.

Defender and a VPN

One doesn’t replace the other. Microsoft Defender is antivirus and firewall software. It scans files, blocks malware and filters connections on your PC.

A VPN encrypts the traffic leaving your PC and hides your IP from outside servers. Different problems. The two run happily side by side, and on a laptop that travels we’d want both.

They do meet in one place. After a fresh install or a large Windows update, Defender Firewall sometimes blocks VPN tunnel traffic. The VPN says “Connected”, and nothing loads.

1. Open Windows Security, then Firewall & network protection.
2. Click the link that lets an app through the firewall.
3. Find the VPN program.
4. Tick both Private and Public.

In a typical case, that’s the whole fix.

Fixing common free Windows VPN problems

Most problems come from four causes: a blocked protocol, a firewall rule, a broken network adapter driver, or a congested free server.

The VPN connects, and nothing loads

The kill switch has usually fired after an interruption. Or DNS broke. Switch protocol first.

• In Proton: Settings, Connection, Protocol, then OpenVPN TCP.
• In Windscribe: Stealth or OpenVPN TCP.

Still stuck? Check that Defender Firewall lets the app through on both network types.

Yellow triangle on the VPN adapter in Device Manager

A yellow warning on the TAP or WireGuard adapter points to a driver conflict. It often follows a switch between VPN apps. Or a Windows update that touched network drivers.

1. Press Win + X and open Device Manager.
2. Expand Network adapters.
3. Right-click the broken adapter and choose Uninstall device.
4. Reinstall the VPN from scratch.

Speed drops after a few minutes

That points to a crowded free server. It’s worst in the evening hours of the server’s region. Try another country if your plan lets you choose.

On Proton, wait out the cooldown and press Change server. On Hotspot Shield, we’d switch from Hydra to WireGuard before anything else.

Windows Update is slow with the VPN on

Update traffic goes through the tunnel by default. That eats free-tier data and speed.

On hide.me or Windscribe, exclude Windows Update from the tunnel with split tunneling. Otherwise, disconnect for large downloads and reconnect afterwards. Paid plans on bigger infrastructure rarely show this problem.

Two VPN apps running at once cause all four problems more often than anything else. Uninstall the one you no longer use. Just closing it isn’t enough, because its network adapter stays active.

Before you ask for help

• Note the app version and the protocol in use.
• Run the three leak tests and keep the results.
• Check whether a second VPN app is still installed.
• Try one other network, a phone hotspot for example. If plain Wi-Fi fails too, see WiFi problems on Windows 11.

Typical VPN problems on Windows

“Protected”, and leaking anyway

A free app from an unknown provider shows a green shield. The DNS leak test lists the ISP’s resolvers. Every domain had been visible the whole time.

Connected after the update, and no pages

A large Windows update finishes, and the VPN connects as usual. Nothing loads. Defender Firewall had dropped the app’s permission, and two ticked boxes bring it back.

Two VPNs, one adapter fight

Someone tries a second VPN and only closes the first. Both adapters stay active, and the connection drops every few minutes. With the old app uninstalled, the new one runs clean.

The hotel that blocked everything

WireGuard won’t connect on a hotel network. OpenVPN over TCP port 443 gets through, because it looks like normal HTTPS. Stealth mode would have been the next step.

Windows versions and apps this guide covers

The install, leak-test and troubleshooting steps apply to current Windows releases. The menu paths are the same on the versions below.