Culvert VPNWhat is a VPN, and what does it actually do?
A VPN sends your traffic through an encrypted connection to a server elsewhere, so the network cannot read it and websites see the server's address, not yours.
Plain answers about VPNs on Android
Straight answers to the questions people ask about VPNs: what they hide, why they slow down, how to use one on hotel and campus Wi-Fi, and how Android's own settings fit in. 123 guides, grouped by the question they answer, each written to be read in under five minutes.
VPN basics
What a VPN is, what it hides, and what it does not.
How a VPN works, step by step
A VPN app takes over your phone's network path, encrypts every packet, and sends it to a server that forwards it to the internet under its own address.
What a VPN hides, and what it does not
A VPN hides your IP address from websites and your traffic from the Wi-Fi and your ISP. It does not hide your accounts, cookies or the fact you use a VPN.
Does a VPN hide your IP address?
Yes. With a VPN on, websites and apps see the VPN server's address instead of yours. Here is who can still see your real IP, and the leaks to check for.
What an exit IP is, and why the app shows you yours
The exit IP is the address websites see when your VPN is on: the server's, not yours. Here is what it tells you and why an app should verify it.
Does a VPN make you anonymous?
No. A VPN hides your IP from websites and your traffic from the network, but accounts, cookies, device identifiers and the provider still know you.
Free VPNs and no sign-up
How a free tier can be honest, and how to tell when it is not.
Is a free VPN safe? How to tell in five minutes
A free VPN can be safe when you can see how it is funded, what data it collects and which permissions it asks for. Here is how to check in five minutes.
How free VPNs make money, and which ways should worry you
Free VPNs are paid for by a premium tier, by ads, by selling browsing data or by renting out your connection. Here is how to tell which one you are using.
A VPN with no sign-up: how it can work without an account
A VPN can work with no sign-up because your phone can create its own account from a hardware key. Here is how that works and what it changes for you.
Can you use a VPN without giving an email address?
Yes. A VPN needs an email only when there is something to restore, such as a paid subscription. A free tier can run entirely from a key on your phone.
Which permissions a VPN app actually needs on Android
A VPN app on Android needs the system VPN permission, network access and notifications. It does not need contacts, SMS, location, camera or storage.
Why free VPNs limit data or time
Free VPNs limit data or time because bandwidth is the cost that grows with use. Here is what each kind of limit means for you and which shape is fairer.
Privacy: who sees what
Your ISP, the Wi-Fi owner, your employer, and the VPN itself.
What your ISP can see when you use a VPN
With a VPN on, your ISP sees one encrypted stream to one server and how much data flows, but not the sites you visit, your DNS lookups or page contents.
What the Wi-Fi owner can see, with and without a VPN
Without a VPN the Wi-Fi owner sees every site name you visit; with one they see one encrypted stream to one server, plus your device's name and data use.
Can your employer or school see your traffic through a VPN?
A VPN hides site names and contents from the work or campus network, but a managed device or one with a corporate certificate can be inspected regardless.
VPN logs explained: what "logs" can mean and what to ask
Connection logs, usage logs and aggregate counters are three different things with different risks. How to tell them apart and what to ask a provider.
What a seized VPN server can reveal about you
A seized VPN server reveals only what the provider stored on it. Done well, that is live connection state and opaque ids, not names or browsing history.
If HTTPS already encrypts, why use a VPN?
HTTPS encrypts the page but shows the network the site's name, your IP and your DNS lookups. A VPN covers those, and every app that is not a browser.
Public and restrictive Wi-Fi
Hotels, campuses, cafés and offices, and the networks that filter.
Public Wi-Fi risks in plain English
Public Wi-Fi is run by someone else and shared with strangers. Here is what that actually exposes, what HTTPS already covers, and where a VPN helps.
Using a VPN on hotel Wi-Fi: what goes wrong and what to do
Hotel Wi-Fi puts a sign-in page in front of everything and often filters ports. Here is why a VPN struggles there, and the order to fix it in.
VPN on university and campus Wi-Fi
Campus Wi-Fi is a managed network that often filters ports and sometimes blocks VPN protocols. What the university can see, and how a VPN connects there.
Using a VPN on office Wi-Fi
Office Wi-Fi is monitored, filtered and covered by a policy you signed. What IT can see, when a personal VPN is appropriate, and how it connects there.
Airport and café Wi-Fi: is a VPN enough?
A VPN covers most of what airport and café Wi-Fi exposes, but not the sign-in page, a fake hotspot or a phishing screen. What it does and does not do.
Why the VPN won't connect until you accept the Wi-Fi terms
A captive portal holds all traffic until its sign-in page is accepted, so no VPN can connect first. How to get the page to load, even with Always-on VPN.
Speed, battery and reliability
Why a VPN is slow, why it drops, and what actually fixes it.
Does a VPN slow down your internet?
A VPN usually adds a little latency and costs some throughput; how much depends on server distance, server load and which protocol gets through.
Why your VPN is slow, and what actually fixes it
A slow VPN is usually a distant or busy server, a network forcing a slower transport, or weak Wi-Fi underneath; here is how to tell which and fix it.
Ping vs speed: what a fast VPN really means
Latency is how long a packet takes to get there and back; bandwidth is how much you can move per second. A VPN affects each differently.
Why the nearest VPN server is not always the quickest
The closest VPN server on a map can be slower than one further away, because internet routes, peering and server load matter more than kilometres.
What VPN server load is, and why it matters as much as distance
Server load is how close a VPN server is to its limits on sessions, processor and bandwidth; a busy nearby server often loses to a quiet distant one.
Does a VPN drain your phone battery?
A VPN uses some battery for encryption and keepalives, typically a small share of the day with WireGuard; distant servers and reconnects make it worse.
Android how-tos
Always-on, the built-in kill switch, split tunnelling and battery settings.
How to set up a VPN on Android in two minutes
Install a VPN app from Google Play, tap connect, accept Android's one-time connection request and check the exit IP. Full steps for Android 8 and up.
Always-on VPN on Android: what it does and how to turn it on
Always-on VPN makes Android start your VPN at boot and restart it whenever it stops. What it changes, where the toggle is and when to add the block.
"Block connections without VPN": Android's built-in kill switch
Block connections without VPN stops every app reaching the internet unless the VPN is up. What it blocks, how to turn it on and its side effects.
VPN kill switch on Android: why the OS should own it
Only the Android system can stop traffic leaving outside a VPN tunnel, so the real kill switch is Always-on VPN's block. Why in-app switches fall short.
Split tunnelling on Android: keep some apps outside the VPN
Split tunnelling lets chosen apps skip the VPN on Android. How it works per app, why an exclude list beats an allow list, and what an excluded app sees.
Which apps to exclude from your VPN
A practical list of apps worth excluding from a VPN on Android, from banking to local-network and carrier apps, and the ones to keep inside the tunnel.
Protocols and the technology
WireGuard, TLS on port 443, IKEv2, MTU, DNS and IPv6.
VPN protocols explained: WireGuard, OpenVPN and IKEv2
A VPN protocol is the set of rules that builds the encrypted tunnel. How WireGuard, OpenVPN and IKEv2 differ in speed, size and getting through.
What WireGuard is, and why modern VPNs use it
WireGuard is a small, fast VPN protocol with fixed modern cryptography, a one-round-trip handshake and built-in roaming. How it works and its limits.
WireGuard vs OpenVPN on a phone
WireGuard is quicker, lighter on battery and roams without reconnecting; OpenVPN can run over TCP 443 where UDP is filtered. Which wins on a phone.
WireGuard vs IKEv2: reconnects, roaming and battery
WireGuard and IKEv2 both roam between networks and are light on battery. They differ in ports, handshake weight and how easily a network filters them.
UDP vs TCP for a VPN: speed versus getting through
UDP is the right transport for a VPN because it avoids stacked retransmission; TCP is the one that connects where UDP is filtered. The trade explained.
A VPN inside TLS on port 443: how it works and when you need it
Wrapping a VPN tunnel in TLS on TCP port 443 makes it look like HTTPS, so it connects on networks that filter ports or protocols. How, and what it costs.
Testing and troubleshooting
How to check a VPN is working, and what to do when it is not.
How to check your VPN is working
Compare the IP address a website sees before and after you connect; if it changes to the server's address and DNS follows, the VPN is working.
How to test for an IP leak
An IP leak means a site sees your real address while the VPN is on. Compare IPv4 and IPv6 with the VPN off and on, then again after a reconnect.
How to run a DNS leak test on Android
A DNS leak test shows which resolver answered your lookups while the VPN was on; if it belongs to your carrier or ISP instead of the VPN, DNS is leaking.
WebRTC leaks: what they are, and whether Android apps are affected
A WebRTC leak is a browser handing your real IP to a web page while a VPN is on; mainly a desktop problem, and Android apps with no browser are unaffected.
VPN not connecting on Android: a checklist
A VPN that will not connect on Android usually has no internet underneath, a filtering network, a revoked permission or a wrong clock; check in that order.
"Authentication failed" and other VPN errors, decoded
On a VPN app with no password, "authentication failed" almost always means an expired session or a wrong phone clock. Fix the time and reconnect first.
Server locations
Every city we serve: latency, who it suits, and whether it is free.
Netherlands VPN server in Amsterdam, and what to expect from it
Culvert VPN's Netherlands server is in Amsterdam and is on the free tier. Here is the latency to expect from nearby countries and who it suits.
Germany VPN servers in Saarbrücken and Limburg
Culvert VPN has two German cities, Saarbrücken on the free tier and Limburg on Premium. Latency from nearby regions, who they suit, and how the app picks.
France VPN servers in Roubaix and Lauterbourg
Culvert VPN's French servers are in Roubaix and Lauterbourg, both on the free tier. What latency to expect from nearby regions and who they suit.
UK VPN server in London, and what latency to expect
Culvert VPN's UK location is London, on the Premium tier. Expected round trips from Britain, Ireland and western Europe, and who a London server suits.
USA VPN server in Saint Louis, and why the middle of the country
Culvert VPN's US location is Saint Louis, Missouri, on Premium. Why a central city, expected round trips from across North America, and who it suits.
Canada VPN server in Montreal
Culvert VPN's Canadian location is Montreal, a Premium city. Expected round trips from Canada and the US north-east, and who it suits.
Comparisons
VPN against proxy, Tor, Private DNS, antivirus and eSIM.
VPN vs proxy: what is the difference?
A proxy forwards one app's traffic and usually leaves it unencrypted; a VPN carries every app on the phone in one encrypted tunnel. When each fits.
VPN vs Tor: which one do you actually need?
Tor routes traffic through three volunteer relays for anonymity at a heavy cost in speed; a VPN encrypts everything to one server you trust.
VPN vs Private DNS: what each one actually encrypts
Android's Private DNS encrypts only name lookups; a VPN encrypts all your traffic. What each one hides, and how the two interact when both are on.
VPN vs antivirus: which protects against what
Antivirus inspects files and apps on the phone; a VPN protects the network path to the internet. Neither replaces the other. Here is the split.
VPN and eSIM for travel: two different jobs
A travel eSIM gives your phone mobile data abroad; a VPN encrypts that data and any Wi-Fi you use. They do different jobs, and most travellers want both.
VPN for travel: a ten-minute checklist
Set up your VPN before you leave, turn on Always-on, pick a nearby server and know what to do on hotel Wi-Fi. A ten-minute checklist for Android.