Culvert VPNVPN and eSIM for travel: two different jobs
A travel eSIM gives your phone mobile data abroad; a VPN encrypts that data and any Wi-Fi you use. They do different jobs, and most travellers want both.
A travel eSIM and a VPN do different jobs. The eSIM is a mobile data plan you download instead of inserting a card, so your phone has internet abroad without roaming charges. The VPN encrypts whatever traffic your phone sends, over that eSIM or over hotel Wi-Fi, and hides your address from the sites you visit. One gets you online; the other decides who can see what you do once you are. Most travellers who think about either end up wanting both.
Side by side
| Travel eSIM | VPN | |
|---|---|---|
| What it provides | Mobile data in the country you are visiting | Encryption of your traffic and a different exit address |
| Replaces | Roaming on your home plan, or a local SIM card | Nothing; it runs on top of whatever connection you have |
| Works on Wi-Fi | No; it is a mobile connection | Yes, and on mobile data |
| Who sees your traffic | The eSIM's carrier, like any carrier | The VPN provider, after the carrier sees only an encrypted stream |
| Your IP address as sites see it | The carrier's, in the country you are in | The VPN server's, in whichever city you chose |
| Cost model | Data allowance for a period | Free tier or subscription |
| Needs the other one | No | No |
What the eSIM does
A travel eSIM is a carrier profile you install from a QR code or an app. Once activated, the phone attaches to a local network in the country you are visiting and uses the eSIM's data allowance instead of your home plan's roaming. It is cheaper than roaming, avoids the hunt for a SIM shop on arrival, and keeps your home number active for calls and texts on the physical SIM.
Its privacy properties are those of any mobile connection. The radio link to the tower is encrypted, and after that the carrier handles your traffic in the clear: it can see which sites you connect to, and the sites see an address belonging to that carrier in that country. The eSIM's carrier is also usually a reseller of a local network you have never heard of, so the party seeing your traffic is one you know very little about.
What the VPN does
A VPN encrypts everything the phone sends before it reaches the eSIM's carrier or the Wi-Fi network, and delivers it to a server in a city you choose. The carrier sees one encrypted stream to one address. The sites you visit see the VPN server's exit address. Using a VPN on mobile data covers how it behaves over a cellular link specifically, including what happens as the phone moves between towers.
The VPN does not provide data. With no eSIM, no local SIM and no Wi-Fi, a VPN has nothing to run over.
Why travellers want both
The eSIM removes the reason to use hotel and café Wi-Fi, which is good, because that Wi-Fi is the network most worth encrypting on. But a data allowance is finite, and most trips still involve Wi-Fi: the hotel for the evening's video, the airport lounge, the apartment rental. The VPN covers all of it, eSIM data and Wi-Fi alike, with one setting. Turn on Always-on VPN before you leave and every network you touch is treated the same way.
The VPN also solves a problem the eSIM creates. Your traffic now exits from a carrier in a country where you do not live, and some services react to that: a bank that challenges a login from an unfamiliar country, a site that shows the wrong language, a home service that behaves differently. Connecting the VPN to a server nearer home, or to a city you are used to, gives you a familiar exit address regardless of which eSIM you are on. How to choose a location is the guide to picking one.
Data use
A VPN adds a little to every packet: the encryption headers and, for some protocols, a wrapper. On a modern protocol that overhead is a few percent. A travel eSIM plan of a few gigabytes will not notice; a very small one might. If data is tight, the biggest saving is not turning the VPN off but leaving the app-store updates and cloud photo backups for Wi-Fi, which is true with or without a VPN.
One more setting matters here: Android's split tunnelling. If an app on the phone should stay on the eSIM's direct connection, such as one the VPN interferes with, it can be excluded from the tunnel rather than the whole VPN switched off. The rest of the phone stays protected.
Setting them up in the right order
- Install and test the eSIM before you travel, while you still have your home connection to fall back on.
- Install the VPN and connect once at home, so Android's connection request is already accepted.
- Turn on Always-on VPN for the app in Android's settings, so it comes back after every reboot and network change.
- Pick a server city, and check its measured latency from where you will be, when you arrive.
The travel checklist expands this into the full ten minutes.
Culvert VPN runs over an eSIM's data or any Wi-Fi alike, picks the connection method that works on each network automatically, and shows you the exit address you got, on Google Play.
Questions people also ask
Does a travel eSIM encrypt my traffic?
No. It is a mobile data plan. The connection between phone and tower is encrypted the way any mobile connection is, but the carrier and everything beyond it see your traffic as normal.
Does a VPN work over eSIM data?
Yes. The VPN does not care where the data comes from; it runs over the eSIM's connection exactly as it does over a home SIM or Wi-Fi.
Will a VPN use more of my eSIM data?
Slightly. Encryption adds a small overhead per packet, usually a few percent. On a metered travel plan it is noticeable only if the plan is very small.