A VPN with no sign-up: how it can work without an account

A VPN can work without a sign-up because the only thing the service needs is a way to recognise your phone the next time it connects, and the phone can make that itself. The app generates a key in the phone's secure hardware, sends the public half to the server, and from then on proves it is the same device by signing each request. No email, no password, no form, and nothing for you to remember, because there is nothing to forget.

What a sign-up is actually for

An account in a VPN app does a handful of jobs, and it is worth separating them, because most can be done without one.

• Recognising the device. The service needs to tell one connection from another so it can count devices on a plan, apply free-tier limits fairly and cut off a connection that is being abused.
• Restoring something you paid for. If you buy a subscription and later change phones, the new phone needs a way to prove it is yours.
• Contacting you. Billing problems, a refund, a security notice.
• Marketing. Newsletters and win-back emails, which is the reason many apps ask early and insist.

Only the second and third need an identity that exists outside your phone. The first needs an identity, but not one that has anything to do with you as a person.

How the phone becomes the account

Android phones can keep cryptographic keys in hardware that the operating system, and even the app that created them, cannot read out. The app asks that hardware to create a key pair. The private half never leaves the chip; the public half is sent to the VPN's server, which stores it as the account.

From then on, when the app talks to the server, it signs the request with the private key, and the server checks the signature against the public key it has on file. That proves the request came from the same phone, in the way a password proves a request came from the same person, except that the key cannot be phished, reused on another site or leaked from a database, because nobody, including you, ever sees it.

Some phones can also produce a certificate from the manufacturer stating that the key lives in real hardware. A service can use that to tell a genuine phone from an emulator being used to mint thousands of fake free accounts, which is what makes a free tier viable without asking each user to identify themselves.

What this changes for the free tier

Fair-use limits on a free tier have to attach to something. Attaching them to an IP address does not work on mobile networks, where thousands of subscribers share one carrier address, so an address-based limit blocks strangers and is escaped by switching from Wi-Fi to mobile data. Attaching them to a device key works: one phone, one key, one free allowance. It also means the provider never learns your name, email or phone number just to give you the free tier.

What you give up

Be clear-eyed about the trade. If the phone is lost, wiped or replaced, the key goes with it. For a free account that costs you nothing; a fresh install creates a new one. For a paid subscription it matters, which is why a sensible app asks for an email only at the moment you buy, or offers a recovery phrase you write down. Why an account with no email needs a recovery phrase covers that design.

The other thing to be clear about: no sign-up does not mean invisible. The server still sees the IP address your phone connects from (it must, to send packets back), and any VPN keeps at least that for a while to deal with abuse. What a no-sign-up design removes is the link between that address and a name, email or payment record. It is a real privacy improvement, and a bounded one. What a VPN server is, and what it can see sets out the rest.

How to tell a real no-sign-up app from a delayed one

Some apps advertise "no sign-up" and then ask for an email on the second screen, or require an account to do anything beyond a short trial. The test is simple: install it, tap connect, and see whether you are connected before any form appears. If the free tier is genuinely account-free, you will be. If the first connect requires an email, "no sign-up" meant "sign-up later".

Also check what happens when you do want to pay. A design that asks for an email at purchase, and only then, is using the email for the one job it is needed for: restoring the subscription. A design that had your email all along was collecting it for something else. Can you use a VPN without giving an email address? goes through when an email is genuinely needed.

Where the honesty has to move to

Removing the account removes one place a provider could be careless with your identity. It does not remove the provider. What is recorded about the connection itself, and for how long, still belongs in the privacy policy, and a no-sign-up app with a vague policy has only moved the problem. Look for a short, specific list: what is kept, why, and the number of days.

Culvert VPN's free tier works this way (the account is created on the phone from a hardware-backed key with no email or card, the servers see only an opaque connection id, the service does not log the sites you visit, your DNS queries or your traffic contents, and it keeps your IP address for up to 30 days for abuse handling as described in its privacy policy), and it is on Google Play.