Culvert VPNWhich apps to exclude from your VPN
A practical list of apps worth excluding from a VPN on Android, from banking to local-network and carrier apps, and the ones to keep inside the tunnel.
Exclude an app from the VPN when it needs to see your real network: banking apps that treat an unfamiliar address as fraud, apps that talk to devices on your home Wi-Fi, carrier services such as Wi-Fi calling, and anything that must use the mobile network directly. Keep everything else inside. The exclude list should be short, because every app on it sends its traffic with your real address, in full view of whatever network you are on.
A working list
| App type | Why exclude it | What happens if you don't |
|---|---|---|
| Banking and payment apps | Fraud systems treat a login from an unexpected address as a risk signal | Extra verification steps, temporary blocks, or refusal to log in |
| Apps for home devices: printers, speakers, cameras, TV casting | They find devices by broadcasting on the local network, which the tunnel does not carry | "No devices found", casting that never starts |
| Carrier apps: Wi-Fi calling, visual voicemail, RCS setup | They authenticate against the carrier's own network | Wi-Fi calling drops, voicemail stops syncing |
| Navigation and ride-hailing | Some use the network address as a location hint alongside GPS | Odd default locations, pricing shown for the wrong region |
| Speed test apps | You want to measure the network, not the tunnel | Results measure the VPN route instead |
| Games with region-based matchmaking | A distant exit IP can put you in a distant lobby | Higher ping than necessary |
None of these is a rule. A banking app that works fine through the VPN can stay inside, and the more of them that do, the better, because banking is exactly the traffic you would rather the café Wi-Fi did not see. Online banking on public Wi-Fi weighs the two sides. Exclude an app when it actually misbehaves, not in advance.
What you give up for each one
Every excluded app runs as if the VPN were off. Its connections leave the phone with your real IP, the local network can see every server it talks to, and its DNS lookups go to the network's resolver rather than the VPN's. It is also outside Android's kill switch: Block connections without VPN only holds traffic that would have gone through the tunnel, so an excluded app keeps working, unprotected, when the VPN is down. Split tunnelling on Android has the full table.
That is the price, and it is why the list should be a list of exceptions, not a list of apps you are unsure about.
Apps to keep inside
- The browser. Most of what a VPN protects happens here.
- Messaging and email. The contents are usually encrypted already, but who you connect to and when is not, and that is what the local network sees.
- Social and news apps. Same reason.
- Anything you use on public Wi-Fi. The whole point.
- The VPN app itself. You cannot exclude it, and Android would not let you; its own connection to the server is handled outside the tunnel by the system.
Two that are not what they seem
Apps that feel slow through the VPN. Video and large downloads are the usual complaint. Slowness is almost always a distant or busy server rather than the tunnel itself, so pick a nearer city or a less loaded one before reaching for the exclude list. Excluding the app fixes the symptom by removing the protection.
Work apps. If your employer's app needs a corporate VPN, it needs that VPN, and Android runs only one VPN at a time. Excluding the work app from a personal VPN does not connect it to the corporate one. In that case the answer is to switch VPNs when you need work access, not to split.
Excluding versus disconnecting
For an app you use rarely, such as a bank you check once a week, it can be simpler to disconnect the VPN for a minute than to leave the app permanently outside. Disconnecting is a conscious act each time; an exclusion is a standing exposure you will forget about. Prefer the exclusion only for apps that fail every time, or that you use constantly.
Checking your list works
After saving the list, the VPN reconnects. Open an excluded app that shows a location or address, such as a weather app or a speed test, and confirm it reports your real network. Then open the browser and confirm it still shows the VPN's exit IP. If the browser shows your real address, the VPN is not connected, which is a different problem.
If you are on mobile data rather than Wi-Fi, the calculus changes slightly, because the carrier already sees your traffic whether or not you use the VPN for any given app; using a VPN on mobile data covers that. And if an excluded app still fails, DNS is the next thing to look at, because Android's Private DNS setting applies to excluded apps too.
Culvert VPN keeps an exclude list, so apps you add later are protected by default and the only apps outside the tunnel are the ones you chose, and it is on Google Play.
Questions people also ask
Should I exclude my browser?
Almost never. The browser is where most of the traffic worth protecting happens. If one website misbehaves through the VPN, switch location or disconnect for that visit rather than leaving the browser outside permanently.
Does excluding an app make the VPN faster?
Only for that app, and only if the slowness was the VPN's route rather than the app's own server. It does not speed up the tunnel for the apps still inside it.
Do I need to exclude apps to receive calls and texts?
Ordinary calls and SMS do not use the VPN at all. Wi-Fi calling and some carrier messaging features may, and if they fail with the VPN on, the carrier's app is the one to exclude.