Chromebooks support VPNs in three ways: Android apps from the Play Store, Linux container VPN clients (if Linux is enabled on the device), and the built-in VPN client for L2TP/IPsec and OpenVPN. Most users will find Android VPN apps the simplest path.
Android VPN Apps on Chromebook
If your Chromebook supports Android apps (most models from 2017 onward), you can install VPN apps directly from the Google Play Store. NordVPN, ExpressVPN, Surfshark, and Mullvad all have Android apps that work on Chromebook. The experience is nearly identical to using the VPN on an Android phone -- install, log in, connect. One limitation: Android VPN apps on Chromebook may not protect Linux container traffic, only the Chrome OS browser and Android apps.
Built-In Chrome OS VPN Client
Chrome OS has a built-in VPN client that supports L2TP/IPsec and OpenVPN (via a Chrome extension from VPN providers). This approach does not require an Android app. NordVPN, ExpressVPN, and Mullvad provide Chrome extension VPN clients. The Chrome extension approach typically protects all browser traffic but not Android app traffic unless configured otherwise.
Linux Container VPN
If you use the Linux (Crostini) container on your Chromebook, VPN clients installed in Linux (OpenVPN, WireGuard) only protect Linux traffic -- not Chrome OS or Android apps. For most users, this is too limited to be useful as the primary VPN method.
Which VPN Works Best on Chromebook
For simplicity: NordVPN or Surfshark Android apps -- both install from the Play Store, have reliable kill switches, and work without configuration. For privacy-focused users: Mullvad has both an Android app and OpenVPN configuration files for the Chrome OS built-in client. For school or work Chromebooks: the built-in L2TP/IPsec client is often the only option if the device is managed and Android apps are restricted by policy.