What a Kill Switch Does
When a VPN connection drops unexpectedly, your device typically falls back to your regular internet connection. This means your real IP address is briefly exposed. A kill switch detects the VPN dropout and immediately blocks all internet traffic until the VPN reconnects. From an outside perspective, you simply go offline rather than revealing your real IP.
When You Need It
A kill switch matters most when your privacy is genuinely at stake: torrenting, journalist work, activists in restrictive countries, or anyone connecting to sensitive resources. For casual privacy users who just want to avoid tracking, a VPN dropout for a few seconds is usually not catastrophic. But if your use case requires consistent anonymity, a kill switch is not optional.
System-Level vs App-Level Kill Switch
An app-level kill switch blocks traffic only from a specific application when the VPN drops. A system-level kill switch blocks all internet traffic across your entire device. For most purposes, system-level is the correct choice. App-level kill switches miss traffic from other applications that may run in the background.
Best Implementations
Mullvad has one of the best kill switch implementations: it activates immediately and blocks at the OS firewall level, not just within the VPN application. NordVPN and ExpressVPN also offer solid kill switches. Check that the kill switch is enabled by default or activate it manually after installation.