What a Kill Switch Does
When a VPN connection drops, most devices automatically fall back to their regular internet connection. Without a kill switch, this happens silently: you are browsing, your VPN disconnects for a second, and your traffic goes out unencrypted over your regular IP address before the VPN reconnects. You may not notice. Your ISP, anyone monitoring your network, and the sites you visit all see your real IP for that window.
A kill switch prevents this by cutting your internet connection entirely the moment the VPN tunnel drops. No fallback, no leaked traffic. Your connection stays offline until the VPN reconnects or you manually re-enable it.
App-Level vs System-Level Kill Switch
An app-level kill switch only blocks traffic for specific applications when the VPN drops. A system-level kill switch blocks all internet traffic on the device. System-level is more secure. Use app-level only if you have a specific reason to keep some traffic flowing outside the VPN (like local network access to a printer).
When the Kill Switch Matters Most
Kill switches matter most when your VPN connection is unreliable, such as on mobile networks that frequently hand off between towers, on public WiFi with unstable connections, or when using torrenting software where a real-IP leak would be significant. For everyday home browsing over a stable connection, the risk of a dropped VPN exposing data is lower but still real.
VPNs with the Best Kill Switch Implementations
NordVPN's kill switch has both app-level and system-level options and has been thoroughly tested. Mullvad's kill switch is always on by default and cannot be disabled, which is ideal for privacy-focused users. ProtonVPN's kill switch works reliably across platforms. ExpressVPN calls it Network Lock and it functions at the system level. Enable the kill switch in your VPN app's settings immediately after installation.