What a Kill Switch Does
A VPN kill switch blocks all internet traffic if the VPN connection drops unexpectedly. Without a kill switch, a VPN disconnection causes your device to fall back to your regular internet connection -- your real IP address and unencrypted traffic become visible to your ISP and any network observer. This happens silently; most users have no idea their VPN dropped. A kill switch prevents this by cutting off the connection entirely until the VPN reconnects, rather than letting traffic leak through unprotected.
When VPN Connections Drop
VPN connections drop more often than most users realize: when switching between WiFi networks (home to mobile hotspot), when a device wakes from sleep, when the VPN server is temporarily unavailable, during network interruptions (brief WiFi dropout), and when switching between cellular and WiFi on mobile. Each of these events is a potential IP leak without a kill switch. If you use a VPN for privacy-sensitive activities (torrenting, journalism, accessing sensitive work systems), a kill switch is not optional.
App-Level vs. System-Level Kill Switch
App-level kill switch: blocks only the specific application's internet traffic when the VPN drops. Only the apps you specify (e.g., your BitTorrent client) are cut off. Other applications (browser, email) continue to work. This is less disruptive but less protective -- if you care about what your browser reveals during a VPN drop, an app-level kill switch does not help. System-level kill switch: blocks all internet traffic on the device when the VPN drops. Nothing gets through until the VPN reconnects. More protective, but can be disruptive if your VPN drops during a video call -- the call will disconnect rather than continuing unprotected. For most privacy-conscious users, a system-level kill switch is the right default.
VPN Kill Switch Implementations
Mullvad: one of the best implementations -- the kill switch is enabled by default and is highly reliable. Uses firewall rules at the OS level rather than just the application. Proton VPN: strong kill switch, works reliably across reconnect scenarios. ExpressVPN: good kill switch, called 'Network Lock.' NordVPN: reliable kill switch on desktop; the mobile implementation has historically been less consistent -- check current reviews. On iOS: iOS 14+ has a built-in 'Always On VPN' mode and kill switch functionality when combined with a VPN profile. Not all VPN apps expose this correctly -- Mullvad and Proton do.
Testing Your Kill Switch
To verify your kill switch works: connect to your VPN, visit ipleak.net to confirm your VPN IP is showing. Then manually disconnect the VPN (not through the app -- disable the network adapter or pull the ethernet cable). Immediately try to load a website. If the kill switch is working, the page will not load. Reconnect the VPN and verify your IP again. This test takes 2 minutes and is worth doing once when you set up a new VPN or after a major app update.