Best VPN for Android: ranked by app audits

Every “best VPN for Android” list ranks the same five or six apps by speed and battery numbers nobody outside the publisher can check. This one ranks them on what you can verify yourself, from your own phone: whether the Android app has an independent security audit, whether its source is public, and whether you can install it without the Play Store.

That standard produces a different order than our full VPN rankings. NordVPN tops that ranking on network size and audit streak — but those audits cover its no-logs claim and server infrastructure, not the Android app itself, and NordVPN has no F-Droid listing. Here it ranks fourth. If total server count matters more to you than what you can independently check on the app you’re actually installing, that overall ranking is the one to use instead.

The Android-verifiable picks, ranked — app facts as of 24 Jul 2026, prices as of 23 Jul 2026

VPN	Android app audit	Open source	Off-Play-Store install	Split tunnelling	Devices	Intro price
1. Mullvad	Leviathan Security Group, 2026 (MASA)	Yes	F-Droid, signed APK, GitHub	Yes	5	€5/mo flat
2. Proton VPN	SEC Consult, 2019 (source review)	Yes	F-Droid, GitHub APK	Paid plans only	10 (1 free)	$2.99/mo intro
3. Windscribe	Leviathan Security Group, 2022	Not confirmed	F-Droid	Not documented	Unlimited	$5.75/mo
4. NordVPN	None found	Not confirmed	No F-Droid listing	Yes	10	$3.49/mo intro
5. Surfshark	None found	Not confirmed	No F-Droid listing	Yes — Bypasser	Unlimited	$2.49/mo intro

“Not confirmed” means the provider makes no public claim either way on its own documentation — it isn’t proof the opposite is true.

Which Android VPN apps are actually audited

NordVPN and Surfshark are best known here for the Deloitte no-logs engagements that show up across this site’s other rankings. Read the fine print, though, and those engagements cover the no-logs claim and the server network — not the Android application. Neither company’s reachable documentation names an Android-app-specific audit.

Only three providers in this dataset can show one. Mullvad’s Android app passed a Mobile Application Security Assessment (MASA) from Leviathan Security Group, run against the App Defense Alliance’s Mobile App Profile — the second time the app has passed it. The report is dated 17 Feb 2026, published 1 Jun 2026, and covered app version 2026.2, with the fixes re-tested in version 2026.3-beta3. Six issues came up, four serious enough to require a fix: mutable PendingIntents made immutable, the login and password fields masked in the UI, a gap in the Play data-collection disclosure about how long purchase history was retained, and a missing in-app account-deletion option. Mullvad publishes the full report in its own repository.

Windscribe’s Android app was covered by an earlier Leviathan engagement, in March 2022 — the same review that covered its iOS app, not an Android-only assessment — with the report posted to the project’s GitHub wiki. Proton VPN’s audit is older still: SEC Consult ran a source-code review dated 15 Nov 2019 (the PDF is filed under a 2020 name, but the report itself carries the earlier date), finding one medium-risk and four low-risk issues that Proton says were fixed or accepted.

The Play Store’s own “Data safety” section looks like it should fill this gap. It can’t. Google’s policy for that label states plainly that the developer alone is responsible for what it declares, and nothing checks the accuracy before it publishes. It is a statement by the company about itself. An audit is the only item on this page that someone outside the company actually examined.

1. Mullvad — the deepest Android disclosure

Mullvad’s Android app is open source, published under the GPLv3 license, and ships three ways outside the Play Store: a signed APK from Mullvad’s own site, a GitHub release, and an F-Droid build. Combined with the 2026 audit detailed above, it has the most complete public record of any Android app on this list.

The trade-off is the one that shows up on every Mullvad ranking on this site: five simultaneous devices, no free tier, and a flat €5 a month — about $5.68 at the conversion its pricing page showed on 24 Jul 2026 — that never discounts, whatever the term length. Full detail in our Mullvad review.

2. Proton VPN — open source, with a real free device

Proton VPN publishes its Android source on GitHub under a GPLv3 license and offers two off-Play-Store install routes — F-Droid and a GitHub APK — one fewer than Mullvad’s three. Its Android audit, the 2019 SEC Consult source-code review, is the oldest of the three on this list.

The free plan is the pull: one device, no data cap, no card required. Paid plans raise that to 10 devices for an intro $2.99 a month, with the renewal math laid out in our Proton VPN review.

3. Windscribe — audited, on F-Droid, unlimited devices

Windscribe is the third provider here with an Android-specific audit — Leviathan’s March 2022 review — and its app is on F-Droid, linked directly from Windscribe’s own download page. Two things Windscribe does not state either way on its own pages: whether the Android source is public, and whether the app does split tunnelling. Neither silence is proof the feature is missing.

What Windscribe does put no limit on is device count: unlimited connections, even for free accounts, at $5.75 a month with no later renewal increase to plan for.

4. NordVPN — no Android audit, no F-Droid listing

NordVPN documents split tunnelling for Android directly: pick the apps you want left outside the tunnel. It covers 10 devices per account, priced from $3.49 a month on the 27-month intro plan. What it doesn’t have is a public Android-app audit or an F-Droid listing — the package returned a 404 on F-Droid’s site, checked 24 Jul 2026 — so if either matters to you, it’s the wrong pick here despite being the network’s biggest name.

5. Surfshark — unlimited devices, the same audit gap

Surfshark calls its Android split-tunnelling feature Bypasser and pairs it with unlimited simultaneous devices for $2.49 a month on its 27-month intro plan. Like NordVPN, it has no public Android-app audit and no F-Droid listing — also a 404, checked the same day. Unlimited devices is the strongest reason to choose it over NordVPN here; neither closes the audit gap.

Android’s own kill switch doesn’t need an app

Most Android VPN roundups describe a kill switch as something the app provides. Android has one built into the operating system itself, and it works whether or not the app you picked ships a good one.

The setting is called “Block connections without VPN.” Android’s own developer documentation describes the mode it triggers: the system “ensures that the service is always running and that the apps aren’t allowed to bypass the VPN.” Turn it on from Android’s own VPN settings — reachable from Settings on every Android phone, though the exact submenu differs by manufacturer skin — and no app gets network access unless the VPN tunnel is up. Google documents the same toggle for managed, work-profile devices as the ability to “block connections that don’t go through the VPN.”

It pairs with “Always-on VPN,” a separate setting that keeps your chosen VPN’s connection persisted across a reboot or an app update. The detail most reviews skip: Android’s documentation says apps support always-on by default. A developer has to deliberately opt out, not in — so the app you installed almost certainly already supports it, and the toggle just needs to be found and switched on.

Android setting	What it does
Always-on VPN	Keeps the VPN connection reconnected after a reboot or app update, with no action from the app itself required
Block connections without VPN	Blocks all network traffic unless the VPN tunnel is active — a kill switch built into Android, not the app

Neither setting replaces the kill switch a VPN app ships — the two can run together — but both exist independent of which app you choose. Our guide to VPN kill switches covers how the app-level version works and how to test it.

Split tunnelling: what each provider actually calls it

All five providers here support some form of split tunnelling on Android, but the names and restrictions differ enough to trip up anyone searching a settings menu for the wrong word. NordVPN and Mullvad both call it split tunnelling, plainly. Surfshark’s Android feature is named Bypasser. Proton VPN uses the plain term too, but restricts the feature to paid plans, offering a choice between excluding selected apps from the tunnel or routing only selected apps through it, plus support for CIDR IP ranges. Windscribe is the gap: its own documentation names no Android split-tunnelling feature at all.

The free plans that work on a phone

Two of the five have a permanent free tier, and they land on opposite sides of the trade-off that matters most on a phone: data versus devices. Proton VPN Free has no data or bandwidth cap at all, but only one device at a time and a server Android assigns randomly from 10 countries. Windscribe Free caps you at 10 GB a month with a confirmed email address (2 GB without one) but puts no limit on how many devices you connect.

Which one fits depends on how the phone actually gets used. A data cap matters more on a device that spends real time off Wi-Fi than on a laptop that mostly doesn’t; an uncapped single-device plan suits someone who only wants their phone covered, and a generous device limit suits a household protecting several phones on one free account. NordVPN and Surfshark skip a free tier entirely on Android — NordVPN offers only a 3-day trial, Android-only, and Surfshark’s trial requires a card on file. Full limits, audit records, and the six paid-only providers we track are in our free VPN rankings.

How we picked

Four things decided the order above, in weight order:

1. Android-app audit. Who audited it, when, and what they actually looked at — a source-code review, a mobile security assessment, and a penetration test answer different questions, so all three are named above rather than treated as one box to check.
2. Install route. An F-Droid listing, a signed APK, or a GitHub release count as routes that don’t require a Google account; the Play Store alone does not.
3. Open-source status. Confirmed only where a provider publishes its Android source — silence was not treated as a “no.”
4. Split tunnelling, devices, and price, from the same dataset used across this site, priced as of 23 Jul 2026.

Three providers this site tracks elsewhere — ExpressVPN, CyberGhost, and Private Internet Access — aren’t ranked here, because none of the three publishes an Android-app audit, an F-Droid listing, or an open-source claim for its Android app.

Who should skip these picks

• You need a Play Store-only install for a managed work device. Mullvad and Proton VPN’s off-Play-Store routes suit privacy-minded users, not MDM-managed phones that expect a standard Play Store package.
• You want a current audit of the whole service, not a 2019 code review. Proton VPN’s Android-specific audit is its oldest asset here. If audit recency across the whole company matters more than the app alone, our most private VPN ranking weighs infrastructure audits too.
• You need more than 5 devices without paying for unlimited. Mullvad tops this list but caps at 5; NordVPN’s 10, or Surfshark and Windscribe’s unlimited, fit larger households better.
• You specifically want ExpressVPN, CyberGhost, or PIA on Android. None of the three appear above, because none publishes an Android-app audit, an F-Droid listing, or an open-source claim for its Android app.

Android VPN questions, answered

Frequently asked questions

What's the best VPN for Android?

Mullvad, on the criteria this page uses: the newest Android-specific security audit here (Leviathan, 2026), an open-source app, and three ways to install it outside the Play Store. Our overall best VPN pick, NordVPN, has no Android-app audit and no F-Droid listing — see our full VPN rankings if network size and mainstream polish matter more to you than what you can verify on the app itself.

Is there a free VPN for Android that works well?

Two. Proton VPN Free has no data cap but limits you to one device and a randomly assigned server in one of 10 countries. Windscribe Free caps you at 10 GB a month (2 GB without a confirmed email) but allows unlimited devices. Neither NordVPN nor Surfshark offers a free Android plan.

Can I install a VPN on Android without the Google Play Store?

Yes, for three of the five providers here. Mullvad ships a signed APK, a GitHub release, and an F-Droid build. Proton VPN offers F-Droid and a GitHub APK. Windscribe is on F-Droid only. NordVPN and Surfshark have no F-Droid listing, so the Play Store or their own site's installer is the only route.

Does Android have a built-in kill switch?

Yes. Android's own VPN settings include a toggle called 'Block connections without VPN,' which stops all network traffic if the VPN drops — no app required. It runs alongside, not instead of, whatever kill switch a VPN app also ships.

What is Always-on VPN on Android?

A setting built into Android itself that keeps a VPN connection reconnected across a reboot or an app update. Android's developer documentation states that apps support it by default — a developer has to actively opt out, not in.

Which VPN apps for Android have actually been audited?

Three, as far as could be confirmed from primary sources: Mullvad (Leviathan Security Group, 2026), Windscribe (Leviathan, 2022), and Proton VPN (SEC Consult, 2019). NordVPN's and Surfshark's well-known no-logs audits cover their no-logs claim and server infrastructure, not the Android app itself.