Does Your VPN's Kill Switch Actually Work?
We monitor your IP in real-time. Disconnect your VPN to see if your real IP is exposed during the gap.
How to Test Your Kill Switch
Live Event Log
What Is a VPN Kill Switch?
A kill switch is a safety mechanism that blocks all internet traffic the moment your VPN connection drops. Without one, your device does exactly what it was designed to do when a route disappears: it falls back to the ordinary connection and carries on as though nothing happened. Downloads continue, apps keep syncing, pages keep loading - all of it now over your real IP address.
The exposure window is short but it is not harmless. VPN reconnections happen routinely: switching between Wi-Fi and mobile data, waking a laptop from sleep, a server restarting on the provider’s side. Each of those events produces a few seconds during which your traffic is unprotected, and background applications will happily use them. A single request is enough to link your real address to whatever you were doing.
The problem with kill switches is that they are unfalsifiable until tested. A checkbox in the settings panel proves that the feature exists, not that it fires. This page measures the behaviour directly rather than trusting the checkbox.
How to Read Your Results
The monitor polls your visible IP address every two seconds while you deliberately disconnect the VPN. There are three possible outcomes.
| What happens after you disconnect | Verdict |
|---|---|
| Checks stop returning any result - the connection is dead | Kill switch works |
| Your IP changes to your real ISP address | Kill switch failed - traffic leaked |
| IP changes briefly, then checks stop | Slow kill switch - measurable exposure window |
A working kill switch looks like a broken internet connection, and that is precisely the point. The third outcome is the one worth paying attention to: a kill switch that reacts in two seconds instead of instantly still leaked every request your device made during those two seconds. The event log above records the exact timestamps, so you can see how wide the window was.
Application-Level vs System-Level Kill Switches
Not all kill switches protect the same things, and the distinction matters more than most providers explain.
- Application-level: closes or blocks a list of chosen applications when the tunnel drops. Everything not on the list keeps running unprotected - including your browser, if you forgot to add it.
- System-level (firewall-based): installs firewall rules that permit traffic only through the VPN interface. Nothing reaches the internet outside the tunnel, regardless of which application tries. This is the version worth having.
- Always-on / lockdown mode: the strictest variant, blocking traffic even before the VPN connects, so there is no exposure at boot. Android calls this “Block connections without VPN”; several desktop clients label it lockdown mode.
If your provider does not state which kind it implements, this test will tell you: disconnect while a download is running in a non-listed application. A system-level switch stops it; an application-level one does not notice.
What to Do If Your Kill Switch Fails
- Check it is actually enabled. Many clients ship with the kill switch off by default, and updates occasionally reset it. This is the explanation in most cases.
- Enable lockdown or always-on mode if your client offers it, so protection covers boot and reconnection as well as drops.
- Switch protocol to WireGuard. Faster reconnection means a smaller window even when the switch reacts imperfectly.
- Use the operating system’s own control - Android’s “Block connections without VPN” is enforced by the OS and does not depend on the client behaving correctly.
- Consider a firewall rule. On desktop you can restrict outbound traffic to the VPN interface directly, which is the most reliable arrangement available and independent of your provider entirely.
Once the kill switch passes, verify the tunnel itself is clean with our full IP leak test - a perfect kill switch protects nothing if the connection leaks while it is up.
🧰 Related VPN Tools
Every test runs entirely in your browser - nothing is stored unless you choose to share the result.
VPN Kill Switch Test - FAQ
What a kill switch does, how to prove yours works, and what to do when it does not.
How do I test my VPN kill switch?
Start the monitor above, then disconnect your VPN while it runs. The monitor polls your visible IP every two seconds. If the checks stop returning results, the kill switch blocked your traffic and is working. If your real IP appears in the log instead, traffic escaped and the kill switch failed.
Is a kill switch really necessary?
It matters more than most people assume, because VPN connections drop routinely - switching networks, waking from sleep, or a server restarting on the provider’s side. Each drop creates seconds of unprotected traffic that background applications will use immediately. If your reason for running a VPN would be undermined by a few seconds of exposure, then yes, it is necessary.
Why did my internet stop working during the test?
That is the correct outcome. A working kill switch blocks all traffic when the tunnel drops, which is indistinguishable from an outage. Reconnect the VPN and connectivity returns. If your connection kept working normally after disconnecting, the kill switch did not fire.
What is the difference between a kill switch and always-on VPN?
A kill switch reacts to a drop: it blocks traffic once the tunnel fails. Always-on mode is preventive: it blocks traffic whenever the VPN is not connected, including during boot and before the client starts. Always-on covers the startup gap that a plain kill switch leaves open, and where both are available, enabling both is the right configuration.
How fast should a kill switch react?
Ideally instantly, because a firewall-based implementation blocks traffic at the moment the interface goes down rather than after detecting it. Reaction times of one to two seconds indicate a polling-based design, which leaks every request made during that interval. The event log above timestamps each check so you can measure your own window.
Does a kill switch protect against DNS leaks?
No - these are separate problems. A kill switch handles what happens when the tunnel fails; a DNS leak happens while the tunnel is working perfectly. You need both checks to pass. Run our DNS leak test alongside this one for the complete picture.
My VPN has no kill switch. What are my options?
On Android, enable “Block connections without VPN” in the system VPN settings - it is enforced by the operating system and works with any client. On desktop, configure your firewall to allow outbound traffic only on the VPN interface. Both approaches are more reliable than a client-side switch, since neither depends on your provider’s software behaving correctly.
Should I re-test after updating my VPN client?
Yes. Kill switches depend on firewall and routing rules that get rewritten during updates, and the setting itself is sometimes reset to its default. This is one of the most common silent regressions in VPN software, and the test takes under a minute - worth repeating after every client update or OS upgrade.