VPN Kill Switch Explained: The Feature That Matters More Than Speed

The wifi icon in the corner of the screen blinks back to full bars in a hotel lobby before you even register that the connection dropped for a few seconds. Nothing visibly changed: the page you were on is still loading, the video call reconnected on its own. What you cannot see from the icon is whether your traffic spent those few seconds running unprotected over the hotel’s open network while the VPN quietly tried to reconnect behind the scenes. That gap, not the advertised connection speed, is the feature worth understanding before you actually need it. Most VPN marketing leads with server count and connection speed, both easy to compare on a spec sheet, while the setting that actually determines what happens during the one moment a public network fails sits two menus deep and is rarely mentioned at all.

What a Kill Switch Actually Does

A kill switch is a setting that blocks all internet traffic the instant the VPN connection drops, rather than letting the device fall back to an unprotected connection while it reconnects. Without one, a dropped VPN tunnel is invisible to most apps: they simply keep working, silently switching to the raw, unencrypted connection for however long the reconnection takes, which can be a few seconds or, on unstable public wifi, considerably longer. With a kill switch enabled, that same drop stops all traffic outright until the VPN tunnel is back up, trading a few seconds of no internet for zero seconds of exposed traffic.

Why This Matters More on Public Wifi Than at Home

A home network drops a VPN tunnel occasionally too, but the underlying connection is generally private and the risk of a stranger capturing that gap is low. Airport wifi, hotel networks, and coworking spaces are shared, often unencrypted at the network level, and are exactly the environment where a VPN is doing the most real work. That is also precisely where public networks are least stable, so the moment a kill switch matters most, an unreliable hotel router, is also the moment it is statistically most likely to be tested.

System-Level vs App-Level Kill Switches

Not all kill switches work the same way. A system-level kill switch blocks all traffic from the device the instant the VPN drops, covering every app and background process. An app-level kill switch only blocks traffic from specific apps you designate, which leaves everything else, background syncs, other browser tabs, notifications, exposed during the gap. For anyone handling client files, financial logins, or any confidential work over public networks, the system-level version is the one that actually closes the gap. An app-level switch protecting only one browser tab while a sync app leaks data in the background solves half the problem.

How to Actually Test Yours

Most people enable a kill switch once in a settings menu and never confirm it works. A simple test: connect to the VPN, start a continuous ping or a file download from a site that shows your IP address, then manually disable the wifi adapter or unplug the ethernet cable for a few seconds while watching whether the connection halts completely or keeps limping along on a fallback path. A kill switch that is enabled in settings but misconfigured, common on certain operating system and VPN client combinations, will not announce itself as broken. Running this test once, before a trip rather than during one, is the only way to know it works rather than assume it does. Set a recurring reminder to repeat the test after any major app update, since an update that changes default settings can silently reset a kill switch to off without any notification that it happened.

DNS Leaks Are a Related, Separate Problem

A kill switch handles a dropped tunnel. It does not automatically fix a DNS leak, where domain name lookups quietly route through your regular internet provider’s DNS servers instead of the VPN’s, even while the VPN connection itself is active and stable. This reveals which sites you are visiting even though the traffic content stays encrypted. Most reputable VPN providers, NordVPN included, route DNS requests through their own servers by default, but this is worth confirming with a DNS leak test site rather than assuming it based on the provider’s marketing claims. Run the DNS leak check from the same networks where the kill switch gets tested, since some public routers and captive-portal wifi setups are configured in ways that interfere with DNS routing specifically, independent of anything the VPN app itself is doing correctly.

What to Look for When Choosing a VPN for Travel

A kill switch alone is not a reason to pick one VPN over another; nearly every mainstream provider offers some version of it. The differentiator is whether it defaults to system-level protection, whether it has been independently tested rather than only self-reported, and whether the provider’s broader security stack, protocol choice, audited no-logs policy, server network, holds up around it. NordVPN (Europe) or NordVPN (US/Canada) (which link works best depends on the region you are in) includes a system-level kill switch across its desktop and mobile apps, which is the version worth confirming is active before relying on any public network for anything you would not want exposed.

Setting It as a Default, Not an Afterthought

The most reliable version of this feature is the one you never have to remember to turn on. Most VPN apps allow the kill switch to be set as a persistent default rather than a per-session toggle, so it is active automatically the next time the app launches, on the next trip, without depending on remembering to check a settings menu in an airport line. Set it once, test it once, and the feature does the rest of the work silently in the background exactly when a hotel router decides not to cooperate. The habit worth building is small: after installing a VPN on any new device, before the first real trip that device makes, open the settings menu once and confirm the kill switch specifically, rather than trusting the default install to have gotten it right.

Marko Jambrek

Licensed architect in Zagreb, 30 years of practice (sustainable design). Reviews and approves every article on this site before publication. Writes about AI tools through a lens of order and long-term value, tests before recommending.