Should you set up a VPN on Android with an app or by hand, and how does always-on VPN work?
Summary
Use the provider's app from Google Play if you subscribe to a consumer VPN, and add a profile by hand under Settings > Network & internet > VPN if your employer gave you server and sign-in details. That choice matters for always-on VPN: Google's help page says a manually added VPN has an Always-on VPN switch, while a VPN set up through an app won't show that option. Android runs one VPN per user at a time, so starting a second one stops the first.
App or manual profile
Google's Android help starts with getting your VPN information from your administrator, and says you might need to install a VPN app and start setup there. That app can come from Google Play or from the administrator.
The first time any VPN app goes live, Android shows a connection request dialog asking you to confirm that you trust the VPN. It looks like the permission prompts for the camera or contacts.
For a manual profile, open Settings, tap Network & internet, then VPN, tap Add in the top right, enter what your administrator gave you, and save. To connect, tap the VPN, enter your username and password, and tap Connect. A key icon appears at the top of the screen while you're connected. Google notes that some of these steps only work on Android 14 and up, and if your phone's menus don't match, it suggests searching Settings for "VPN."
Only one VPN runs at a time
Android's developer documentation says there's only one active VPN service per user or profile, and starting a new one automatically stops the existing one. If your work VPN dropped the moment you turned on a personal VPN app, that's why.
The exception is the work profile. Each user or work profile can run a different VPN app, and Google's help page describes making a VPN apply only to apps in your work profile.
Always-on VPN and blocking everything else
Always-on VPN arrived in Android 7.0. For a manually added VPN, tap the gear icon next to it and turn on Always-on VPN. If the connection stops working, Android keeps a notification on screen until you reconnect.
The stricter setting is Block connections without VPN. According to the developer documentation, the person using the device or an IT admin can force all traffic through the VPN, and the system blocks anything that doesn't use it. When you turn it on, Settings warns that you won't have an internet connection until the VPN connects. In effect it's a device-wide kill switch, which our kill switch article covers in more detail, including how companies enforce it.
To take a VPN off the phone, tap the gear icon and choose Forget. Turning the switch off only disconnects it.
VPN by Google on Pixel
If you have a Pixel 7 or newer phone, or a Pixel Tablet, look for VPN by Google on the same VPN settings screen. It costs nothing extra in the countries where it's offered, Japan among them. It doesn't change your IP location, so it won't get you into content that's blocked where you are. Other Android phones don't get it, and our Google VPN article covers the eligible devices and what traffic it leaves unprotected.
Sources
- https://support.google.com/android/answer/9089766?hl=en
- https://developer.android.com/develop/connectivity/vpn
- https://support.google.com/pixelphone/answer/2819573?hl=en
Related on this site
- Is Google's free VPN still around, and which phones can use it?
- What does a VPN kill switch actually stop when the connection drops?
- Where should you download a VPN app, and does a free download mean the VPN is free?
- What do you actually do to start using a VPN, from signing up to knowing it works?
- Business VPN pricing: what teams actually pay per user
Written by Kaz (pen name). Published September 28, 2026. The facts above come from the vendor and standards pages listed under Sources. We have not used these products. Corrections: contact form.