How to Use a VPN: A Beginner's Guide for Every Device [2026]

Using a VPN takes about two minutes once you have an app installed: choose a provider, download the app, connect to a server, and you are done. What most guides skip is everything that comes after: the settings that actually matter, how to verify the connection is working, and how to set up a VPN on devices that do not support apps at all.

This guide covers the full setup process for iPhone, Android, Windows, Mac, smart TVs, Firestick, PS5, and Xbox, plus the post-install settings worth configuring before you browse. Internxt VPN is a Chrome extension that encrypts browser traffic and pairs with Internxt's encrypted cloud storage under one account, a lighter option for users who want browser-level protection without a system-level app.

How to use a VPN: the basics

These four steps work for any VPN provider on any device with an official app. Device-specific instructions follow in the sections below.

Step 1: Choose a provider

Look for a provider with an independently audited no-logs policy. This means a third-party security firm has verified that the provider does not store your browsing activity or connection logs. A self-declared no-logs claim with no audit behind it is a marketing statement, not a verified privacy guarantee.

Also check that the provider has apps for all the devices you use. Most mainstream providers cover Windows, Mac, iOS, and Android under a single subscription, with five to ten simultaneous connections depending on the plan. If you only need protection in your browser rather than across your whole device, a VPN extension for Chrome is a lighter alternative. Internxt VPN is one option in this category, available free from the Chrome Web Store with no system installation required.

Always download from your provider's official website or your device's official app store. On Windows and Mac, go to the provider's site directly. On iPhone, use the App Store. On Android, use the Play Store. Third-party sources for VPN software carry a real risk of modified or malicious builds.

Step 3: Connect to a server

Open the app, sign in, and tap or click Connect to turn the VPN on. Most apps connect you to the fastest available server automatically. Once connected, your internet traffic routes through the VPN via an encrypted tunnel and you browse normally, no change to how you search or use the web. If you need to appear in a specific country, for example to access a service from another country, open the server list and select that location before connecting.

Step 4: Check it worked

Once connected, take 30 seconds to confirm the VPN is active and not leaking. The Is your VPN actually working? section below has a three-step check that takes under a minute.

How to use a VPN on iPhone

The steps below apply to both iPhone and iPad. iOS and iPadOS use the same VPN configuration system, so the setup is identical on both devices.

Setting up a VPN app on iPhone

1. Open the App Store and search for your VPN provider by name.
2. Download and install the official app.
3. Open the app and sign in with your account credentials.
4. Tap Connect. iOS will prompt you to add a VPN configuration to your device. Tap Allow. The permission creates a secure tunnel and does not give the app access to your other data.
5. A VPN icon appears in the iPhone status bar when the connection is active.

To disconnect, open the app and tap Disconnect, or toggle off the VPN from Settings > VPN.

Using the Control Center shortcut

Once a VPN configuration is installed, you can connect and disconnect directly from Control Center without opening the app.

1. Go to Settings > Control Center.
2. Find VPN in the list and tap the green plus icon to add it.
3. Swipe down from the top-right corner of your screen to open Control Center and tap the VPN icon to toggle it.

Note: this shortcut toggles the most recently used VPN configuration. If you have multiple VPN configurations installed, manage them from Settings > VPN.

Enabling Always-On VPN on iOS

Always-On VPN ensures your connection is encrypted before any app sends data over the network, including in the background. On personal devices, enable it inside your VPN app's settings. Most providers label it Auto-connect or Always-On. Set it to activate on all networks, or on untrusted networks only if you want your home Wi-Fi excluded.

On devices managed through an MDM profile (company or school devices), Always-On VPN can be enforced at the system level by an IT administrator.

How to use a VPN on Android

Chromebooks running ChromeOS also support Android VPN apps through the Google Play Store, and the setup process is the same as on Android. Open the Play Store on your Chromebook, install your provider's app, sign in, and connect.

Setting up a VPN app on Android

1. Open the Play Store and search for your VPN provider.
2. Install the official app.
3. Open the app, sign in, and tap Connect.
4. Android will ask you to confirm the VPN connection. Tap OK.
5. A key icon in the status bar confirms the VPN is active.

To disconnect, open the app and tap Disconnect, or go to Settings > Network & Internet > VPN and toggle off the connection.

Using Android's system-level Always-On VPN

Android includes a built-in Always-On VPN feature that routes all device traffic through the VPN and cuts internet access if the VPN disconnects unexpectedly. It runs independently of the app and persists even if the app is force-stopped.

To enable it:

1. Go to Settings > Network & Internet > VPN.
2. Tap the gear icon next to your VPN configuration.
3. Enable Always-On VPN.
4. Optionally enable Block connections without VPN. With this on, your device will have no internet access until the VPN is connected, which is useful on public or corporate networks where unencrypted traffic is a risk.

This setting is available on Android 8 and later. The exact path varies slightly by manufacturer, but it is always within the VPN settings menu.

How to use a VPN on Windows (desktop or laptop)

Using your provider's Windows app (recommended)

1. Go to your VPN provider's website and download the Windows client.
2. Run the installer and follow the prompts. Windows may ask for permission to install a network driver; this is required for the VPN tunnel to function.
3. Open the app and sign in.
4. Click Connect. The app selects the fastest available server by default.
5. To connect to a specific country, open the server list and select it before clicking Connect.

Before using the VPN regularly, open the app's settings and enable the kill switch. This blocks your internet connection if the VPN drops, preventing unencrypted traffic from leaking through your regular connection in the gap before the VPN reconnects.

Using Windows built-in VPN (no app required)

Windows 10 and 11 include a native VPN client that supports IKEv2/IPsec and L2TP/IPsec connections without any third-party software. Use it if you cannot install applications on a work or school computer, if your employer has issued VPN credentials for a corporate network, or if you want a VPN connection that persists across user accounts on a shared machine.

To set it up, you need three things from your VPN provider or IT administrator: the server address, the protocol type, and your account credentials.

1. Go to Settings > Network & Internet > VPN.
2. Click Add a VPN connection.
3. Set VPN provider to Windows (built-in).
4. Enter a Connection name (any label you choose) and the Server name or address.
5. Set VPN type to IKEv2 if your provider supports it. IKEv2 is faster and more stable than L2TP. If unsure, check your provider's manual setup documentation.
6. Set Type of sign-in info to Username and password and enter your credentials.
7. Click Save.
8. Click Connect on the VPN settings page, or select the connection from the system tray network icon in the taskbar.

Once connected, the system tray network icon shows a shield indicator. To disconnect, click the network icon, select the VPN connection, and click Disconnect.

The Windows built-in client does not support WireGuard. For WireGuard connections on Windows without a provider app, download the official open-source WireGuard for Windows client and import a configuration file from your provider. The WireGuard vs OpenVPN breakdown covers how the two protocols differ and how to pick between them.

How to use a VPN on Mac (desktop or laptop)

Using your provider's Mac app (recommended)

1. Download the Mac client from your VPN provider's official website.
2. Open the downloaded .dmg file and drag the app to your Applications folder.
3. Launch the app from Applications or Spotlight.
4. Sign in with your account credentials.
5. Click Connect.

macOS will ask for your system password the first time the app installs a VPN configuration or network extension. It is a one-time prompt and does not grant the app ongoing elevated access.

Using macOS built-in VPN (manual setup)

macOS supports IKEv2, L2TP over IPsec, and Cisco IPsec natively through System Settings. As with the Windows built-in client, use it when you cannot install a third-party app: on a managed work Mac, a shared machine, or when connecting to a corporate VPN using credentials provided by your IT team.

Before starting, have the following ready: the server address, the VPN type your provider supports, your username and password, and if using L2TP, a pre-shared key or certificate from your provider or administrator.

1. Open System Settings > VPN.
2. Click Add VPN Configuration and select the protocol. IKEv2 is preferred where available.
3. Enter a Display Name of your choice.
4. Enter the Server Address and Remote ID as provided by your administrator or VPN provider. For IKEv2, the Remote ID is usually the same as the server address.
5. Under Authentication, enter your username and password. If your provider requires a certificate instead of a password, select Certificate and locate the file.
6. Click Connect.

macOS adds a VPN status indicator to the menu bar when the connection is active. To disconnect, click the indicator and select Disconnect, or return to System Settings > VPN and toggle it off.

The macOS built-in client does not support WireGuard or OpenVPN. For those protocols, use your provider's app, or install the official open-source client for each protocol separately.

How to use a VPN on a Smart TV, Firestick, PS5, or Xbox

Most major VPN providers publish apps directly on the Amazon Appstore and the Google Play Store for Android TV.

On a Firestick:

1. From the home screen, go to Find > Search and type your VPN provider's name.
2. Select the app from the results, then choose Get or Download.
3. Once installed, open the app, sign in, and tap Connect.

On Android TV (including Sony, TCL, and Philips smart TVs running Android TV or Google TV):

1. Open the Play Store from the TV's home screen.
2. Search for your VPN provider and install the app.
3. Sign in and connect.

How to use a VPN on PS5 (and Xbox)

Neither the PS5 nor the Xbox supports native VPN apps. Two methods work:

Router method (permanent): Install the VPN directly on your router. Every device connected to that network, including consoles, is automatically covered. Most VPN providers publish step-by-step guides for common router firmware including DD-WRT, Tomato, and OpenWrt. No setup is needed on the console itself.

Shared connection method (temporary): Connect your Windows PC or Mac to the VPN, then share that connection to the console.

On Windows:

1. Connect your PC to the VPN.
2. Go to Settings > Network & Internet > Mobile hotspot.
3. Set Share my Internet connection from to the VPN adapter and turn on the hotspot.
4. On the PS5 or Xbox, go to network settings and connect to the PC hotspot as you would any Wi-Fi network.

On Mac:

1. Connect your Mac to the VPN.
2. Go to System Settings > General > Sharing > Internet Sharing.
3. Share your VPN connection via Wi-Fi or Ethernet to the console.

Roku and Apple TV

Neither Roku nor Apple TV supports native VPN apps, so the approach is the same as for game consoles: use a router-level VPN or share a VPN connection from a computer.

Roku: Roku does not allow sideloading or third-party apps outside its own store, and no major VPN provider has a Roku app. The only reliable option is installing the VPN on your router so all traffic from the Roku passes through it, or creating a Wi-Fi hotspot on a VPN-connected computer and connecting the Roku to that hotspot instead of your regular network.

Apple TV (4th gen and later): Apple TV supports a native L2TP configuration under Settings > Network > Wi-Fi > Configure DNS, but the setup requires manual credentials from your provider and is limited to protocols Apple TV natively supports. For WireGuard or OpenVPN, the router method is more practical. On Apple TV 4K (2022) and later running tvOS 17+, you can install VPN apps directly if your provider has published one to the App Store. Check your provider's tvOS support page before choosing a method.

Router-level VPN setup (covers all devices at once)

Installing a VPN on your router is the only practical option for devices that do not support apps: smart TVs on non-Android platforms, game consoles, and other network-connected devices.

The setup process depends on your router model and firmware. Most VPN providers document the steps for popular firmware versions. The main consideration is that all devices on the network share the same VPN server and connection capacity. To run some devices on the VPN and others off it, you either need two routers or a split-routing configuration in your firmware.

How to get more out of your VPN

Most people connect and never open the settings again. These five options are worth configuring before you start browsing.

Kill switch

A kill switch blocks your device's internet access if the VPN connection drops unexpectedly. Without it, your traffic routes unencrypted through your regular connection for however long it takes the VPN to reconnect. Usually that is seconds, but enough to expose your real IP address and activity.

Enable the kill switch in your VPN app's settings. It is usually labeled Kill Switch, Network Lock, or Internet Kill Switch depending on the provider. On Android you can also enable it at the system level through Settings > Network & Internet > VPN (see the Android section above).

DNS leak protection

When you connect to a website, your device first sends a DNS query to look up the site's IP address. Without DNS leak protection, these queries can bypass the VPN tunnel and go directly to your ISP's DNS servers, revealing which sites you visit even when the VPN is active.

Enable DNS leak protection in your app's settings, then run the DNS leak test in the verification section below to confirm it is working.

Split tunneling

Split tunneling routes only specified apps or destinations through the VPN, while everything else uses your regular connection. Use it when you need VPN protection for some activity but your banking app, streaming service, or local network device blocks or performs poorly over VPN.

Most desktop VPN apps and Android apps support split tunneling. Due to iOS system restrictions, per-app split tunneling is not available for third-party VPN apps on iPhone. Browser-based VPN extensions protect only the traffic inside that browser by nature, so split tunneling is not a relevant setting for extension-based VPNs.

How to change your location with a VPN

To use a VPN from another country, open your VPN app's server list and select the country you want to appear to be in. The VPN replaces your visible IP address with the server's, so websites and services see the server's location instead of yours. This works whether you are at home accessing content from another region or travelling and connecting back to a server in your home country. Fully hiding your IP address also involves checking for DNS and WebRTC leaks, which the verification section below covers.

Not all VPN providers work reliably with streaming services that actively detect and block VPN connections. Check your provider's documentation for confirmed streaming support before assuming it will work.

Auto-connect on untrusted networks

Most VPN apps include an option to connect automatically when you join a network that is not on your trusted list. Enable it in your app's settings under Auto-connect, Trusted networks, or Network protection depending on your provider. Set your home Wi-Fi as trusted so the VPN does not run unnecessarily at home, but activates automatically on airport, hotel, cafe, and any other unfamiliar network.

If your concern is connecting before any app or service sends data, for example on a corporate network that logs traffic from the moment you join, the system-level Always-On settings on Android and iOS are more reliable than the app-level auto-connect. Always-On VPN at the OS level blocks all network traffic until the VPN tunnel is established, so nothing leaves the device unencrypted during the window between joining the network and the app opening. The Android and iOS sections above cover how to enable this.

On Windows and Mac, the app-level auto-connect is the only native option short of a third-party network management tool. For most uses the practical difference is small, as a modern VPN app connects in under two seconds. If traffic-before-VPN is a hard requirement, Android or iOS with Always-On enabled at the system level is the more complete solution.

Is your VPN actually working?

Run this three-step check immediately after connecting to confirm the VPN is active and not leaking data.

IP address check: Visit ipleak.net or whatismyipaddress.com. The location shown should match your chosen VPN server, not your real location. If it shows your real IP, the VPN is not connected.

DNS leak test: On ipleak.net or at dnsleaktest.com, run a standard test. All DNS servers listed in the results should belong to your VPN provider. If your ISP's DNS servers appear, DNS leak protection needs to be enabled in your app settings.

Kill switch test: With the VPN connected, disconnect it manually while loading a webpage. The page should stop loading immediately. If it continues loading, the kill switch is either not enabled or not functioning. Check your app settings.

If any of these checks fail, enable DNS leak protection and the kill switch in your app settings and run the full test sequence again.

Frequently Asked Questions

How to use a VPN for beginners?

Install your VPN provider's app from the official app store, sign in, and tap Connect. The app handles all technical configuration automatically, and a status indicator in the app and your device's menu bar confirms when the connection is active.

How to use a VPN for free?

Most reputable providers offer a free tier with data or server restrictions, or a paid plan with a 30-day money-back guarantee. Proton VPN's free tier has no data cap but limits connections to servers in three countries. Completely free VPNs with no paid option typically cover their costs through data collection, which works against the reason most people use a VPN in the first place.

How can I use a VPN without installing software?

Both Windows and macOS include native VPN clients that connect using IKEv2 or L2TP without any third-party app. The Windows built-in VPN and macOS built-in VPN sections above walk through the process step by step. Particularly useful on work or school computers where installing new software requires administrator approval.

Does a VPN change my IP address?

Yes. When you connect, your traffic routes through the VPN server and websites see that server's IP address and location rather than yours. Your real IP address is not visible to the sites you visit while the VPN is active.

Can my ISP see my browsing history if I use a VPN?

A VPN encrypts your traffic between your device and the VPN server, so your ISP can see that you are connected to a VPN but cannot see which sites you visit or what you do on them. The VPN provider itself can see your traffic, which is why an audited no-logs policy matters.

Which VPN has an independently audited no-logs policy?

Several providers have completed third-party audits: Mullvad was audited by Cure53 in 2022 and 2023; ProtonVPN was audited by Securitum in 2022; Internxt VPN was audited by Securitum in 2024/2025. Note that Internxt VPN is a Chrome browser extension rather than a system-level app, so it protects browser traffic only.

One more layer worth adding

A VPN covers your connection. For a complete privacy setup, the other question is where your files live and who can access them. Secure cloud storage built on zero-knowledge encryption means files are encrypted before they leave your device. The storage provider cannot read them even if compelled to. That is the same principle that makes a no-logs VPN worth using in the first place.