Proton VPN: the free tier is the actual product

You install the free tier on your mom's phone because she clicks things. It takes four minutes, there's no card involved, and she will never notice it running. That is the whole onboarding, and I've now done it on two phones in my family, a cracked screen protector and all. My mom's threat model is mostly her own thumbs, which a VPN does not touch, and I'll get to why I installed it anyway.

Proton VPN is the consumer VPN from the people behind Proton Mail, Proton AG in Geneva, running Proton Free, VPN Plus, and Proton Unlimited, the last of which bundles the whole suite. The free tier is the unusual part, so this post is mostly about that and about where the paid tiers are actually worth it.

the part everyone gets wrong

"Free VPN" is, as a category, mostly a data harvesting scheme wearing a costume. The economics don't work otherwise: bandwidth costs money, and if you're not paying, your DNS queries and app inventory are the merchandise. I tell juniors this at work and most of them already believe it, which is progress.

Proton's free tier is the exception because it isn't the product, it's the funnel. The company sells subscriptions to a large enough user base that giving away one device of medium-speed service in ten rotating countries costs them marketing budget instead of margin. That's a defensible business model, and it's the only shape of free VPN I'll put on a family phone. The catch is that everything interesting is paid: the kill switch, Secure Core, streaming, ten devices at once.

I want to be careful here, because a VPN still doesn't make anyone anonymous, and I don't want this read as "free tier acquired, problem solved." It moves ISP visibility to a Swiss company and little else.

the mechanics

The apps are open source and have been through external audits, and Proton publishes a transparency report that includes the legal requests they receive, which is the kind of paper trail I care about more than any landing page claim. The tunnel is WireGuard underneath, with their own client layer. NetShield, their DNS-level filter, blocks ads and known malware domains, and it works well enough that I run it on my mom's phone instead of a separate blocker.

Secure Core is the paid feature with a real architecture behind it: traffic enters through hardened servers in Switzerland, Sweden, or Iceland before exiting elsewhere, so the exit IP and the account you authenticated with sit in different jurisdictions and different providers. For the use case where someone might subpoena an exit node's logs, that layering matters more than speed claims about their accelerator.

Port forwarding support on Plus is the sleeper feature. NAT-PMP, supported in the apps, which means tunneling inbound connections for self-hosted stuff is possible without exposing your real IP. Mullvad removed port forwarding entirely in 2023, so if that's on your list, Proton is one of the few consumer options that kept it.

Swiss jurisdiction is the other pillar, and it cuts both ways. Switzerland's legal system reached Proton Mail in 2021, when court orders forced logging of a French activist's IP address, and Proton disclosed it afterward. That was the mail service, not the VPN, and the companies say VPN traffic sits under different Swiss obligations. Still, the lesson I take is that no jurisdiction is a wall, and Proton's transparency about the case is worth more than any "no logs" badge.

where it breaks

The account model means every Proton session is anchored to an email address, which is one identity more than Mullvad's account number design carries. Email is also the recovery path and the phishing surface. That's a genuine difference in attack surface, and it's the price of a product that wants to up-sell you a calendar.

The free tier's limits are real, not decorative. One device at a time, medium speed, and the country list rotates, so "the server in your city" is not a feature you own. Streaming services block free-tier exits hard, which is fine for me and disappointing for whoever installs it expecting Netflix.

Upsell friction is constant. The app treats the free tier as a advertisement for Proton Unlimited, and I understand the economics while still finding the prompts tiring. Full admission about that economics: I have run the free tier on my mom's phone for over two years and paid them nothing, and their cost to serve me is apparently my share of a marketing budget, which is a strange way to run a business and I'm grateful for it.

The other breakage is expectation mismatch. A VPN changes which network you exit from, and nothing else. My mom's phone had the same phishing problem the day after install as the day before, and the VPN was never going to fix that, because the problem was never on the wire.

what to do

1. Put the free tier on the devices nobody will pay for: parents, kids, an old tablet.
2. If you actually need streaming, port forwarding, or ten devices, VPN Plus is the tier; price out the annual before the monthly, it's meaningfully cheaper per month.
3. Turn on the kill switch the day you pay for it. The free tier doesn't ship it, and it's the difference between a dropped tunnel and a leak.
4. Enable NetShield everywhere, paid or not.
5. Read the transparency report once a year instead of trusting the landing page. Five minutes, and it's the only review that updates.

Her phone case is a pink folio with a cartoon cat on the clasp, bought in 2022, and the VPN has outlived two screen protectors on that device. The cat clasp is still fine.

If you pay for any tier, turn on the kill switch tonight.