Public Wi-Fi
Café and hotel Wi-Fi can be patchy. If the tunnel drops mid-session, the kill switch is designed to stop your traffic carrying on unencrypted across a shared network.
Using a VPN on public Wi-FiLeak protection
VPN kill switch
Connections drop: a Wi-Fi signal fades, you move between networks, a server restarts. The kill switch is designed to stop traffic leaving your device until the encrypted tunnel is back, instead of quietly carrying on without it. It’s in the DarkMatter app for Windows; our other apps don’t have one.
- Designed to block traffic if the VPN tunnel becomes unavailable
- Helps keep your real IP address out of view during a drop
- Included on every plan, in the DarkMatter app for Windows
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
What it is
What is a VPN kill switch?
In short
A VPN kill switch is a safety net for your connection. It watches the encrypted tunnel between your device and the VPN server, and if that tunnel stops working it is designed to block internet traffic, rather than letting your device carry on over your normal, unprotected connection.
How it works
How a kill switch works
Your device usually has more than one way to reach the internet. A VPN adds a preferred route through the encrypted tunnel. A kill switch is designed to make that route the only one allowed while you’re protected.
- Encrypted VPN tunnel
- Normal connection, not encrypted by the VPN
- Traffic stopped
Read this diagram as text
Three rows. Row one, tunnel connected: your device sends traffic through the encrypted tunnel to a VPN server, and websites see the server’s IP address. Row two, the tunnel drops and there is no kill switch: your device falls back to its normal connection, which the VPN does not encrypt, and websites can see your real IP address. Row three, the tunnel drops and a kill switch is on: the kill switch is designed to stop traffic leaving your device, so nothing is sent until the tunnel returns. This shows how kill switches work in general; exact behaviour depends on the Windows app’s settings.
Three rows. Row one, tunnel connected: your device sends traffic through the encrypted tunnel to a VPN server, and websites see the server’s IP address. Row two, the tunnel drops and there is no kill switch: your device falls back to its normal connection, which the VPN does not encrypt, and websites can see your real IP address. Row three, the tunnel drops and a kill switch is on: the kill switch is designed to stop traffic leaving your device, so nothing is sent until the tunnel returns. This shows how kill switches work in general; exact behaviour depends on the Windows app’s settings.
You connect
Your traffic is routed through the encrypted tunnel to a VPN server, and websites see the server’s IP address instead of yours.The tunnel drops
A weak signal, a change of network or a server restart can interrupt the tunnel. Without a kill switch, most devices simply carry on over the normal connection.Traffic is held back
The kill switch is designed to block traffic while the tunnel is unavailable, so it doesn’t go out unencrypted with your real IP address.The tunnel is back
When the VPN is connected again, traffic flows through the tunnel as normal. A short pause is the kill switch doing its job.
The important detail is that a dropped VPN often goes unnoticed. Apps keep running, pages keep loading and nothing on screen tells you the protection has gone. A kill switch turns that silent failure into a visible one: things pause instead of leaking.
Kill switches generally work with firewall-style rules on your device that only let traffic out through the VPN connection.
Why it matters
Where it makes a difference
A drop matters most when you’re on a network you don’t control, or doing something you’d rather keep to yourself.
Online banking
Your bank’s website encrypts the page itself, but a drop could still send your traffic across the local network with your real IP address. A kill switch is designed to pause it instead.
VPNs and online bankingTravelling
Moving between airport, hotel and mobile networks is exactly when connections change. The kill switch is designed to cover the gaps in between.
Using a VPN while travellingWorking remotely
If you work from shared spaces, a kill switch is designed to stop work traffic spilling onto the café network while the tunnel reconnects.
VPNs for remote work
Side by side
How it compares
| No VPN | VPN without a kill switch | VPN with a kill switch | |
|---|---|---|---|
| While connected | Not encrypted by a VPN | Encrypted in the tunnel | Encrypted in the tunnel |
| If the tunnel drops | Nothing changes | Falls back to your normal connection | Designed to block traffic until the tunnel is back |
| Real IP address visible to sites | Yes | During the drop | Designed to stay hidden |
| What you notice | Nothing | Often nothing at all | A short pause |
This table describes how kill switches work in general. It isn’t a test of a particular device.
The honest bit: what it can’t do
- It protects against the tunnel failing. It doesn’t protect you from malware, phishing or an account that’s already compromised.
- While the tunnel is down, apps can look offline. That’s expected, and it clears when the tunnel is back.
- The kill switch is in the DarkMatter app for Windows. Check its settings there to see how it behaves on your PC.
- Sites you sign in to still know it’s you. A kill switch keeps your IP address out of view during a drop; it doesn’t make you untraceable.
Check it yourself
See the difference for yourself
Check the IP address websites see with the VPN off, then again while connected. The two should be different.
Kill Switch
Common questions
What does a VPN kill switch do?
It’s designed to block internet traffic if the encrypted VPN tunnel stops working, so your device doesn’t fall back to your normal connection and show websites your real IP address.
Why would a VPN connection drop?
Common causes include a weak Wi-Fi signal, moving between networks, a network that interferes with VPN traffic, or a VPN server restarting. Most drops are brief, and many happen with no warning on screen.
Will a kill switch stop my internet working?
Only while the tunnel is unavailable, when traffic is held back so it doesn’t leave unprotected. How it behaves when you disconnect the VPN on purpose depends on its settings in the DarkMatter app for Windows.
Which DarkMatter apps have the kill switch?
Only the DarkMatter app for Windows, where it’s included on every plan. Our other apps don’t have one.
Does a kill switch make me untraceable?
No. It helps keep your IP address out of view if the tunnel drops. Websites and accounts you sign in to still know who you are, and a VPN doesn’t remove tracking cookies.
How can I tell whether my VPN is working?
Open What is my IP with the VPN off, then again while connected. When it’s working, websites see a VPN server’s address rather than your own.
Included on every plan
Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
Related features
Last reviewed