How to switch VPN providers without a gap in protection

To switch VPN providers safely, set up and test the new VPN before you cancel the old one. Then remove the old app and its leftover settings, turn on the new one's blocking or kill switch option, and run a leak test. Cancel the old subscription last, once the new one has passed.

The order is the whole trick. Most switching problems come from doing it the other way round: cancelling first, deleting the old app, and spending a day or two with nothing protecting the connection while the new one gets sorted out.

Why the order matters

When you switch, there are two ways to get it wrong. One is a gap: a period where you have no working VPN at all. The other is overlap: two VPNs installed and both trying to control the same connection, which can cause dropped connections, odd DNS behavior, or a status icon that says one thing while traffic does another.

The sequence below avoids both. You keep the old service paid for until the new one has proved itself, and you never have both running at the same time.

Step 1: Pick the new VPN and sign up

Choose before you change anything on your devices. The checklist at the end of this post covers what to look for. Sign up and download the new app on every device you plan to use, but do not connect yet.

If you are switching because a free VPN let you down, our post on whether free VPNs are safe explains what usually pays for them.

Step 2: Record what the old VPN shows

While the old VPN is still connected, open the Secria VPN leak test and note what it reports: your visible IP address, the DNS servers it sees, and whether WebRTC shows anything. Then disconnect and run it again, so you also know your real IP address and your internet provider's DNS servers.

This gives you a baseline. When you test the new VPN in step 5, you will know exactly which addresses must not appear.

Step 3: Disconnect the old VPN and switch off its always-on settings

Disconnect the old VPN in its app. Then check the system settings, because that is where the switch usually goes wrong.

Android. Android allows only one active VPN service per user or profile. Its developer documentation says that starting a new VPN service automatically stops the existing one. That sounds convenient, but there is a catch: Always-on VPN, and the Block connections without VPN switch that goes with it, are set per app. If they are still on for the old provider, Android keeps trying to bring the old VPN back. When an always-on VPN cannot connect, Android shows a notification that cannot be dismissed until you reconnect or turn always-on off.

To clear it, open Settings, then Network & internet, then VPN. Tap the settings icon next to the old VPN and turn Always-on VPN off. Google's Android VPN help has the same path.

iPhone and iPad. Go to Settings, then General, then VPN & Device Management. Make sure the old VPN is not connected and is not set to connect on demand. Any configuration profile the provider installed is listed on this screen too.

Mac. Open System Settings, then VPN. Turn the old service off, and if it has Connect on demand enabled, turn that off as well. Apple lists both options in its Mac VPN settings guide.

Windows. Disconnect in the old app and close it, including from the system tray, so it does not reconnect at startup.

Step 4: Connect the new VPN and turn on its blocking option

Open the new app, sign in and connect. Then look in its settings for a kill switch or a setting that blocks traffic when the VPN is down, and turn it on. Without it, a dropped connection sends traffic out over your normal connection until the VPN reconnects, and you will not notice.

On Android, you can also set this at the system level for the new app: in Settings, Network & internet, VPN, open the new VPN's settings and turn on Always-on VPN and Block connections without VPN. Android's documentation warns that with blocking on, you will have no internet before the VPN connects. That is the point.

Step 5: Test the new VPN for leaks

Run the leak test again with the new VPN connected and compare it with your notes from step 2.

Check	Pass	Fail
IP address	Belongs to the new VPN's server, in the country you picked	Your real address, or the old VPN's address
DNS servers	The new VPN's servers	Your internet provider's servers, or the old VPN's
WebRTC	No real or local address you recognize	Your real IP address appears
Blocking	Pages stop loading while you reconnect	Pages load with your real address during the drop

To test blocking, browse to any page and reconnect the VPN, or switch from Wi-Fi to mobile data, and reload while it reconnects. Our guide on how to tell if your VPN is working covers each test in detail, including how to run them from a terminal.

If the old VPN's address or DNS servers show up, the old one is still active somewhere. Go back to step 3 on that device.

Do this on every device, not just the first one. Phones are where leftover always-on settings tend to hide.

Step 6: Remove the old VPN completely

Once the new VPN passes on a device, uninstall the old app there. Then remove anything it left behind:

iPhone and iPad. In Settings, General, VPN & Device Management, remove the old provider's VPN entry and any profile it installed. Apple's profile guide notes that deleting a profile also deletes the settings that came with it.
Android. In Settings, Network & internet, VPN, open the old VPN's settings and tap Forget if it is still listed.
Mac. In System Settings, VPN, click the info button next to the old service and choose Remove configuration.
Windows. Uninstall from Settings, Apps, Installed apps, then check Settings, Network & internet, VPN to make sure the old connection is gone.

Restart, reconnect the new VPN and run the leak test once more. A clean result after a restart means nothing from the old provider is coming back at startup.

Step 7: Cancel the old subscription

Now cancel, in the place you paid: your Apple Account, Google Play, or the provider's website. If you are still inside a refund window, ask for one at the same time. Our guide on how to cancel a VPN subscription has the steps for each, the refund routes and their time limits, and how to ask the old provider to delete your account.

What to look for in the new VPN

You can check these on a provider's own pages before you pay.

Post-quantum key exchange. Encrypted traffic recorded today could be decrypted later by a large enough quantum computer. The defense is a post-quantum key exchange such as ML-KEM, which NIST published as the FIPS 203 standard in August 2024. The technology is now mainstream: Apple's VPN deployment guide says devices on iOS 26 and macOS 26 or later can be configured to run additional ML-KEM key exchanges for IKEv2. Ask whether the provider uses it on every connection or only as an option. Our post on whether WireGuard is quantum safe explains what the protocol does and does not cover on its own.

Servers that keep nothing on disk. RAM-only servers run without hard drives, so a reboot clears them. That limits what could ever be recovered from a seized or compromised server.

A logging policy with specifics. "We respect your privacy" is not a policy. Look for a statement that names what is not recorded: browsing, DNS queries, traffic contents. Then read the privacy policy and check it says the same thing.

A modern protocol. WireGuard and OpenVPN are the two you will see most. If you are unsure which to use, our WireGuard vs OpenVPN comparison covers speed, setup and security.

Blocking when the tunnel drops. Without a kill switch or an equivalent setting, step 4 has nothing to turn on.

And keep realistic expectations about what any VPN does. Our post on what a VPN hides explains what changes and what stays visible.

Switching to Secria VPN

Secria VPN uses post-quantum key exchange on every connection and runs on RAM-only servers. No activity logs: we do not record browsing, DNS queries or traffic contents. It is $7.99 a month, or included in Secria Pro at $9.99 a month with Secria Mail and VPN on 5 devices. The pricing page has the details. Follow the same seven steps, and run the leak test at the end.

FAQ

Can I run two VPNs at the same time? Not usefully. On Android, starting one VPN service stops the other. On other systems, two VPN apps can compete for the same routes and DNS settings. Disconnect the old one before connecting the new one.

Should I cancel my old VPN before or after installing the new one? After. Keep the old one until the new one has passed a leak test on every device, so you are never left without protection.

Do I need to uninstall the old VPN app? Yes, and also remove its system configuration. Leftover profiles and always-on settings can reconnect the old VPN or block your internet after its subscription ends.

Why does my Android phone keep showing a VPN notification after switching? Always-on VPN is probably still set on the old app. Open Settings, Network & internet, VPN, and turn Always-on VPN off for the old one, then turn it on for the new one.

How long does switching VPN providers take? About half an hour for a few devices, most of it testing. The part that takes longest is finding the old settings on each device.

New first, test, remove the old, cancel last. Done in that order, there is no moment where your traffic goes out unprotected.