Which VPN works in Russia right now — and why that is not a question about the service

The question expects a name in reply: tell me the app that works right now. The honest answer is an unpleasant one — there is no such name, and that is not modesty. Working is not a property of a service; it is the outcome of three things meeting: the app, your network and this hour. Below — why that is so, the one sign that still tells services apart, which paths our own connections come up on, and where we fall short.

Why no list of “which VPN works right now” can exist

Such lists do get written, and they are pleasant to read: ten names, ticks, “tested”. The trouble is that it was tested at the author’s place — on his home connection, in his city, on the day he sat down to write. You have a different provider, a different mobile operator, a different hour and a different phone; and “works” is not a label on an app but the outcome of one attempt in one network.

We see this from our own write-ups rather than from reasoning: three kinds of network behave differently, and one of them does not interfere at all; mobile operators interfere in different ways, so “it does not work for me” and “it does not work for my neighbour” are often two different faults with the same look on screen. That is why the answer “this one works” holds for exactly one person and exactly one day.

And the second half, which is worth saying about ourselves out loud. We do not measure other services and we do not write rankings. A list put together by someone who is selling inside that list is worth exactly what its first place is worth — and that is visible in advance, without any testing. What we can actually do is explain the mechanism by which some connections survive a change in the network and others do not, and show our numbers as they are.

What actually breaks: one path against several

Any app of this kind connects through a chain of three things: a way of wrapping traffic, a port and a server address. As long as the network between the phone and that address lets such connections through, everything works. Once it stops, the app goes silent entirely.

If a service has one such chain, it has exactly two states. Works — does not work, with nothing in between, and the switch happens for all of its users at once, because their path is shared. Hence the familiar “it stopped working for everybody today”: not a coincidence and not a rumour, but a direct consequence of how it is built.

A spare path is not a setting — it is a separate household. Another address, an entry point inside the country, a channel of a different kind: each of them means more servers, more traffic and more repair work, every month. That is why spare paths are far from universal: they do not fit into the economics of a service that takes no money. What a service lives on and what money actually buys is taken apart point by point in a separate article; we do not repeat it here.

The main difference: it switches, or you do

Spare paths do exist in services with a single protocol too — usually as a list of servers: did not go through, pick another; still nothing, pick a third. That works, but it moves the labour onto the person, and it does so at the worst possible minute: right then he has no internet with which to read an instruction or to ask anyone.

So the sign worth judging by is this: does the app walk that list for you instead of you. It is checkable in a single attempt and before paying: if after a failure the app showed an error and stopped, the list is yours to walk; if it went on by itself and then told you what it finally connected on, it walked the list for you.

With us this is a ladder of four attempts in a row, and the phone walks it itself, asking nothing:

1. Straight to the server of the chosen country over a new-style address. Not every network has one — how it differs from the ordinary kind is a separate piece.
2. Straight to the same server over the ordinary address.
3. Through an entry point inside Russia. From there traffic goes to the same server in the same country, and the encryption stays end-to-end.
4. A fallback channel — it looks like an ordinary secure web connection.

Which path worked, the app spells out on screen. On the main screen it is a short badge next to the button — “Direct · IPv4”, “Direct · IPv6”, “Via Russia” or “Backup”; in the connection details the path is named in full — “Direct”, “Direct over IPv6”, “Via Russia”, “Backup channel”. That is not decoration: a person who can see what he is connected on can tell “all is well here” from “I am holding on by the last rung” — and write to us before everything goes quiet for good. How the ladder is built inside and how the app decides that a path is alive — in a separate article.

The full set of signs by which an app can be judged before you install it — what it asks of the phone, where it is installed from, who answers when it breaks — is collected in a neighbouring article; here we take apart one sign only, but the main one.

Which paths our people connect on: numbers from our own journal

A story about a ladder is worth exactly as much as the numbers under it. Here are ours, for the seven days to 20 September 2026. This is neither a survey nor advertising: the app itself reports which rung it came up on, and we count those records.

The table reads like this. Nine connections out of ten (1050 of 1171, 89.7%) were served by the first two attempts — that is, by the direct path. Spare paths were needed by one in ten: 95 times the fallback channel and 26 times the entry point inside Russia. This is the answer to “which one works right now” in the only form in which the question has an answer at all: for most people the simplest path works, and for a minority there would have been nothing to connect with at all. The ladder exists for that minority — for everyone else it simply never came into play.

The curious part is the first two rows. The ordinary address worked more often than the new-style one (648 against 402), even though the phone tries the new one first. The journal does not record the reason, and we are not inventing one; the simplest explanation is that part of those networks have no new-style address at all — but that is our guess, not our measurement.

Where we honestly fall short

The section such articles usually do without, and wrongly: without it the previous one reads as a promise, and a promise is something we cannot give.

294 records where no rung worked. In the same seven days to 20 September 2026 the journal holds exactly that many — against 1171 connections that came up, which makes it one record in five of all 1465. We neither pass this off as “our failure rate” nor hide it: the journal records the outcome, not the cause. Those 294 include a phone in the underground with no signal, mobile data switched off, and a mistake of our own — the journal cannot tell them apart. Such reports also reach us later than the rest: on a total failure there is nothing to send them over, so the app holds them back until a connection appears.

Networks that let only some things out. There are networks — mobile, corporate and guest alike — in which only a few permitted addresses are let out at all. A ladder does not save you there: you can try paths for as long as you like if none of them leaves the network. How that looks on mobile internet — in a separate write-up.

A weak signal. One or two bars produce exactly the same picture on screen as a network that stopped letting things through; we measured that separately, and the app cannot tell one from the other.

And the main thing we do not promise. That it will work always and for everyone. Every rung lives exactly as long as it is let through, and no number of attempts makes a connection guaranteed. We keep no list of “where it works”: we do not count connections by city or provider, and we will not print a guess dressed up as a measurement.

How to check it in one evening, instead of trusting a list

The question “which one works” becomes checkable once it is asked differently: does this one work — for me. That one gets an answer in one evening and without paying.

1. Check on each of your networks separately. Home internet, mobile, the office Wi-Fi and the café one — these are four different answers, and they are under no obligation to agree.
2. Repeat in the evening. In the busy hours the picture changes — and on mobile internet it changes more than on a home connection.
3. Look at which rung it came up on. First or second means your network lets the direct path through, which is the calmest arrangement. The fallback channel means the direct path does not get there, but the connection exists anyway — that is not a fault, that is exactly the case the ladder is for.
4. Check that the protection really came on. Did the address change, is traffic flowing, are name lookups leaking past the tunnel — four checks, step by step; they are the same for any app, not only ours.

If nothing connects at all — not a single app — the trouble is usually not the choice of service: Android gives such a connection a single slot, and a forgotten app may be holding it. The three reasons why none of them works we took apart separately — start there, otherwise you will keep changing services while the cause stays put.

What we checked

• Four attempts — from the app’s code, not from its description. On 20 September 2026 we read the file of our app where the rungs are listed: there are exactly four, in the same order as described above.
• The on-screen names come from the app’s own strings. The badge on the main screen (“Direct · IPv4”, “Direct · IPv6”, “Via Russia”, “Backup”) and the full path names in the connection details (“Direct”, “Direct over IPv6”, “Via Russia”, “Backup channel”) — those are the very strings the interface uses, read on the same day, not a retelling. They are different strings and we do not merge them: the main screen shows the short badge.
• The rung numbers come from our own connection journal. For the seven days to 20 September 2026: 1171 connections that came up — 402 on the new-style address, 648 on the ordinary one, 26 through the entry point inside Russia, 95 on the fallback channel; and separately 294 records where no rung worked. The shares are taken of 1171; the share of “none” is taken of all 1465 records.
• What the “none worked” line means. We checked it against the code that writes it: it means “none of them delivered”, not “the app did not report”. The difference matters, and we did not want to be wrong in the direction that suits us.
• That such reports arrive later. The app keeps a separate on-disk queue for reports it could not send at once; it exists precisely because on a total failure the journal used to lose exactly the total failures. Read on 20 September 2026.

What we do not know

We try to make sure nothing more can be concluded from our text than is actually in it.

• Why the ordinary address worked more often than the new one. The journal writes the outcome, not the cause. “Part of those networks simply have no new-style address” looks like the most plausible explanation, but we have no measurement behind it.
• What exactly lies behind those 294 records. Whether the phone had any network at all, the journal does not know — so neither do we.
• How other services are built. We do not measure them, keep no rankings and name no names. Everything said about “one path” is a description of a mechanism, not a claim about any particular app: some of them may well have spare paths.
• How this looks by city, provider or operator. We do not count connections in that cut and we draw no “where it works” maps. We do have write-ups on individual operators, but they are about the mechanism of the fault, not about a success rate.
• How long the present arrangement will hold. The numbers above are a snapshot of one week. In a month the shares will be different, and we do not know in which direction.
• Whether it will work for you specifically. That depends on your network and can only be checked on your own device — which is what the trial is for.

Short answers

Which VPN works in Russia right now? No name is right for everyone: what decides is your network and this hour, not the name of the app. The only sign that means anything is whether the app has several ways of connecting and walks through them itself.

Which VPN works for free? We have no free-forever plan — there is a trial of 7 days after you confirm your email, with no card. Why free ones fall away more often is taken apart point by point.

Why did they all stop working at once? Because a service with a single path has exactly two states, and the switch between them is shared by all of its users. What to do if yours stopped working — separately.

It works for my friend and not for me — why? Most likely you are on different networks: home internet, mobile and someone else’s Wi-Fi behave differently, and the same setting gives a different outcome in each.

What is going on with VPNs today? For the country as a whole we do not know and cannot know. We only know about ourselves: which rungs our people connect on is in the table above, and we refresh those numbers by measurement, not by impression.

Which VPN works on a phone? The one you checked on your own network before paying. The signs by which an app can be judged before installing, and the phone settings that break any secure connection, are in the Android article.

None of them works — what do I do? Start not by choosing a new one but with the three reasons that silence all of them at once: they are taken apart in order.

What does it cost with you? Prices, ways to pay from Russia, terms, and what happens if the money left but the access did not appear — in a separate article: we say nothing about money here, so as not to retell half of it.

Do you promise it will work for me? No. We promise four attempts instead of one, honest numbers and a free way to check — not a result.