The best VPN for Android is the one that passes a few simple checks right on your phone: it installs from a trustworthy place, finds a working route on your network by itself, asks for nothing extra and does not die in the background. A ranking will not show you that; your phone will, in an evening. Below are eight such checks and how Mayak does on each. We believe Mayak is the best choice for Android — and under every point we give a fact you can verify. Everything here is as of 4 October 2026.
In short. Check eight things: where the app installs from, whether it tries routes to the server by itself, whether it handles IPv6, how long it takes to connect, whether ping goes through the tunnel, which permissions it asks for, whether it holds up in the background and whether you can try it without a card. Mayak: Google Play and a file from the site, four connection attempts without your involvement, IPv6 as the first attempt, connection in about a second, no contacts or location, 3 free days after you confirm your email, no card.
We make Mayak, a private network with its own Android app. You can run every check below on the free trial without paying: that is more honest than any ranking.
🍎 On iPhone Mayak works with the subscription link from your account, in Happ or INCY (INCY is in the Russian App Store): where to tap on iPhone.
Eight checks on one page
| Check | How to check on Android | Mayak |
|---|---|---|
| 1. Install source | The Google Play page or a file on the service’s site | Google Play and a file from the site, version 0.7.40 |
| 2. Picks the route itself | Connect at home and on mobile data | Four attempts in turn; the route is shown on screen |
| 3. IPv6 | Is there an IPv6 setting and what does it do | IPv6 is the first attempt; IPv6 through the tunnel too |
| 4. Connect time | Time it from the button to a loaded page | A median of about a second in our log |
| 5. Ping through the tunnel | Ping from the app or a terminal | Goes through, replies are real; live ping under the button |
| 6. Permissions | The list on the store page and in phone settings | No contacts, messages, location or files |
| 7. Background and always-on | Leave the phone for an hour with the screen off | Spots a background restriction itself and leads to the right settings |
| 8. Sign-up and trial | What it asks before the first connection | An account number, email optional, a trial without a card |
General questions before paying — what the service lives on, what it stores, how to cancel — are collected in “How to choose a VPN”. Here: only what you can check on the Android phone itself.
1. Where it installs from, and whose signature
How to check. Open the Google Play page from a link on the service’s site and compare the developer’s name and website. If you install a file, take it only from the service’s own site. Details in “Downloading a VPN for Android: where it is safe”.
Mayak. The developer on Google Play is Mayak Networks, the site is mayaknetworks.com. The same app is on our home page in the “Download” section; as of 4 October 2026 both have version 0.7.40. The file is signed with our key, and the app checks the signature at every self-update: it will not install a substituted copy over itself.
2. Does the app pick the route itself
How to check. Connect at home on Wi-Fi, then turn Wi-Fi off and connect on mobile data. A good app comes up in both places without you touching any settings and tells you which route it is on. An app with a single route shows an endless “Connecting…” wherever that route does not get through.
Mayak. The app chooses the protocol and route, not you: four attempts in a row — directly to the new-style address (IPv6), directly to the usual address, through an entry point in Russia, and a fallback channel that looks like an ordinary secure web connection. In the seven days to 20 September 2026, of 1,171 connections that came up, 1,050 needed only the first two attempts, 95 came up on the fallback channel and 26 through Russia (how we counted). On a fallback route the status carries a “Backup” or “Via Russia” mark. And “Check connection” in the settings runs through every method by itself and tells you which one fails on your network. How it works — in a separate article.
3. IPv6
How to check. See whether the app’s settings have IPv6 and what the service’s help says about it.
Mayak. We support IPv6 from two sides. First, IPv6 is the first connection attempt: at some operators its road is both faster and less congested, and if it does not answer, the app moves to the usual address within a fraction of a second (why IPv6 goes first). Second, “Settings” → “Use IPv6” brings IPv6 through the tunnel where your carrier does not provide it; the “IPv6” icon on the main screen lights up only when it really works.
4. How long it takes to connect
How to check. Time it from pressing the button to a page loading in the browser. A “connected” icon is not the result yet: the result is a reply arriving from the internet.
Mayak. In our log the median is 1.09 seconds via the new-style address and 1.34 seconds via the usual one. Our stopwatch stops not at the icon but at a confirmed reply from the outside network. Why it occasionally takes eight or twenty seconds — broken down step by step.
5. Does ping go through the tunnel
How to check. Turn the connection on and ping an address that does not exist on the internet, for example 192.0.2.1: it is reserved for documentation. If a reply comes back, the app is answering pings itself, and its numbers cannot be trusted.
Mayak. Our tunnel is AmneziaWG; it carries any IP packet whole, including service pings (ICMP) and game UDP. We tested ourselves exactly that way: there was no reply from 192.0.2.1 through the tunnel, so replies from real addresses are real (the test). And the “Ping” number under the button in the app is a live response inside the secure connection; it updates by itself while the connection is up (why it differs from the per-country ping).
6. Which permissions it asks for
How to check. The permission list is visible on the Google Play page before installing and in phone settings afterwards. A secure connection needs neither contacts, nor messages, nor the call log, nor location.
Mayak. The app has no such permissions at all. It has internet, network state, start after reboot, notifications and the camera — needed by a single screen where you can point the phone at a code instead of typing. The site build can additionally install its own updates; the Google Play build does not have that permission.
7. Does it hold up in the background
How to check. Connect, turn the screen off and leave the phone for an hour. Most often “the VPN disconnects by itself” not because of the network but because Android put the app to sleep to save battery.
Mayak. The app notices when the system restricts its background work, says so in words and leads you to the right screen. Android’s always-on mode is reached from “Settings” → “Protection” → “No protection — no internet”: the button opens the system screen (step by step). There is auto-connect after a restart, a quick-settings tile to switch on with one tap, and when you move from Wi-Fi to mobile data the tunnel comes back up by itself. Other causes of drops — with numbers in a separate article.
8. What it asks before the first connection
How to check. Look at what the app demands before letting you connect: a phone number, an email, a card. The less, the better.
Mayak. The account is created right in the app: your login becomes a nine-digit number (like 472-918-563), and the app makes up the password itself. An email is optional but opens the full trial: 3 free days on two devices once it is confirmed, 1 day without it. We ask for no card for the trial. After that it is a subscription in roubles, by Russian card or SBP (plans in the help centre).
The best free VPN for Android: honestly
Free services exist, and they are paid for differently: with advertising, with data, or with having no fallback routes — there is nothing to keep them running on. That does not make them all bad; it means it is worth knowing what a service lives on (what paying does and does not buy). We have no free-forever plan: we live on subscriptions, with no advertising and no selling data. What is free is the trial, and all eight checks above fit into it.
What else the app has
- Russian apps direct. Banks, Gosuslugi and marketplaces can go outside the tunnel with the “RU Apps” preset, and any app of your own through “Split tunneling” (how to turn it on).
- Filtering. Ads and trackers, a kids’ mode or your own DNS server — one setting for the whole account (details).
- App lock with a fingerprint or PIN. Whoever gets hold of your unlocked phone will not see the account area or settings.
- Android TV — the same app, driven by the remote.
- Several devices on one subscription: “Start” — up to 3, “Family” — up to 5, “Max” — up to 10.
- Support from the app: a message to support is sent right from the app’s settings.
Run all eight checks on your own phone. Install the app and create an account right in it. We ask for no payment details for the trial. A confirmed email opens the access — 3 free days on two devices. An email is optional: without one the trial is 1 day.
What we checked
- Versions and the Google Play page — the version file and the store page, 4 October 2026.
- The four attempts and their shares — from the app’s code and our log for the seven days to 20 September 2026.
- Connect time — from the connection log, measured on 29 August 2026.
- Ping through the tunnel — over a real AmneziaWG tunnel on the night of 16 September 2026, checked against 192.0.2.1.
- Permissions — from the app’s Android manifest, 20 September 2026.
- Background behaviour — from the app’s strings and code, 20 September 2026.
What we do not know
- How other services work. We do not measure them and do not name them. Everything said about “a single route” describes a mechanism, not a specific app.
- How much battery the connection takes. Not measured on any model.
- What phone skins call the relevant items. Samsung, Xiaomi, Huawei and others differ; verified paths are in the articles on Samsung and Xiaomi.
- How your network will behave. Only you can see that — which is what the trial is for. If it does not work, tell us your operator, city and phone model.
Quick answers
Which VPN is best for Android? The one that passes the eight checks above on your phone and your network. We believe Mayak does — check it on the trial.
What is the best free VPN for Android? Free ones exist but live on ads, data or without fallback routes. With us the trial is free: 3 days after you confirm your email, no card.
Do I need to choose a protocol by hand? In Mayak, no: the app tries the routes itself and stays on the one that answered.
Does ping work through a VPN? Through an IP-level tunnel like our AmneziaWG, yes. Test an app by pinging 192.0.2.1: there should be no reply.
Why does the VPN on Android drop in my pocket? The phone puts the app to sleep to save battery. Lift the background restriction and turn on always-on.
Can I do without an email or phone number? Yes: the account lives on a nine-digit number. An email gets you the full 3-day trial and a way to recover access.