VPN on GrapheneOS: which one, how to set it up, and when it does not help
A VPN is not a cure-all. We compare Mullvad and ProtonVPN, explain the per-app VPN setting, and are honest about what a VPN does and does not do.
VPN on GrapheneOS: which one, how to set it up, and when it does not help
A VPN is often sold as the solution to everything. It is not. This article explains what a VPN actually does, which provider is worth it, and how to set it up on GrapheneOS.
What does a VPN do and not do?
A VPN encrypts your internet traffic between your phone and the VPN server, and hides your IP address from the websites you visit.
What a VPN does:
- Hide your IP address from websites
- Encrypt your traffic from your provider (or public networks)
- Mask your location (useful for geo-blocking)
What a VPN does not do:
- Make you anonymous if you are logged into accounts (Google, Facebook know who you are regardless)
- Protect you against malware or phishing
- Hide your traffic from the VPN provider itself — they see everything your provider would otherwise see
- Clear your cookies or browser fingerprint
A VPN shifts trust from your provider to the VPN provider. Make sure you trust that VPN provider more.
Mullvad vs ProtonVPN
Mullvad
Price: €5 per month, no subscription required, payable per credit unit (also by cash or Monero).
Strengths:
- No account required — you get a random account number
- No email address, no name, no personal data needed
- Externally audited and transparent about results
- Based in Sweden, strong privacy legislation
- WireGuard support as standard
Weaknesses:
- No free option
- Fewer servers than larger providers
Mullvad is the choice when anonymity at sign-up is a priority. You can pay for it without leaving a trail.
ProtonVPN
Price: Free (limited), paid from €4 per month.
Strengths:
- Free tier available (limited servers, no speed limit)
- Based in Switzerland, strict privacy legislation
- Open-source apps, externally audited
- Strong reputation via the Proton ecosystem (ProtonMail)
- More servers and countries than Mullvad
Weaknesses:
- Account required (email address needed, even for free)
- Free tier limited to three countries
ProtonVPN is the choice if you already have a Proton account or want a free starting point.
Avoid: NordVPN, Surfshark, ExpressVPN — aggressive marketing, unclear ownership structures, and a history of claims that do not hold up. Not recommended for privacy-conscious use.
Setting up WireGuard on GrapheneOS
GrapheneOS has built-in WireGuard support without an extra app. This is the most efficient method.
For Mullvad:
- Go to mullvad.net → Account → WireGuard configuration
- Generate a configuration file for Android
- On the phone: Settings → Network → VPN → WireGuard
- Import the configuration file
For ProtonVPN:
- Go to protonvpn.com → Downloads → WireGuard configuration
- Generate a configuration for your desired server
- Import using the same method
You can also use the official apps (available via sandboxed Google Play or direct APK), but the built-in WireGuard option is lighter and requires no extra app.
Per-app VPN: the most powerful feature
GrapheneOS lets you configure which apps go through the VPN and which do not. This is called “per-app VPN” or “split tunneling”.
Settings → Network → VPN → [your VPN] → Apps
Here you choose:
- All apps via VPN — default, most secure
- Only selected apps via VPN — useful if an app does not work well through VPN
- Selected apps bypass VPN — banking apps that detect VPN can connect directly this way
When do you turn off the VPN?
Turning on a VPN and forgetting it is tempting but not always smart.
Banking apps sometimes detect VPN use and refuse to start. Solve this via the per-app setting above — not by turning off the VPN entirely.
If a connection is slow, that is sometimes the VPN server. Switch servers before disabling the VPN.
The honest conclusion
A VPN is a useful layer in a broader privacy setup. It is not a replacement for a secure operating system, encrypted communications or good password management. On GrapheneOS, with a trustworthy provider like Mullvad or ProtonVPN, it adds real value.
Do not buy a VPN as your first privacy measure. Buy it as a supplement to a system that is already solid.