Pick which apps run through the encrypted tunnel. Pick which apps stay on your regular network. Both happen at the same time. No paid tier required — most VPNs lock this behind one.
Your phone has one internet connection. Without split tunneling, ALL apps share it: either all through the VPN, or none. Split tunneling lets two parallel "lanes" exist on the same device.
Browser, social apps, messaging, etc.
Banking apps, local Chromecast, printer, etc.
Many banks geofence to your home country. Keep your bank outside the tunnel so it sees your normal IP, while everything else stays encrypted.
Chromecast, local printer, smart-home devices, NAS. They need to see your real LAN. Keep them direct.
Games where every ms counts can stay direct, while background apps (Discord, browser, system updates) tunnel through.
Only tunnel the apps where privacy matters. Stop the radio from doing extra crypto for app traffic you don't care about.
Force your most sensitive apps (password managers, personal email) through the tunnel. Let everything else decide for itself.
Some hotel WiFi captive portals break with a VPN. Keep the browser direct until you're past the login screen, then turn the tunnel back on.
The full list of your installed apps shows up, sorted alphabetically.
"Tunnel selected" = only these apps go through VPN (everything else direct). "Exclude selected" = everything goes through VPN except these (everything else tunneled). Pick the mental model that fits.
Apply. New traffic from each app routes according to your setup. Existing connections stay where they are until they reconnect.
| VPN | Split tunneling on free tier? | Per-app on Android? |
|---|---|---|
| 🤡 ClownVPN | ✓ Yes | ✓ Yes |
| ProtonVPN Free | ✗ Paid tier only | — |
| TunnelBear Free | ✗ Not offered at all | — |
| Windscribe Free | ✓ Yes | ✓ Yes |
| Hotspot Shield Free | ✗ Paid tier only | — |
| Hide.me Free | ✗ Paid tier only | — |
| Atlas VPN Free | ✗ Not offered | — |
Verified on each provider's pricing/features page in 2026. Windscribe and ClownVPN are the only options with genuine free-tier split tunneling on Android.
The kill switch covers your tunneled apps. Split tunneling decides who's "tunneled".
Tunneled apps inherit the no-log policy. Direct apps don't (they're not on our network at all).
Tunneled traffic uses WireGuard or OpenVPN. Direct traffic uses your normal stack.