Free VPN Chrome Extensions: Which Are Safe, and Which Harvest Your Data (2026)

Two free VPN extensions for Chrome are safe enough to recommend: Proton VPN's and Windscribe's. Both come from named companies, both declare that they collect only sign-in information, and both are run by providers whose paid plans fund the free tier. Avoid Urban VPN Proxy, which a security firm reported in December 2025 had been capturing users' AI chatbot conversations, and think hard before installing any free extension whose listing admits to collecting your web history.

There is a bigger caveat: a VPN extension protects only the browser it lives in. If you want your whole computer covered, a desktop app does that job, and an extension is a companion to it rather than a replacement. Every listing detail below was read from the Chrome Web Store on 9 October 2026.

The short answer: which free extensions are safe

Our view, ranked by what each listing and its documented history show:

• Use: Proton VPN (Proton AG, Switzerland; declares sign-in data only; its free tier works in the extension) and Windscribe (Windscribe Limited, Canada; declares sign-in data only; free plan of 10GB a month with a confirmed email).
• Caution: VeePN, Planet VPN, Touch VPN, Browsec and Hotspot Shield. None has a documented data incident we could source, but each falls short on at least one point: a missing developer address, broad declared data collection, or a privacy section that says nothing was collected while the product routes all your browsing.
• Avoid: Urban VPN Proxy (the December 2025 Koi Security findings) and Hola's free model (a long-standing peer network, explained below).

If you only need a different IP in the browser now and then, Opera's built-in free VPN is a no-extension alternative, with the trade-offs covered further down.

Extension 'VPNs' are proxies: what they cover and what they don't

A Chrome VPN extension sends the browser's traffic to a server run by the extension's company, which forwards it to the websites you visit. Websites then see that server's IP address instead of yours. That is useful for hiding your location from a site, or getting past a simple network block at school or work.

What it does not cover is everything outside Chrome. Email clients, Windows or macOS updates, games, cloud sync, and other browsers all keep using your normal connection and your real IP address. That is why reputable companies sell the extension as an add-on to their full app rather than as the whole product.

The other thing to understand is access. To route your browsing, a VPN extension typically asks for access to every website you open. That is a lot of trust to hand to a company you have never heard of. The same access that lets an extension proxy a page lets a badly behaved one read it, which is exactly what the Urban VPN findings were about.

The listing audit (nine extensions, read 9 October 2026)

The Chrome Web Store asks every developer to declare what data the extension collects, and shows it in a "Privacy practices" section on the listing. We read nine popular free VPN extensions' listings on 9 October 2026. These are the developers' own declarations, not audits, and every one of the nine also carries the store's standard statement that data is not sold to third parties outside approved uses.

How to read the table. A long list of declared data is a warning: an extension that says it collects location, web history and the content of the sites you visit is telling you, in its own words, that it sees what a VPN is meant to hide. A short list is better, but "nothing collected" is not proof: it is a self-declaration that Google does not audit, and an extension that proxies every page you load is in a position to collect far more than it declares. The best signal is a short declaration from a named company with an address and a paid product that funds the free one. Proton and Windscribe fit that description.

Two numbers in the table are worth a second look. VeePN, the most-installed listing at 15 million users, names its developer as VeePN CORP with no address. Planet VPN's listing metadata shows 1 million users while its description claims more than 10 million. Neither is evidence of wrongdoing; both are reasons to prefer a provider that is easier to hold to account.

Documented incidents: Hola, Urban VPN and others

Declarations tell you what a developer admits to. Documented incidents tell you what actually happened. Two of the most-installed free VPN extensions have a public record, and a third brand has an older one.

Urban VPN Proxy, 2025

On 15 December 2025, Koi Security researcher Idan Dardikman reported that Urban VPN Proxy and three sibling extensions from the same publisher (1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker), with more than 8 million users combined, had been capturing the prompts people typed into AI chatbots and the replies, on services including ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok and Meta AI. According to The Register's report on the findings, the collection was on by default with no setting to turn it off, ran whether or not the VPN was connected, arrived with version 5.5.0 in July 2025, and sent data to Urban VPN analytics domains. The only way to stop it, the researcher said, was to uninstall the extension. Urban VPN did not respond to The Register.

On 9 October 2026 the Urban VPN Proxy listing still showed 7 million users and the store's "not sold to third parties" statement. That is the clearest illustration of why a store badge is not a safety check.

Hola, 2015 to today

Hola runs as a peer-to-peer network. In May 2015, after 8chan's founder said his site had been attacked through the Hola network, reporting by ZDNet and Vice showed that Hola had been selling access to its free users' connections through a business called Luminati, which was renamed Bright Data in 2021.

Hola's own FAQ, read on 9 October 2026, still describes a network built on resources its users contribute, shared "for business use by Bright Data". It also says free users who install only the browser extension are not part of the peer network, and Premium subscribers are never used as peers. So the extension on its own does not turn your computer into an exit node, by Hola's account. Its listing does, however, declare the broadest data collection of the nine: seven categories, including payment information and personal communications.

Hotspot Shield, 2017

Older, and about the app rather than the extension: in August 2017 the Center for Democracy & Technology filed a complaint with the US Federal Trade Commission over what it called "undisclosed and unclear data sharing and traffic redirection" in Hotspot Shield's free app, then owned by AnchorFree. We found no public record of FTC enforcement following it. Today its Chrome listing says the extension is offered by Pango GmbH, and Touch VPN's listing carries a Pango copyright line.

How to check any extension yourself in 2 minutes

You do not need to trust any list, ours included. Before installing a free VPN extension, check five things.

1. Who made it. On the Chrome Web Store listing, scroll to the developer section. Look for a company name and a physical address. A first name and a Gmail address is not enough for software that sees all your browsing.
2. What it declares. Open "Privacy practices" on the listing. Web history, website content or personal communications are red flags for a VPN.
3. When it was updated. An extension not updated in a year or more is not keeping up with Chrome or with security fixes.
4. What it can access. After installing, open chrome://extensions, click Details, and read Site access and Permissions. A VPN will ask for all sites; that is expected, and it is why the first two checks matter so much.
5. What is it funded by. If there is no paid plan and no ads, ask how the servers are paid for. Our guide to how free VPNs make money covers the usual answers.

Our free VPN safety checklist turns those questions into a quick scored test.

Safer free options for Chrome

Proton VPN extension. Published by Proton AG in Switzerland, it declares only authentication data, and the free tier works inside it: no data cap, no ads, servers chosen for you. Proton's no-logs policy had its fifth Securitum audit, with an on-site visit in May 2026. The free plan covers one device at a time. If you later want every app covered, the desktop apps use the same account; you can see Proton VPN's plans (an affiliate link) when the free tier stops being enough.

Windscribe extension. Published by Windscribe Limited in Ontario, Canada, with 2 million users and a declaration of authentication data only. The free plan gives 10GB a month once you confirm an email, or 2GB without; Windscribe says the extra 8GB comes in exchange for one or two promotional emails a month. Windscribe pays us nothing. Its outside check is a 2024 PacketLabs infrastructure audit rather than a formal no-logs assurance report. Our Windscribe free review has the detail.

Opera's built-in browser VPN. No extension at all: Opera's browser includes a free VPN with no data cap, no ads and no sign-up, encrypting traffic between the browser and Opera's servers in three regions (the US, Singapore and the Netherlands). Like an extension, it covers only the Opera browser. Opera says its no-log setup was audited by Deloitte. Opera Ltd is about 68% owned by Kunlun Tech, a Shenzhen-listed Chinese company, according to its 2025 annual report; whether that matters depends on your threat model, and we give the details in plain terms rather than as a warning.

For the full ranking of free VPNs on every device, see our best free VPN guide.

VPN extensions for Firefox and Edge

Everything above about how extensions work applies in any browser: a VPN extension covers only the browser it is installed in, and it needs access to every site you open. The two we recommend are not Chrome-only. Proton lists Chrome and Firefox extensions in its own download menu, and its Firefox add-on, published by Proton, showed about 150,000 users in Mozilla's add-on store on 22 October 2026. Windscribe lists extensions for Chrome, Firefox and Microsoft Edge on its own site, and its Firefox add-on, published by Windscribe, showed about 79,000.

Edge users have a second route. Microsoft's support page explains that Edge can install extensions from the Chrome Web Store once you allow extensions from other stores, so the Chrome listings in our table are what you would be installing. Whichever browser you use, run the same five checks before you click install.

Edge cases

School and work Chromebooks. On a managed Chromebook, your administrator controls VPNs and extensions and can block them. Installing a proxy extension to get round a school filter can break the rules you signed up to.

Using an extension and a desktop VPN together. Reputable providers design their extension to sit alongside their own app. Mixing an extension from one company with a VPN app from another can route browser traffic twice or in unexpected ways; pick one.

Streaming. Free extensions rarely work reliably with streaming services, and the Chrome-only coverage does nothing for TV and phone apps. Our free VPN for streaming guide explains the limits.

Removing a bad extension. Remove it from chrome://extensions, then clear the browser's cookies and site data for good measure, and change passwords for any account you used while it was installed if the extension is one with a documented incident.