VPN security starts with protecting your account and subscription link, then checking what your connection covers on public Wi-Fi. Connecting to a route does not protect every app, and it does not make it safe to enter login details anywhere. Know who has your credentials, which traffic uses the route, and whether the website you are visiting is trustworthy.
Your Account and Subscription Link: What Each One Protects
Your account password gets you into the service dashboard; your subscription link lets a client retrieve route settings. Subscription URLs often contain a token that identifies your account. Anyone with the URL may be able to retrieve a working configuration without entering your dashboard password. It is not an ordinary web address, and a subscription QR code deserves the same protection.
Changing your dashboard password may not invalidate an existing subscription; that depends on how the service handles credentials. Do not assume that changing your password resolves a leak. Exported client configurations may also contain node passwords, user identifiers, or subscription URLs, so sharing a configuration can carry risks similar to sharing the link itself.
| Data | What it may be used for | How to protect it |
|---|---|---|
| Account password | Sign in to the dashboard and view or manage service details | Use a unique password and store it in a trusted password manager |
| Subscription link and QR code | Retrieve route settings; may use account traffic | Share only with a client you trust; never post publicly |
| Exported configuration file | Access connection credentials saved in the configuration | Treat it as a sensitive file; check for and remove credentials before sharing |
| Screenshots and logs | May reveal account details, destination domains, or connection information | Crop before submitting a support request, then check for links, tokens, and QR codes |
Save subscription URLs in a password manager with access controls or in an encrypted note. Clipboard history, cross-device clipboard syncing, and automatically uploaded screenshot folders can create extra copies. Take particular care on borrowed devices, and remove imported configurations and saved credentials when you are done.
Getting the Client and Importing a Subscription: Cut Out the Middlemen
A secure import starts with a trustworthy source. Lookalike installers in search results, modified apps shared in chat groups, and unfamiliar websites that ask you to upload a subscription before generating a configuration all create more opportunities for credentials to be exposed. A subscription converter can read the original data. Use one only if you trust the tool and the environment it runs in—not just because it makes importing easier.
- Open the verified service website yourself, check the domain, and then go to the user dashboard. Never enter your password through an urgent link in an unfamiliar message.
- Use the dashboard to find the client download for your operating system, and verify the publisher and download source. If your system displays a security warning, find out why before proceeding; do not blindly follow instructions from an unfamiliar guide.
- Copy the subscription URL from the dashboard and import it using the client's built-in subscription feature. Importing a QR code, like pasting a URL, gives the client access to a credential.
- After updating the subscription, choose a route and check the client's current mode and system proxy settings. Verify the connection by visiting a trusted website, then clear any clipboard copies you no longer need.
Signing in is required to retrieve a VPNZW subscription. Except on iOS, you can download the client and sign in without purchasing a plan; on iOS, the download option depends on your eligibility as shown in the dashboard. Check the client download page in the dashboard for the available option. Marketing pages do not link directly to installers.
Behavior varies by platform. Desktop clients may use only the system proxy or may support a virtual network interface; some apps do not follow system proxy settings. A VPN icon on a mobile device usually indicates that a network configuration or tunnel is active, but it does not prove that every app or DNS query is handled as expected. Check the client's mode, rules, and system permissions.
Public Wi-Fi: Check the Network, Certificate, and Connection Order
Public Wi-Fi risks go beyond whether someone can intercept the wireless signal. They also include lookalike hotspots, fake sign-in pages, and prompts to install configuration profiles. A network name that looks like a hotel or café is no proof of ownership. Confirm the network name and sign-in process with the venue, turn off automatic joining when you do not need it, and prevent your device from reconnecting to unfamiliar saved hotspots.
Some networks require portal sign-in before you can get online. If the client prevents the sign-in page from appearing, verify the hotspot with the venue, temporarily disconnect the client to complete the required sign-in, then reconnect and check the connection. Avoid sensitive tasks during this transition. If a sign-in page unexpectedly asks for your email password, payment password, or subscription import, stop and verify the request.
HTTPS protects data sent between your browser and the correct website, provided the domain is right and the certificate checks out. If your browser reports a certificate error, do not bypass the warning to sign in. Do not install a root certificate or device management profile on a public network just because a page calls it a “network fix”; these changes can alter which entities your device trusts.
VPNZW uses bank-grade encryption for connection protection, but that cannot verify a website's identity or stop you from entering a password on a spoofed page. For important services, use a saved bookmark or type a verified address yourself. Check the full domain, not just the page logo or padlock icon.
Split Tunneling and DNS: What to Check After Connecting
Routing rules determine which requests use the proxy, connect directly, or get blocked. Rule-based mode usually handles only traffic that matches a rule. Even a client's “global” mode depends on how it routes traffic. With system proxy mode alone, apps that ignore the proxy may still connect directly. A virtual network interface can capture more traffic, but routing, exclusions, and client implementation still matter.
DNS translates domain names into network addresses. If a query that should use a protected route instead goes to a resolver on the local network, the domain being looked up may be exposed. This unexpected routing is commonly called a DNS leak. It does not mean HTTPS content has been decrypted, but it may reveal lookup information to the local network.
- ✅ Check your current browser exit on the My IP page and confirm that its location matches the route you selected. This checks only the current visit, not every app.
- ✅ Check the client's DNS mode, remote DNS settings, and routing rules to see how domains that should use the proxy are resolved and routed.
- ✅ Use a DNS test tool you trust to check which resolvers are involved, and interpret the result alongside your configuration. A different location alone does not prove a leak.
- ✅ Check your browser's Secure DNS settings. It may use a separate resolution path, so make sure it matches your intended routing.
- ❌ Do not assume that being able to open a webpage means every check has passed, and do not fix access problems by casually disabling certificate verification.
Interpret test results in context. Resolving a direct-connection domain through a local resolver may be expected under your rules. A remote resolver and exit in different locations do not automatically indicate a leak. What matters is whether traffic that needs protection follows the intended route. After changing settings, reconnect, reload the page, and test again. If something is wrong, use the troubleshooting guide to check each possibility instead of changing several settings at once.
Leaked Subscription Link: Revoke It, Then Clean Up Copies
If you find a subscription URL in a group chat, public support ticket, or screenshot, assume someone else may have it. Deleting the message can limit further sharing, but cannot retrieve copies already made. Closing your own client will not invalidate configurations held by others.
- Stop sharing it, note where it was exposed and what type of data was involved, and do not paste the full link again to explain the issue.
- Check whether the dashboard offers an option to reset the subscription or revoke credentials. If there is no clear option, ask through a dashboard support ticket how to revoke them.
- If your account password was also exposed, change it to a unique one and check whether the dashboard lets you sign out of other sessions. This does not confirm that the subscription has been revoked.
- Once you have a refreshed subscription, replace the old URL on your devices and update the configuration. Remove old QR codes, exported files, and shared copies.
- Check traffic records for unusual usage or changes. If you still have concerns, give support the relevant time and symptoms so the service team can confirm the status.
When troubleshooting, start with your operating system, client name, error message, and checks already performed. Do not send your full password, subscription URL, or a dashboard screenshot containing a QR code. If support needs a configuration to diagnose the issue, first confirm the support channel and the specific fields required, then handle sensitive data only as instructed.
Information Sharing and Everyday Security Checklist
Share only what the task actually requires. VPNZW does not require an email address; a username and password are enough to get started. Avoid reusing a social media handle, work account, or common email prefix as your username, so separate parts of your identity are less easily linked.
Provide payment details only through a verified payment flow. VPNZW supports Alipay, WeChat Pay, and USDT. Each method leaves different records, and none should be treated as inherently anonymous. For a refund or support request, provide only the order details required by the dashboard; do not publish a full bill or unrelated transaction history.
When reading the terms of service, distinguish browsing content, connection metadata, account details, and payment records. “No logs” is a policy claim whose scope needs to be checked, not a guarantee that every external record disappears. If the terms do not address a type of record, do not assume how it is stored or when it is deleted.
Routine maintenance also means updating your client and operating system, locking access to your devices, and checking whether configuration backups sync automatically to shared storage. If a kill switch is essential, confirm that your current client actually offers one and test its behavior in a controlled setting. Do not infer its coverage from the name of a setting alone.