Blog / safety
Fake VPN apps: how to download a VPN safely
Fake VPN apps and modified APKs spread fast where VPNs are in demand. Here's how to spot them and where to get a VPN you can trust.
When a country restricts the internet, VPN apps become some of the most downloaded apps there. That makes them a favourite disguise for malware. A fake VPN can show ads everywhere, steal passwords, read your messages or quietly sell your traffic. Here’s how to stay clear of them.
Berry is our own product, and we’ll use it in the examples. The advice applies to any VPN.
Where fake VPNs come from
- Modified APKs shared in messaging channels and groups, often with names like “VPN Pro unlocked” or “premium free”.
- Copycat apps with a name and icon close to a well-known VPN.
- Websites that look like an official download page but aren’t run by the developer.
- “Free premium” offers that ask you to install a second app or enter a code from a stranger.
The more urgent people’s need for a working VPN, the more of these appear. They spread fastest during internet restrictions, when the official stores themselves may be hard to reach.
Five rules for a safe download
- Get the app from Google Play or from the developer’s own website. Nowhere else. For Berry, that’s Google Play or our download page.
- Never install a “cracked” or “unlocked” version. If someone has changed the app to unlock paid features, they could have changed anything else too.
- Check the developer’s name on Google Play and the address of the website you download from. Typos and extra words are a warning sign.
- Compare the checksum when there is one. If the developer publishes a SHA-256 hash for the APK, check that your file matches it. A file with a different hash is not their file.
- Look at the permissions. A VPN needs to set up a VPN connection and show notifications. It has no reason to read your SMS, contacts or call log.
Signs you installed a fake
- Ads that appear outside the app, on your home screen or over other apps.
- The app asks to become an “accessibility service” or a device administrator.
- Your battery or data use jumps right after installing it.
- It “connects” instantly every time, but your IP address doesn’t change. You can test that in two minutes with our IP and DNS leak check.
If you see any of these, uninstall the app, change the passwords you used while it was installed, and install a VPN from an official source.
What about free VPNs in general?
Free doesn’t mean fake. Many honest VPNs, Berry included, have a free plan paid for by ads or by people who upgrade. What matters is that the app is open about how it makes money and what it keeps. We wrote more about that in is a free VPN safe?
The short version
Install from Google Play or the developer’s site, never from a forwarded file. Skip anything “unlocked”. Sideload only from the developer’s own download page. A VPN sees all your traffic, so it’s worth the extra minute.
Frequently asked questions
Is it safe to install an APK from outside Google Play?
It can be, if it comes straight from the developer's own website and the file matches the checksum they publish. APKs forwarded in chats or posted in channels are the risky ones, because anyone can modify them.
How do I check an APK's SHA-256?
Use a file manager or checksum app that can show a file's SHA-256 hash, and compare it with the one the developer publishes. If even one character differs, delete the file.
Can a VPN app steal my data?
A VPN app handles all your traffic, so a malicious one is in a good position to misuse it. That's why where you download it from matters more than for almost any other app.