VPN browser extension: one browser or the whole device?

Is a VPN browser extension a real VPN?

No. An extension cannot create a network interface; it can only use the browser's proxy API to send that browser's requests through an intermediate server. Websites see the proxy's address, while every other program on the machine keeps using your real connection. Strip away the marketing and it is a browser proxy.

Whether the path to that proxy is encrypted depends on the extension. Careful ones use an HTTPS proxy or their own tunnel; others use a plain proxy with no encryption, so your IP changes for websites but the local network still sees which sites you visit. The listing almost never says which kind you are installing.

Two leaks are common even with a good extension: DNS lookups can go out through the operating system rather than the proxy, exposing every domain you visit, and WebRTC, the technology behind browser video calls, can reveal your real IP unless the extension blocks it. A DNS leak test and any page that shows your public IP reveal both in seconds.

What stays outside the extension

Everything outside that one browser keeps using your real IP: mail client, messaging apps, Spotify, Steam, a torrent client, system updates, and any second browser. If a link opens in Edge while the extension lives in Chrome, that page loads without the proxy.

One detail catches people off guard: Chrome turns extensions off in Incognito windows by default, so a private tab browses with your own IP unless you allowed the extension in that mode. Firefox asks the same question at install time, and the default answer is no.

On phones, options are narrower still. Chrome on Android and Safari on iPhone lack the desktop extension catalog, and the apps that matter most (banking, social, messaging) never touch the browser. Covering a phone means a system-level VPN, the VPN profile in your settings.

System VPN: the WireGuard app covers the whole device

A VPN app installed on the operating system creates a virtual network interface and receives every packet the device sends: browsers, apps, background services, DNS queries. WireGuard does this with a small, modern protocol built into the Linux kernel and official clients for Windows, Mac, Android, and iPhone.

That closes all three gaps. DNS travels inside the tunnel, so the local network never sees the domains. WebRTC exits through the VPN interface, so the address it reveals is the server's. And no app sits "outside" the tunnel: torrents, email, and the second browser all take the same path.

It also unlocks settings an extension cannot offer. On Windows, the WireGuard client can block all traffic outside the tunnel: if the VPN drops, nothing leaves the computer. Android has "Always-on VPN" and "Block connections without VPN"; on iPhone, on-demand activation brings the tunnel up by itself on Wi-Fi. The guide on how to use a VPN walks through each.

Is a free VPN extension for Chrome safe?

It depends on how it pays for its servers and on what it asks to read. A proxy extension needs the proxy permission and little else; one that requests permission to read and change your data on every website can see every page you load, including what you type into login forms.

Servers cost money every month, so ask how the extension covers that. The usual answers are ads, selling browsing data, or using your connection as an exit for other people's traffic, which is what the Hola extension was caught doing in 2015. Chrome shows the permission warning at install time; read it.

Finally, extensions change hands. An honest one can be sold, and the next automatic update can arrive with trackers or worse. The official WireGuard app is open source, has no ads, and does not depend on who owns a store listing this month. The guide on free VPNs covers what "free" usually costs instead.

When an extension is enough and when you need the app

A browser proxy makes sense in a few cases: opening one site with a different IP when the rest of your traffic does not matter; a locked-down work computer where you can add extensions but not install software; or checking how a page looks from another country without signing in anywhere sensitive.

The system app is the right choice everywhere else: public Wi-Fi, phones, video calls, torrents, anything where nothing may leave the device unprotected. A Brazilian abroad whose bank app insists on a connection from Brazil hits the same wall: the app never touches the browser, so only a system VPN could help, and only with a Brazilian location listed on the status page. The VPN Brazil guide covers that case.

How SuaVPN works today

SuaVPN has no browser extension, and we would rather say so plainly than ship a proxy and call it a VPN. The service runs on the official WireGuard app: create an account, add a device in the panel, pick a location from the status page, and get the configuration as a .conf file (computer) or QR code (phone). Once active, it carries all of the device's traffic through the tunnel, in every browser and app; there is no split tunneling to route one browser outside it.

Plans differ only by device count: 3 on Basic, 5 on Pro, 10 on Family; protocol and locations are the same on all. Current prices are on the pricing page. Pay by card through Stripe from anywhere, cancel at any time and keep access until the paid period ends, and, under Brazilian consumer law, request a full refund within 7 days. The apps page has setup steps per system; support answers the rest.