VPN for Chromebook: what actually covers the whole device
Updated on
A Chromebook can run a real VPN, and the way to do it is not the one most guides suggest. ChromeOS runs Android apps, so the official WireGuard app installs and covers everything. This guide explains why an extension does not, and how to set the tunnel up.
Does a VPN work on a Chromebook?
Yes, and better than people expect. Google's own Chromebook documentation states that "Chromebooks with the Play Store can install Android VPN apps", and that "typically VPNs implement a full tunnel, which means that all traffic from all Chrome windows, Chrome apps, and Android apps will pass through the VPN connection". That is the whole device, not one browser.
So the honest answer to "what is the best VPN for a Chromebook" is that you are not looking for a Chromebook product at all. You are looking for a service whose Android app you can install from the Play Store, which on ChromeOS behaves as a system-wide tunnel.
The built-in WireGuard support, and its limits
Google also notes that "some Chromebooks have basic built-in support for the WireGuard protocol". Where it exists, it lets you enter a tunnel in the system settings without installing anything. It is worth checking under the network settings before you install an app.
The word doing the work in that sentence is "some". Availability varies by device and by how the Chromebook is managed, and the built-in screen expects you to type the configuration by hand rather than import a file. For most people the app is the shorter path.
Why your school or work Chromebook may refuse
A managed Chromebook, the kind issued by a school or an employer, is controlled by an administrator console. That console can block installing apps from the Play Store, block VPN configuration entirely, or force a specific VPN of the organisation's choosing.
If the Play Store is missing or the VPN section is greyed out, that is policy, not a fault. No provider can work around it, and attempting to is usually against the acceptable use agreement you signed with the institution.
Why a Chrome extension is not a VPN
The search results for this topic are dominated by browser extensions, and they solve a smaller problem than they appear to. An extension can only affect what passes through the browser it is installed in. Everything else on the machine keeps using your normal connection.
On a Chromebook that gap is wider than on a laptop, because the Android apps you install are outside the browser entirely. An extension would leave every one of them untouched while the icon in the toolbar suggests you are covered.
| Traffic | Chrome extension | WireGuard Android app |
|---|---|---|
| Pages in the Chrome window it is installed in | Covered | Covered |
| A second browser profile or guest session | Not covered | Covered |
| Android apps installed from the Play Store | Not covered | Covered |
| Linux (Crostini) terminal and its programs | Not covered | Covered |
| System updates and background services | Not covered | Covered |
| DNS lookups from outside the browser | Not covered | Covered |
The free extension problem, specifically
Free browser extensions in this category carry the same economics as free VPN apps: someone pays for the bandwidth, and it is not the user. The reasonable questions are who publishes it, what permissions it requests, and what its privacy policy says about selling data. Those answers are usually easier to find than the marketing suggests.
The browser extension guide goes through the difference in more detail, including why most of these are proxies rather than tunnels.
How to set up a VPN on a Chromebook, step by step
The sequence below assumes a personal Chromebook with the Play Store available. It takes a few minutes, and the only part that needs care is getting the configuration onto the machine.
- Open the Play Store on the Chromebook and install the official WireGuard app. It is free and open source, published by the WireGuard project itself.
- Sign in to the SuaVPN panel in Chrome, open Devices, and add a device with a name you will recognise later.
- Pick a location from the ones listed on the status page, and generate the configuration.
- Import it into the app. On a Chromebook the file route is easier than the QR code: save the configuration file to the Chromebook, then use the import option in the WireGuard app and pick it from the Files app.
- Switch the tunnel on. ChromeOS shows a key icon in the status area while a VPN is active.
- Confirm it worked by loading any page that reports your public address and checking it matches the location you chose, rather than trusting the icon alone.
If the WireGuard app does not appear in the Play Store
Two things cause this. Older Chromebooks predate Play Store support entirely, and there is no way to add it. Managed devices have it disabled by an administrator, which shows up as the store being absent rather than as an error.
On an older personal Chromebook without the Play Store, the built-in WireGuard screen in network settings is the only remaining option, and only if your model has it.
Battery, speed, and what actually changes
WireGuard is light enough that the tunnel is not what drains a Chromebook. What you will notice is distance: a server far from you adds round-trip time to every request, which shows up as pages feeling slower to start rather than as anything breaking.
We publish which locations are online rather than speed figures, because a number measured on our hardware says nothing about your connection. The status page shows what is up before and after you subscribe.
When the tunnel is on but something still leaks
The most common surprise on ChromeOS is that the tunnel is genuinely working and one particular thing still behaves as if it were not. Two causes account for almost all of it, and both are worth knowing before you conclude the service is at fault.
The Linux container starts before the tunnel
If you use the Linux development environment, it is a container with its own networking. It normally follows the system tunnel, but a container that was already running when you connected can hold on to the previous route until it is restarted. Shutting the Linux environment down and starting it again is usually enough.
This is worth checking specifically if you use the terminal for anything that matters, because nothing in the interface tells you the container is on a different path from the browser.
Location is not the same as address
A site can ask the browser for your location directly, through the permission prompt, and that answer comes from Wi-Fi networks around you rather than from your address. A tunnel does not change it. If a service still shows you the wrong country with the VPN on, that permission is the first thing to check in the site settings.
The same applies to an account you are signed in to. Your address changes; the account, its history, and its region setting do not.
What SuaVPN gives a Chromebook, and what it does not
You get a WireGuard configuration per device, imported into the official app, with its own key pair that you can revoke on its own from the panel. On ChromeOS that covers the browser, the Android apps, and the Linux container together.
There is no SuaVPN app and no browser extension, no dedicated address, and no split tunneling, so you cannot route only some apps through the tunnel. Plans differ only in how many devices you register at once: Basic covers 3, Pro 5, and Family 10, and a Chromebook counts as one of them.
Current prices are on the pricing page, in Brazilian reais, payable by card through Stripe from anywhere. You can cancel at any time from the panel, and Brazilian consumer law gives you seven days from purchase to ask for a full refund, which is enough to test it on your own Chromebook and your own network before deciding.
Frequently asked questions
What is the best VPN for a Chromebook?
Any service whose Android app you can install from the Play Store, because ChromeOS runs Android apps as a full-device tunnel. That makes it an ordinary VPN decision rather than a Chromebook-specific one: check the protocol, the logging policy, and the price.
Does a Chrome extension protect my whole Chromebook?
No. An extension only affects the browser window it runs in. Your Android apps, the Linux container, and system traffic all keep using the normal connection, which on a Chromebook is a large share of what you actually do.
Can I use a VPN on a school or work Chromebook?
Often not. Managed Chromebooks are controlled by an administrator console that can block the Play Store or disable VPN configuration entirely. If the option is greyed out, that is policy rather than a fault, and no provider can bypass it.
Do Chromebooks support WireGuard natively?
Google states that some Chromebooks have basic built-in support for the WireGuard protocol, in the network settings. Availability depends on the model and on how the device is managed, so check the settings before assuming it is there.
Is a free VPN for Chromebook safe?
The same caution applies as anywhere else: free services need revenue from somewhere, and on extensions that often means data. Check who publishes it, what permissions it asks for, and what the privacy policy says about selling information.
Does SuaVPN have a Chromebook app?
No, and it does not need one. You install the official WireGuard app from the Play Store and import the configuration generated in the panel. There is no SuaVPN app on any platform and no browser extension.
Sources
Try SuaVPN
WireGuard, a card subscription, several devices per subscription and cancellation whenever you want.
See plans