VPN for iPhone and iPad

Does the iPhone come with a VPN?

No. iOS provides the network extension, the toggle, and the status badge, but no VPN service. Open Settings > General > VPN & Device Management and you will see the configurations that apps have installed; an app such as WireGuard creates the tunnel from a configuration your provider gives you.

Once it is up, everything the device sends leaves encrypted and travels to the server you chose: Safari, third-party apps, background refresh, system updates.

The effect is the same as on any other device. The network you are on, whether a hotel, an airport, or a coffee shop, sees only encrypted packets heading to one address and can no longer read or alter what you access. Websites and apps see the server's IP and location instead of yours. What does not change matters just as much: apps you are signed in to still know who you are, cookies and device identifiers keep working, and no VPN makes a phone anonymous.

iPhone VPN setup with the WireGuard app

SuaVPN does not ship an app of its own. It works with the official WireGuard app, which is free on the App Store, open source, and maintained by the WireGuard project. The SuaVPN dashboard generates a ready-made configuration for each device, and the app imports it by scanning a QR code or opening a .conf file. Give each iPhone or iPad its own entry in the dashboard rather than reusing another device's file: separate keys let you revoke a lost iPad without touching the iPhone, and the dashboard counts devices per plan.

No second screen to show the QR code? Save the .conf file the dashboard offers and import it through "Create from file or archive"; the Files app works, and so does AirDrop from a Mac. Otherwise, it takes five steps:

• Install WireGuard from the App Store and open it.
• Sign in to the SuaVPN dashboard, go to Devices, and create a device for this iPhone or iPad with a name you will recognize. Pick one of the locations listed on the status page.
• In the app, tap "+" and choose "Create from QR code," then point the camera at the code shown in the dashboard.
• Name the tunnel and allow WireGuard to add VPN configurations when iOS asks; confirm with Face ID, Touch ID, or your passcode.
• Flip the switch next to the tunnel. The VPN badge appears in the status bar within seconds, and the "Latest handshake" line in the tunnel details starts updating.

On-Demand Activation: let iOS turn the VPN on for you

The most useful iOS-specific feature is On-Demand Activation, built into the WireGuard app. Open the tunnel, tap Edit, and scroll to the On-Demand section. You can have iOS bring the tunnel up on cellular, on Wi-Fi, or on both, and refine the Wi-Fi rule by network name (any SSID, only the ones you list, or all except the ones you list).

The rule most people settle on is "every Wi-Fi network except home," with cellular on or off to taste. The tunnel is then up before Safari loads the first page at an airport gate or in a hotel lobby, and iOS keeps the rule across reboots and reconnects whenever you change networks. The VPN for travel and public Wi-Fi guides build on this setup.

Two caveats. iOS runs one personal VPN tunnel at a time, so if you keep several tunnels for different locations, enable On-Demand on only one or the rules will compete. And unlike WireGuard for Windows, the iOS app has no separate kill switch; On-Demand is the closest equivalent, since the system brings the tunnel back on its own after a drop.

Is iCloud Private Relay a VPN?

No. Private Relay hides your IP address and DNS lookups by routing traffic through two relays, so no single party sees both who you are and where you are going. It covers Safari, DNS queries, and unencrypted app traffic only, everything else leaves the phone as usual, and it never lets you choose a location.

If you pay for iCloud+, you already have it, which is why the two features are easy to confuse.

The two can get in each other's way. If the VPN is on and Safari misbehaves (pages that will not load, a wrong location), turn Private Relay off under Settings > your name > iCloud > Private Relay, or only for the current network by opening its details in Settings > Wi-Fi and switching off "Limit IP Address Tracking." With a WireGuard tunnel active, Private Relay adds little: the tunnel already hides your IP for every app, not just Safari.

Battery, cellular data, and common problems

WireGuard suits a phone well. When nothing is being transferred it goes nearly silent, and its encryption (ChaCha20-Poly1305) runs efficiently on Apple's chips, so the extra battery drain over a normal day is small. The exception is weak signal, when the phone keeps dropping and re-establishing the connection. If battery use jumps, check Settings > Battery to see whether WireGuard is actually responsible.

On cellular, the tunnel does not change how your carrier counts data. Every byte still goes against your plan, plus a small overhead from the encapsulation. A VPN is not a way around a data cap, and anyone who says otherwise is selling something.

When something does not work, the cause is usually one of these:

• Tunnel on, no internet: toggle the tunnel off and on. Check the status page to confirm the location is online. If it still fails, generate a fresh configuration in the dashboard and import it again.
• iOS asks for your passcode when you add the tunnel: that is the system confirming a new VPN profile. It happens once per tunnel and is expected.
• A banking app refuses to open: some banks block traffic from VPN addresses. Turn the tunnel off for that session and back on afterward.
• No VPN control in Control Center: add it from Control Center's edit mode on recent iOS versions, or use the WireGuard app itself to turn the tunnel on and off.
• Tunnels gone after removing the app: deleting WireGuard deletes its configurations. Reinstall it and scan the QR code from the dashboard again; the device entry there is unchanged.

Plans, payment, and the honest limits on iOS

SuaVPN plans differ by how many devices you can have active at once: Basic covers 3, Pro 5, and Family 10, and an iPhone plus an iPad count as two. Current prices are on the pricing page. You can pay by card through Stripe, with prices shown in Brazilian reais and automatic renewal at the end of each period. There is no lock-in: cancel whenever you want, and you have a 7-day money-back period under Brazilian consumer law to test it on your own network first.

A few honest limits. The tunnel covers the whole device, so there is no split tunneling. There is no browser extension, no dedicated IP, and no business plan today. The locations you can pick from are the ones listed on the status page. If anything here does not match your screen, the support page is the fastest way to reach us, and the Android guide covers the same setup on the other platform.