On November 10, 2026, Mozilla announced that everyone using Firefox's free built-in VPN gets unlimited data from that day through January 31, 2027. Mozilla's announcement also gives a clear description of the scope: "Firefox's built-in VPN only covers browsing within Firefox." That one sentence is the main difference between a browser VPN and a device VPN.

A browser VPN is either built into a browser or added as a VPN extension. It protects the traffic that browser sends. A device VPN is an app that runs at the operating system level and protects traffic from every app on the phone or computer. Both are useful. They cover different amounts of your connection.

What a browser VPN or VPN extension covers

A browser VPN routes the browser's requests through a remote server before they reach the website. Many browser VPNs and extensions work as a proxy configured inside the browser. The result for the pages you open in that browser is similar to a VPN:

Websites see the server's IP address instead of yours, which hides your approximate location and makes it harder to link your visits across sites.
On shared Wi-Fi, the network operator sees a connection to the server instead of the list of sites you open in that browser.
You can choose where your connection appears to come from.

Mozilla lists the same uses for Firefox's built-in VPN: keeping the sites you visit private on shared Wi-Fi, and changing your browsing location, for example to read news from home while abroad. Firefox's version is available on desktop and Android, requires a Mozilla account, and is coming to iOS.

Mozilla also reminds users that websites can still recognize you through cookies or when you sign in to an account, and recommends a private window to browse without saving history on the device. That advice applies to any VPN, in the browser or on the device.

If you search for "vpn for chrome" or another browser name, you'll find extensions that work in the same way: the protection applies to that browser's traffic, and it's configured inside that browser.

What a device VPN covers

A device VPN creates an encrypted tunnel for the whole device. Every app's traffic goes through it, not only the browser's. On a typical phone or laptop that includes:

Messaging and calling apps, which connect directly to their own servers
Email clients, which sync in the background
Games and game launchers
Streaming, music and social apps
System services, such as app updates, cloud backups and the system's DNS lookups

DNS lookups turn site names into addresses, and they reveal which domains you visit even when the page itself uses HTTPS. A device VPN that sends DNS through its tunnel keeps those lookups private for every app. Our guides to what your ISP can see and how to detect DNS leaks cover this in more detail.

Because it works at the system level, a device VPN can also add protections that apply to the whole connection:

A kill switch blocks traffic if the VPN connection drops, so apps don't fall back to your regular connection for those seconds.
DNS-level ad and tracker blocking filters requests from every app, including ads inside apps.
Split tunnelling lets you choose which apps use the VPN and which connect directly.

Browser VPN vs device VPN at a glance

	Browser VPN or extension	Device VPN
Traffic covered	The browser it runs in	Every app on the device
Hides your IP from websites	In that browser	In every app
Messaging, email, games	Not covered	Covered
System DNS lookups	Browser's own lookups, depending on setup	Covered when DNS goes through the tunnel
Kill switch	Depends on the product	Common in device VPN apps
Setup	Turn on in the browser	Install an app

For a closer look at how proxies differ from VPNs in general, see VPN vs proxy.

When a browser VPN is a reasonable choice

A browser VPN fits when everything you want to protect happens inside one browser:

Reading or shopping on cafe or hotel Wi-Fi with only the browser open
Checking how a site looks from another location
Separating one browser session from your usual IP address
Using a computer where you can't install apps, such as a managed work laptop, if your employer's policy allows browser VPNs

It's quick to turn on and there's nothing to install. With Firefox's cap lifted until January 31, 2027, data limits are not a factor for its users during that period.

When a device VPN fits better

A device VPN fits when the traffic you care about isn't limited to a browser:

On public Wi-Fi with several apps running. Your messenger, email and cloud backup keep syncing while you browse. A device VPN encrypts all of it on the shared network.
On your phone. Most phone activity happens in apps, not in a browser tab.
When you want your ISP to see one encrypted connection. A device VPN hides which services you use across the whole device, which also helps on connections where an ISP slows specific services. See how to tell if your ISP is throttling you.
For gaming and calls. These apps connect directly to their own servers.
When you want a kill switch and ad blocking for every app.

Many people use both: a device VPN as the base layer, and a browser's privacy features, such as private windows and tracking protection, on top. For more everyday situations, see 5 times you need a VPN.

How CyberCat VPN protects the whole device

CyberCat VPN is a device VPN with apps for iPhone, iPad, Mac and Android. When you connect, it encrypts all of your device's traffic with AES-256 and sends it through a CyberCat server, so websites and apps see the server's IP address instead of yours. Every app is covered, including the ones that never open a browser.

DNS in the tunnel. CyberCat sends all DNS queries to its own encrypted resolvers inside the tunnel, so your ISP sees an encrypted connection instead of the domains you look up. You can confirm this with the free DNS leak test and WebRTC leak test.
Kill switch. If the VPN connection drops, CyberCat blocks all traffic until the tunnel is back, so your real IP stays hidden.
Ad and tracker blocking for every app. CyberCat blocks ad, tracker and malware domains at the DNS level across the whole device, with no extension to install.
Split tunnelling. You choose which apps go through the VPN.
Standard and Stealth modes on every plan. Standard is for everyday use. Stealth is for networks that detect and block VPN connections.
Unlimited bandwidth and up to 5 devices on one subscription.

CyberCat keeps no logs of your browsing or traffic. IP addresses kept for security are deleted after 30 days. To see how your connection performs with and without the VPN, use the free CyberCat speed test. New to VPNs? Start with what is a VPN.

FAQ

Is a VPN extension the same as a VPN?

A VPN extension protects traffic from the browser it's installed in, and many work as a proxy inside the browser. A VPN app protects traffic from every app on the device through an encrypted tunnel.

Does Firefox's built-in VPN protect other apps?

No. Mozilla states that Firefox's built-in VPN only covers browsing within Firefox. For apps outside the browser, you need a VPN that runs at the device level.

How long is Firefox's VPN data unlimited?

Mozilla says unlimited data applies from November 10, 2026 through January 31, 2027, for people signed in with a Mozilla account on desktop or Android.

Can I use a browser VPN and a device VPN together?

Yes, though for most people a device VPN on its own already covers the browser along with every other app. Check the result with an IP check.

Is it legal to use a VPN?

VPNs are legal in most countries, and some countries restrict them. Check the rules where you live and where you travel.

Sources

Mozilla, Firefox's free built-in VPN uncaps data limit through January 2027 (November 10, 2026)

Browser VPN vs Device VPN: Is a VPN Extension Enough?