Definition
A kill switch is a feature in a VPN client that monitors the tunnel's status and blocks all internet traffic the instant the tunnel goes down. Without a kill switch, a momentary VPN disconnection — common during reconnects, system sleep, or network changes — sends your traffic over the open ISP connection, exposing your real IP and any unencrypted activity. With a kill switch, the device simply has no internet during the gap, until the tunnel re-establishes.
Application-Level vs System-Level
Application-level kill switches block specific apps (typically a torrent client, browser, or messenger) when the VPN is not active, while leaving the rest of the system online. System-level kill switches block all traffic on all interfaces. The system-level version is stronger but more disruptive; the application-level version is more convenient but riskier. The strongest implementations use the operating system's firewall to enforce the rules, so they survive even if the VPN client itself crashes.
Why It Matters
Most VPN leaks happen during transitions — a few seconds at the start of a session, a few seconds when reconnecting. Without a kill switch, these short windows can be enough to reveal your real IP to a torrent swarm, expose a login from a non-VPN address, or send a few unprotected DNS queries. The kill switch is the defence-in-depth that turns a momentary failure into a brief outage rather than a privacy breach.