WrapVPN on Android: everything the app does

Android treats a VPN as a serious matter, and rightly so: once one is running, every app's traffic goes through it. So before any app can set one up, Android asks you directly with its own connection request. WrapVPN can't answer it on your behalf, and wouldn't want to.

You'll see the request shortly after you first sign in. Accept it once and Android remembers the answer for as long as the app stays installed.

After that, a small key icon sits in the status bar whenever a VPN is connected. Android draws it, not us, which is what makes it a reliable signal: key showing, tunnel up; no key, no tunnel.

Android also runs one VPN at a time. If another VPN app is connected when you start WrapVPN, one of them has to give way, and WrapVPN asks you before it turns the other one off.

Here's the worked example. It's Saturday morning, you're on the train into town, and you open a news site. Before the article appears, the page asks for the addresses of a dozen other domains: analytics, ad exchanges, a couple of trackers that follow you from site to site.

Every one of those connections starts with a lookup, rather like checking a phone book before you dial. Clean Web, our ad and tracker blocker, declines to look up the numbers it knows belong to advertising and tracking domains. No number, no call, so those connections never start, which saves data and a little battery.

On Android it's switched on by default, so this happens from your very first connection, in every app that uses the phone's normal lookups. Two limits are worth knowing. A browser or setting that sends lookups to its own secure DNS provider goes around it, and because it blocks by name rather than reading pages, it isn't antivirus.

Hunting for an app just to flip a switch gets old quickly, so WrapVPN adds a tile to Quick Settings, the panel you pull down from the top of the screen. Edit your tiles once, move WrapVPN into view, and it sits alongside Wi-Fi and the torch.

The tile shows whether WrapVPN is on or off. Tap it while connected and the VPN disconnects. Tap it while disconnected and it opens the app and connects, so you land on the main screen already on your way. If the phone is locked, Android asks you to unlock it first.

The app itself is just as short. There's one large switch, the location you're using, and a list of places such as London, Madrid, Stockholm and Tokyo, each with a speed figure. A lower figure is faster, and the location nearest you usually wins.

Earlier, when the phone moved from the station's Wi-Fi to mobile data as the train pulled out, the tunnel simply carried on. What Auto-Connect adds is a safety net for the moments the VPN isn't running when it should be. With it on, WrapVPN reconnects whenever a network is available, so coming out of a dead spot, or the other kind of tunnel, puts you back behind ours without a tap.

It's off until you turn it on in Settings, and it respects your decisions. Disconnect on purpose and Auto-Connect leaves the VPN off until you connect again yourself. For a short break, Pause stops protection for a few minutes and then resumes by itself.

The one place it needs your help is Wi-Fi with a sign-in page, the sort you meet in a café once you're in town. Android usually offers a notification to sign in to the network. Complete that page first, then connect.

The same app installs on Android TV from Google Play, and a plan bought on your phone also covers an iPhone, a Mac or a Windows PC, provided you sign in with the same Apple or Google account. Install it tonight, accept Android's question, add the tile, and Saturday's train ride is already sorted.