A VPN on your router, or an app on every device?

Your router is the one door between your home network and the internet. Everything in the house, from the phones to the TV to the smart speaker, sends its traffic through it.

Put the VPN on the router and the router does the encrypting. It keeps a single tunnel open to a VPN server, and every device's traffic goes through it without the device knowing. Nothing needs installing on the devices themselves.

Think of it as a doorman for your building. Everyone who comes or goes passes him, and he does the job well. He just doesn't come to work with you.

Here's where the difference shows. Take one phone, owned by someone with a router VPN at home, and follow it from breakfast to bedtime.

At 7:30, on the home Wi-Fi, the router's tunnel covers it. At 8:15 the phone switches to mobile data on the train: no router in sight, so no tunnel. At 9:00 it joins the office guest network, and at 13:00 the café's Wi-Fi at lunch. Neither is covered. At 19:00 it's home again, and covered again.

The router did its job perfectly all day. It's just that its job ended at the edge of the home Wi-Fi signal, so the phone was protected on the one network its owner controls and on none of the others. With an app on the phone, the tunnel would have followed it all day; moving from Wi-Fi to mobile data doesn't stop it.

To be fair to routers, there are good reasons to want one. Some devices can't run a VPN app at all: many games consoles, some smart TVs, smart speakers and the odd internet-connected fridge. A router VPN covers all of them without asking.

It also covers the devices that could run an app but never will, like the old tablet in the kitchen that only ever shows recipes.

And it covers everything you forget about, and every guest who joins your Wi-Fi. If your main concern is your internet provider seeing the whole household's traffic, one tunnel at the router answers that in a single step. For a house full of devices that never leave home, that's a real convenience.

The trade-offs are mostly practical. None of them is a deal-breaker for a house full of devices that stay put, but together they make a router VPN a home project rather than a five-minute job. Here's what you sign up for.

WrapVPN is an app you install on each device: iPhone, iPad and Mac from the App Store, Android phones and Android TV from Google Play, and Windows PCs from the Microsoft Store. We don't offer a router setup, so a games console or a TV that can't run our app sits outside what WrapVPN covers.

In return, each device carries its own protection. Your phone keeps its tunnel on the train and in the café, your laptop picks its own location, and Clean Web, our ad and tracker blocker, has its own switch on each device. One person can use London for their bank while another uses Madrid on the same evening, with no argument over the router's settings.

The TV needn't miss out either. On Android TV, WrapVPN installs from Google Play like any other app, which covers the big screen that's so often left out, and Clean Web helps with ad-heavy apps there.

No plan has a device limit. One account covers your household, and you sign in on each device with the same Apple or Google sign-in so they all land on that account.

One related trap: a VPN on your phone protects your phone, not the laptop using its hotspot. It's the router problem in miniature, so install WrapVPN on the laptop too rather than relying on the hotspot.

If most of your devices stay at home and some can't run apps, a router VPN is a reasonable home project. If you want protection where it's most useful, on the networks you don't control, put an app on the devices that leave the house. Start with WrapVPN on the phone you carry every day, then add the laptop and the TV.