Every Starlink flight is a public hotspot. The satellite downlink is fast, but the network inside the cabin is shared with every passenger around you, and by default nothing separates your traffic from theirs. This guide ranks the VPNs worth running at cruising altitude, drawn from the published Starlink Aviation specifications, independent passenger speed tests, and how each VPN protocol behaves on a satellite link.
Some links in this guide are affiliate links. If you buy through them, we may earn a commission at no cost to you. We included Mullvad despite having no affiliate relationship with them because their privacy model is genuinely strong. Commission rates had no bearing on the rankings.
The 10-second answer
Best overall: NordVPN
NordLynx holds the latency cost to single digits and reconnects fast when the signal drops during a satellite handover.
Best for privacy purists: ProtonVPN
Swiss jurisdiction, open-source apps, and a Stealth protocol that gets through networks which block VPNs.
Best free option: Proton VPN free tier
Unlimited data on the free plan with no activity logs, which almost no other free VPN offers.
Inflight Starlink is public WiFi. It behaves like the network at a coffee shop or an airport lounge, except the other users are locked in a metal tube with you for the next nine hours. Anyone on that network who runs common sniffing tools can read traffic that is not encrypted, and plenty of apps still send data in the clear. A more deliberate attacker sets up an evil twin: a hotspot named to look like the airline’s official network, so your device connects to the attacker instead of the plane. From there they run a man-in-the-middle. Picture posting a letter and a stranger steaming it open, reading it, resealing it, and sending it on, all before it reaches the person you wrote to. You notice nothing.
HTTPS closes part of the gap but not all of it. The padlock encrypts the contents of a page, yet your device still leaks which sites you visit through DNS requests, and a surprising number of apps skip certificate checks or fall back to plain connections when the network misbehaves. A VPN wraps the whole link in one encrypted tunnel, so the cabin network carries noise instead of your data. If you are still working out whether your flight even has Starlink yet, our guide to checking a flight covers that first step. United Airlines, Qatar Airways, Emirates, WestJet, Alaska Airlines and others now run Starlink. Every one of these networks is a public hotspot.
| VPN | Protocol | No-logs audit | Kill switch | Starlink | Streaming | Price / mo |
|---|---|---|---|---|---|---|
| NordVPN | NordLynx (WireGuard) | Deloitte | Yes | Yes | Yes | ~$3.99 |
| ProtonVPN | WireGuard, OpenVPN | Securitum | Yes | Yes | Yes | ~$4.99 |
| ExpressVPN | Lightway | Cure53 | Yes | Yes | Yes | ~$6.67 |
| Surfshark | WireGuard | Deloitte | Yes | Yes | Yes | ~$2.49 |
| Mullvad | WireGuard | Cure53 | Yes | Yes | Limited | €5 flat |
| Hotspot Shield | Catapult Hydra | No public audit | Yes | Yes | Yes | ~$2.99 |
| IPVanish | WireGuard, OpenVPN | Leviathan | Yes | Yes | Yes | ~$3.33 |
Prices are approximate promotional rates on longer plans and change often. Starlink compatibility reflects aggregated passenger reports rather than a controlled inflight test. Audit firms shown are from the most recent public reports; check the provider for current status before you rely on it.
NordVPN runs NordLynx, its build of WireGuard. On a satellite link that choice matters. WireGuard uses UDP and a short handshake, so it sets up the tunnel quickly and recovers in under a second when Starlink switches satellites mid-flight and the connection stutters. Older protocols stall on that same interruption.
Deloitte has audited the no-logs policy five times, and the company sits in Panama, outside the main intelligence-sharing alliances. The kill switch cuts traffic if the tunnel drops, which happens more often on a plane than at home. Threat Protection blocks trackers and known malware domains at the DNS layer, useful on a network you did not set up.
Passenger reports consistently place NordVPN among the VPNs that connect and stay up inside Starlink cabins. Streaming holds up too: it unblocks Netflix US and other large libraries, and NordLynx leaves most of the cabin’s 100 to 200 Mbps free for video.
Get NordVPNProtonVPN comes from the team behind Proton Mail, based in Switzerland. Swiss law sits outside the EU and the Fourteen Eyes group, with no data-retention requirement for VPNs. The apps are open source, and Securitum has audited the no-logs policy every year since 2022 with the reports published, so the claim is inspectable rather than asserted.
For inflight use the Stealth protocol earns its place. Some cabin networks and captive portals interfere with standard VPN traffic. Stealth wraps the tunnel to look like ordinary HTTPS, which gets you connected where a plain WireGuard handshake gets blocked. Secure Core routes through hardened servers in privacy-friendly countries when you want a second layer, at some cost to speed.
Proton also runs the rare free tier worth using. It carries no data cap and keeps no activity logs, where most free VPNs sell your bandwidth or your browsing. The free plan limits you to a few countries and one device, which is fine for securing a single laptop on a flight. Streaming and the fastest servers sit behind the paid plan.
Get Proton VPNExpressVPN runs Lightway, a protocol it built in house. Proprietary usually counts against a VPN, but Cure53 has audited the Lightway code and the core was later opened up, so it lands closer to WireGuard’s transparency than to a black box. On a satellite link it reconnects quickly, which is the property that matters at altitude.
TrustedServer runs the fleet from RAM, so every reboot wipes the disk and there is no long-term storage to seize or subpoena. Audits cover both the apps and the server setup. Streaming is a strength: ExpressVPN unblocks Netflix, Disney+ and Prime Video with less trial and error than most.
The catch is price. At around $6.67 a month on the longest plan it costs roughly double Surfshark and half as much again as NordVPN. You pay for polish and consistency rather than a feature the cheaper options lack. This is an affiliate link — we may earn a commission at no cost to you.
Get ExpressVPNSurfshark runs WireGuard and had its no-logs policy audited by Deloitte. It is the cheapest option here that ticks every box, and it allows unlimited simultaneous devices on one account, so a laptop, phone and tablet all connect at once without juggling logins.
It unblocks Netflix US and the major libraries, includes a kill switch, and holds a tunnel on Starlink without special handling. The CleanWeb feature strips ads and trackers at the DNS layer.
One fact worth knowing: Surfshark merged with Nord Security, the company behind NordVPN, in 2022. The two run as separate services on separate infrastructure, but they share an owner. If you want your VPN and your backup VPN under different companies, that is a reason to pair Surfshark with something other than Nord. This is an affiliate link — we may earn a commission at no cost to you.
Get SurfsharkMullvad is the privacy specialist’s choice. You do not register with an email or a name. The service issues a random account number, you top it up with money, and that number is your whole identity. WireGuard is the default, and Cure53 has audited the apps more than once.
Two things make Mullvad awkward for a general flyer. It keeps a deliberately small server network, so your choice of exit location is limited, and it makes no effort to unblock streaming, so Netflix is hit or miss. If your inflight plan is a work session and a locked-down connection rather than a film, that trade is easy to accept.
Mullvad runs no affiliate programme, on purpose. The company has said in public that paying commissions gives reviewers a reason to recommend a VPN for the payout rather than the product. We earn nothing from sending you to Mullvad, and we list it anyway, which is the point: on privacy grounds it is one of the most credible services here.
Hotspot Shield is fast, on paper, thanks to Catapult Hydra, its proprietary protocol. Proprietary is the problem. Unlike WireGuard or OpenVPN, Hydra is closed source, so outside researchers cannot inspect what it does with your traffic. You trust the company’s word rather than a public codebase.
That word carries history worth reading. In 2017 the Center for Democracy and Technology filed a complaint with the US Federal Trade Commission alleging that Hotspot Shield shared user data with advertising partners while marketing itself as a privacy tool. The service is now owned by Aura. We could not find a published independent no-logs audit from a recognised security firm, so its table entry reads no public audit rather than a named auditor.
It does connect on Starlink and it does unblock Netflix. On security grounds, though, the options above give you an inspectable protocol and an audit you can read for similar money. There is no affiliate link here.
IPVanish covers the basics well. It runs WireGuard and OpenVPN, had an independent audit by Leviathan Security, includes a kill switch, and costs around $3.33 a month. On features alone it belongs in the comparison.
It carries one piece of history that keeps it out of our top picks. In 2016, under previous ownership, IPVanish responded to a US Department of Homeland Security court order by handing over connection logs, and that data contributed to an arrest, despite the company advertising a no-logs policy at the time. IPVanish was later acquired and says it has rebuilt its logging infrastructure and now retains nothing. Both statements are on the record. What you make of a no-logs promise from a service that once produced logs under legal pressure is a judgement only you can make.
IPVanish appears in the table above with its link because it is a competent, approved service. We do not put a recommendation button next to it, because the 2016 disclosure is the kind of thing a reader deserves to weigh before clicking, not after.
This section is for readers who know what a packet is. Skip it if you just want a working VPN.
A VPN and inflight streaming get on better than you would expect. The overhead of a modern protocol runs about 10 to 20 per cent. Starlink inflight peaks at 100 to 200 Mbps to the aircraft, and 4K needs around 25 Mbps, so the maths leaves room even after the tunnel takes its cut and the rest of the cabin takes theirs.
Unblocking is the real variable. NordVPN, ExpressVPN and Surfshark open Netflix US and the big libraries. Hotspot Shield manages Netflix too. Mullvad is inconsistent by design, since it does not chase streaming. Netflix geo-blocks by region but no longer fights VPNs as hard as it once did; Disney+ is stricter and drops more VPN servers; Prime Video sits in between and changes its mind often.
One habit saves most of the pain: connect to a server in your home country before you board, while you are still on airport WiFi or cellular. Your streaming apps lock to that region and carry on once you are airborne. If you need to switch servers mid-flight, WireGuard makes it painless, so changing exit location at altitude is fine.
A little, and not enough to notice. A modern WireGuard VPN adds roughly 10 to 20 per cent overhead and 5 to 15ms of latency. Against Starlink's 100 to 200 Mbps and 40 to 60ms baseline, that leaves plenty of headroom for streaming and calls.
Not fully. Cabin WiFi is a shared public network, so unencrypted traffic is visible to others on it, and a rogue hotspot can pose as the airline's network. HTTPS protects the contents of a page but still leaks which sites you visit.
Usually, though not always on the first try. Some cabin networks and captive portals interfere with VPN traffic. Protocols built to look like ordinary HTTPS, such as Proton's Stealth, get through more reliably than a plain connection.
Any VPN running WireGuard, which includes NordVPN with NordLynx, Surfshark and Mullvad. WireGuard adds about 5 to 15ms, well below OpenVPN over TCP, which can add 30ms or more on a lossy satellite link.
No. Once the tunnel is up, the airline and its WiFi provider see encrypted traffic to a single VPN server, not the sites or apps behind it. They can tell that you are using a VPN and how much data you move, and nothing more.
Some do, and most are a poor trade. Free VPNs often cap data, throttle speed, or fund themselves by logging and selling your activity. Proton VPN's free tier is the exception: unlimited data and no activity logs.
In almost every case, yes. VPNs are legal in most countries and airlines do not prohibit them. The exceptions are a handful of countries that restrict VPNs in general, which can matter based on where you take off or land rather than the flight itself.
Yes. VPNs work on Starlink inflight WiFi the same way they work on any public network. Connect before takeoff or once the network comes online mid-flight. WireGuard-based VPNs reconnect fastest after brief signal drops, which matters on a satellite link where the connection can stutter during a handover.
Starlink is fast. The network inside the cabin is not private. Every device on board shares the same network segment, and without a VPN your DNS queries, unencrypted app traffic, and connection metadata are readable by anyone else on that network with the right software. A VPN encrypts your traffic before it leaves your device, so the shared network only sees noise.
United Airlines, Qatar Airways, WestJet, Alaska Airlines, Emirates, SAS, British Airways, Air France, Virgin Atlantic and airBaltic are among the carriers currently rolling out Starlink. The list grows monthly. Our full airline Starlink tracker shows current rollout status for every carrier. Every one of these networks is a public hotspot.
Starlink does not change the underlying public network risk compared to Gogo or Viasat. It does change how much you use the WiFi. When the connection is fast enough to actually work, you open banking apps, join video calls, send documents. That is when exposure becomes real rather than theoretical. The risk was always there. Starlink makes it worth caring about.
On an unencrypted shared network, yes. Anyone running packet-sniffing software can read your DNS queries, traffic from apps that skip HTTPS, and connection metadata. HTTPS protects the content of most web pages but not which sites you visited, how long you stayed, or what unencrypted apps send in the background. A VPN wraps everything in a single encrypted tunnel before it leaves your device.
Yes. VPNs work on any IP-based network regardless of which satellite provider the airline uses. Emirates runs Starlink on its 777 and A380 fleet, United on regional jets and a growing share of its mainline aircraft, Qatar Airways on its 777s. All three are public networks. Treat them the same way you would treat airport WiFi and connect your VPN before browsing.
A VPN encrypts your traffic before it leaves your device, so even if you connect to a rogue hotspot the attacker sees encrypted noise rather than readable data. It does not stop you connecting to the wrong network in the first place. Always check you are on the airline's official network name before you start browsing, then keep your VPN running for the duration of the flight.
