Here’s the key takeaway from this VPN security guide for beginners: your password and subscription link are both credentials. On public Wi-Fi, verify the network first, then check that your encrypted connection is working. A VPN protects traffic routed through its tunnel, but it can’t identify phishing sites for you or make websites forget you’re signed in.
Understand the difference between accounts, subscriptions, and connections
Your account dashboard lets you manage your plan, check usage, and access configuration details. A subscription link lets a compatible client retrieve server information and usually contains a token or other access credentials. Anyone with the link may be able to retrieve connection details and use your data without signing in to your dashboard. Don’t treat a subscription link like an ordinary URL or share it casually.
A VPN or proxy client routes traffic that matches its rules through a remote exit server. Websites may still identify you through your account, cookies, or browser fingerprint. Using a VPN doesn’t sign you out of websites or erase your browsing history.
| Item | Purpose or risk | What to do |
|---|---|---|
| Dashboard password | Could be used to access your account and manage your plan | Use a unique password and store it in a password manager |
| Subscription links and configuration files | May contain credentials that grant access to servers | Treat them like passwords; don’t share screenshots or forward them |
| Encrypted tunnel | Protects traffic that actually passes through the tunnel | Check routing, DNS, and what happens if the connection drops |
| Website sign-in | Websites can still associate activity with your account | Manage sign-in sessions and website permissions separately |
HTTPS and a VPN protect different parts of a connection. HTTPS protects data exchanged between your browser and the website; a VPN protects the relevant traffic between your device and the tunnel exit. Keep using HTTPS even when your client is connected, and don’t proceed past certificate warnings.
How to store your password and recovery details
Use a unique password for your VPN service instead of reusing one from your email, shopping, or work accounts. A password manager can generate and store a long, random password and help confirm that the site you’re visiting matches the saved domain. Don’t leave passwords in public notes, chat bookmarks, or a browser shared with other people.
VPNGrow doesn’t require an email address. That’s one less detail to provide, but it’s still important to protect your account: save your login details when you create the account and check which recovery options the dashboard actually offers. Don’t assume you can reset a forgotten password by email. If the dashboard provides recovery credentials, keep an offline or encrypted backup.
If a service supports an additional authentication method, you can enable it as directed and store its recovery details securely. This is general advice, not a claim that the VPNGrow dashboard offers every authentication feature. On shared devices, don’t choose an option to stay signed in; sign out when you’re done. Clearing browser history may not end a server-side session.
- ✅ Use a unique dashboard password so a leak from another site can’t be used to try to access your account.
- ✅ Bookmark the verified official site and check the full domain before signing in—not just the page branding.
- ✅ Store recovery credentials separately from files you share, and check that screenshots aren’t syncing to a shared album.
- ❌ Never give your password to someone claiming to be support, or reveal full credentials during remote assistance.
Importing, sharing, and revoking subscription links
Copy the subscription URL from your dashboard and paste it directly into the subscription import screen of a trusted client. A subscription link is used to retrieve configuration; it isn’t an installer and shouldn’t be pasted into a search engine. When taking screenshots, hide the entire URL, QR code, and server authentication details. A QR code is simply another way to display credentials.
Be especially cautious with online subscription converters. Submitting a link to a third-party site may give it access to the link and the server details returned by it. First check whether your client can import the link directly, then review the service’s compatibility guidance. If conversion is necessary, find out where it happens and whose servers handle the configuration. Don’t hand over credentials just because a page claims it’s “secure.”
After updating a subscription URL, check whether the old server credentials have also been invalidated. Some systems replace only the URL used to retrieve configurations; server details already downloaded may remain valid. Don’t assume that changing the link makes every old configuration unusable. If the dashboard doesn’t explain this, ask through the contact page what the revocation covers. Never post the original link in a public forum to ask for help.
How to check your connection on public Wi-Fi
Public Wi-Fi risks include more than eavesdropping: fake hotspots, prompts to install files, and spoofed sign-in pages are also concerns. A hotspot name that resembles a business name doesn’t prove it’s legitimate; ask staff to confirm before connecting. A network sign-in page should only be used to complete that network’s access process. It shouldn’t ask for your VPN password or bank card PIN.
- Verify the network. Turn off automatic connection to networks you don’t need. If you see duplicate hotspot names or an unfamiliar sign-in page, disconnect and check first. Signal strength doesn’t tell you whether a network is genuine.
- Be cautious during sign-in. Some networks require you to open a portal page before you can get online. Provide only what’s necessary. If you’re asked to install a root certificate, configuration profile, or unfamiliar app, stop and find out why.
- Connect securely. Once the network is available, start a trusted client and check its connection log and routing status before opening the site you need. Don’t assume every app is protected just because an icon appears in the toolbar.
- Check the website and its certificate. Use an official address you’ve already saved. A valid HTTPS certificate doesn’t prove a business is trustworthy, but a certificate warning is a reason to stop before entering sensitive information.
- Clear network traces when you leave. Sign out on shared devices and, if needed, forget the hotspot to avoid automatically reconnecting to a network with the same name.
If your client offers a kill switch, enable it and test it: disconnect the tunnel and see whether apps that need protection can still access the internet. Behavior varies by operating system, client, and mode. The presence of a switch in settings doesn’t mean it covers all traffic. If you can’t verify what it protects, pause sensitive activity.
Understanding split tunneling, DNS, and app permissions
Rule-based routing sends different traffic along different paths—for example, some sites may connect directly while others go through a proxy. A direct connection doesn’t mean the connection failed, but it does mean that traffic didn’t pass through the proxy tunnel. “Global proxy” generally changes proxy rules for the client; it doesn’t necessarily route all device traffic through the tunnel. System proxy settings may be followed by only some apps.
System proxy settings and TUN mode cover different traffic on Windows and macOS. On Android and iOS, VPN permission generally lets a client create a system-level network tunnel, but app exclusions and routing rules can still affect what goes through it. On Linux, check whether command-line tools, desktop apps, and system services use the same proxy settings. Start with the setup guides for platform-specific instructions instead of copying screenshots from another platform.
DNS translates domain names into addresses. If requests expected to go through the tunnel are still handled by your local network’s resolver, the result may not match your privacy expectations. Browser-encrypted DNS, system DNS, and client DNS can all be active at once. Check the client documentation and how the settings interact rather than simply turning everything on or off.
A reputable DNS leak test can help you see which resolver handles your requests, but it can’t prove your privacy is fully protected. Split tunneling may intentionally keep some lookups local, and the resolver’s location may not match the location of your traffic’s exit point. More useful questions are whether the result matches your current rules and stays consistent after switching networks or reconnecting. Don’t upload subscription files to DNS test sites.
Personal information you shouldn’t share casually
When troubleshooting a connection, support may need to know your device’s operating system, client name, what you were doing, and the error message—not your full password. Logs may contain subscription URLs, server credentials, visited domains, or local file paths. Review them before sending and include only what’s needed to diagnose the issue.
Avoid sharing ID photos, full payment card details, work system keys, or private conversations unless they’re truly needed. Check the recipient and purpose on payment pages. Someone claiming to process a refund should never ask you to send your payment PIN in a chat. If you don’t understand why data is being requested, ask how it will be used and stored and whether there’s an alternative.
When redacting a screenshot, cover the entire credential—not just a few characters in the middle—and fully conceal subscription QR codes. Before sharing client settings publicly, check the edges of the image, browser address bar, and notification previews. An original image may already have been saved, so replacing it later doesn’t revoke exposed credentials.
What to do after a suspected leak
If you’ve only seen an unfamiliar error message, save the relevant details first; it doesn’t necessarily mean your account has been compromised. But if a password or subscription link has become public, treat it as exposed and act without waiting for unusual activity. Use a trusted device and network for the steps that follow, if possible.
- Secure your dashboard first. Change your unique password. If session management is available, revoke any sessions you don’t recognize. Change the password separately on any other service where you reused it.
- Then revoke subscription credentials. Use the dashboard’s reset or revocation options and confirm whether they invalidate old server configurations. If you’re unsure, ask through official support channels.
- Check where your client came from. Remove apps from unknown sources and review unexpected certificates and permissions. If you suspect the device is infected, address that issue before entering new credentials.
- Reimport and verify. Update the subscription on your own devices, confirm that the client no longer uses old configurations, and check your plan usage and account details for unexpected changes.
Knowing where credentials are stored, which traffic passes through the tunnel, and how to revoke access after a leak matters more than simply seeing “Connected.” Start by protecting your account and subscription, then check public network and routing behavior. Encryption doesn’t replace verifying websites, updating devices, or granting permissions carefully.