Can a VPN Steal Your Passwords? [And How to Stay Safe]
6 min. read
Updated on
Share this article
Improve this guide
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Keeping your login credentials safe is one of the reasons you should use a VPN. This software can help hide your identity by masking your IP address, encrypting your traffic, and handling your DNS queries privately.
However, are you sure that your VPN provider has your best interests at heart? Are you really safe from password theft from the VPN itself?
Unfortunately, you won’t like the answer.
Can a VPN steal passwords?
Yes, a VPN can steal passwords. It sounds absurd because you’d use one to protect vital personal info like online banking data with strong VPN encryption.
But just like most tech companies with malicious intent, shady VPN providers can choose to spy on their users. They can commit password theft and use your sensitive information as they see fit.
How can a VPN service steal your passwords?
There are two main ways how a VPN service can steal your passwords. It can get a hold of your login details and compromise your accounts by:
Intercepting insecure HTTP traffic
HTTP is a protocol that allows browsers and servers to talk with each other. It has made web browsing possible, except there’s one problem: its traffic is unencrypted. HTTP messages are in plain text. Whoever can intercept them can see exactly what you do on a site.
If your VPN intentionally monitors your browsing activity, it will see your credentials when you enter them on an HTTP site.
So, does this mean that you’re doomed to fall victim to a cybercrime like identity theft while using a VPN? Absolutely, not.
How to stay safe?
Instead of going to HTTP sites, visit only HTTPS ones instead. The “S” in the end stands for Secure, as this protocol version incorporates SSL/TLS encryption to render your traffic unreadable to outside observers.
Generally, web browsers like Google Chrome label non-HTTPS sites as “not secure.” Plus, HTTPS sites boast a lock icon to let you know they’re safe to visit in an instant.
Make no mistake about it, the HTTPS protocol doesn’t make you immune to VPN-initiated data breaches and even phishing attacks. But it does make it harder to steal your information.
Infecting your device with malware
Another way a VPN can steal your passwords is by installing a malicious program on your device. Depending on its design, such software can forge or fake certificates, allowing your VPN service provider to crack the SSL/TLS encryption of HTTPS sites.
With self-signed certificates, your traffic remains encrypted to hackers and your ISPs, but not to your VPN. No matter how robust your HTTPS site’s encryption strength is, a rogue VPN would still decode it.
Moreover, your VPN vendor can install a keylogger. This malware tracks your keystrokes, keeping a record of your login details when you type them in and adding them to VPN logs.
Admittedly, it’s concerning that nosy VPNs freely operate. Although you can’t get rid of them, there’s a way to keep your data out of harm’s way while using a VPN.
How to stay safe?
Go with a VPN company that isn’t interested in collecting data to pay the bills. That’s why you should steer clear of free services at all costs. A VPN operation isn’t cheap, so you have to wonder how one keeps the lights on when it doesn’t want your money.
To be fair, every VPN logs data to some extent. But principled vendors only gather the information they need to keep their apps in good condition. They keep no connection and activity records so that nobody could link your actions to your identity.
The service providers with a legit no-logs policy make it happen by investing in RAM-only VPN servers and subjecting themselves to impartial third-party audits.
Likewise, they operate under privacy-friendly jurisdictions to avoid mandatory data retention laws and state-sponsored mass surveillance policies. In other words, their headquarters are not in any Fourteen Eyes countries or states that ban or restrict VPN use.
To help boost your cybersecurity, credible services only use VPN protocols that support multi-factor authentication and have encryption that can withstand brute force attacks.
Also, they may come with built-in malware protection. It’s not an alternative to a robust antivirus program, but this feature can help keep you from landing on sketchy sites.
Every trustworthy VPN is only trustworthy until it’s not. So, do your homework to learn about your prospective service’s track record to unearth any past scandals it may have had.
Read more:
Summary
VPNs can steal passwords, but it doesn’t mean all of them are malicious.
The key is to entrust your data to a reputable VPN, not to a rogue one. And as long as you stay away from HTTP sites, you can stop worrying about your privacy and security whenever you log in.
FAQ
It is safe to log in through a VPN that has a legit no-logs policy. But a service provider’s word isn’t its bond.
So, take all no-logging claims with a grain of salt. Only believe those that have withstood the scrutiny of impartial third-party auditors.
A VPN provider can see your data only if it’s interested in spying on you and keeping tabs on what you’re doing online. Monitoring your activity is even easier when you visit an HTTP site.
Free VPNs do steal passwords. Do all of them do it? Who knows.
But you have to wonder how they support themselves when they don’t sell paid subscriptions. The only logical answer is that they collect data and sell it to the highest bidder in the black market.
So, can a VPN steal your passwords even when it offers premium plans? Yes, it still can, especially when you visit HTTP sites. But if it’s a reputable service provider, it won’t look at your online activity even when it can, nor will it log anything anyone can associate with your identity.
