Start with the basics of VPN safety: protect your account and subscription link, then take precautions on public Wi-Fi. A successful connection only means the client connected; it does not mean every app uses the proxy or that every website you visit is trustworthy. Check credentials, connection coverage, and website identity separately.
The most practical rule is to limit how often credentials are shared: enter your password only at a trusted login page, give your subscription only to a verified client, and remove sensitive details from screenshots or support requests. The steps below follow a typical usage flow and explain what to do if information is exposed.
Account Passwords and Subscription Links: What to Protect
Treat a subscription link as an account credential, not an ordinary URL. A client typically uses the link to retrieve node configurations, which may include authentication details needed to connect. Anyone with a valid link may be able to view the configuration or use the associated routes, consuming account traffic. Access to the dashboard depends on its authentication method; these are separate permissions.
| Information | Main risk if exposed | How to protect it |
|---|---|---|
| Username and password | Someone may access the account and change plan or account settings | Use a unique password and store it in a trusted password manager |
| Subscription link and QR code | Someone may obtain the configuration and use route credentials and traffic | Import only into a trusted client; never post in public groups |
| Client configuration file | May contain node passwords, authentication fields, and subscription URLs | Review each item before sharing; never upload the original file publicly |
| Logs and screenshots | May reveal full URLs, account identifiers, or destinations | Keep only the details needed for troubleshooting and redact sensitive fields |
VPNEdit does not require an email address; access uses a username and password. Keep your username safe, and never reuse your password on other websites. Providing less information does not mean credentials can be handled casually: if the same password is exposed elsewhere, an attacker may still try it on this service.
A QR code is no safer to share publicly than a link. A subscription QR code often just turns the address into a scannable format, and screenshots can be decoded too. Keep QR codes out of tutorial screenshots, and avoid using a semi-transparent overlay to hide sensitive details. A safer option is to crop out the entire credential area before exporting an image.
Importing a Subscription: Fewer Intermediary Pages and Tools
Get your subscription from the account area after logging in. VPNEdit clients for Windows, Android, macOS, and Linux provide access to the subscription after login; the iOS entry requires an active plan. To check the steps, start with the on-site guide, not a download ad in search results.
Import methods vary between general-purpose clients. Some accept a subscription URL, while others require a specific format. A successful import does not necessarily mean the rules, DNS, and system proxy are all configured. Check the client documentation, then verify the update result and selected configuration to avoid accidentally using an outdated one after repeated imports.
- ✅ Open your account from a saved website link and verify the address before entering your password.
- ✅ Get a client suited to your operating system from the guide, and verify its publisher and download source.
- ✅ Import the subscription directly into the client, confirm it can read the configuration, then check routing and DNS settings.
- ❌ Never submit a complete subscription to an unfamiliar online converter, speed test, or configuration checker.
- ❌ Never save an unredacted subscription in chat history, shared notes, or a public code repository.
Subscription conversion gives another party access to your credentials. An online converter must read the original URL or configuration to produce a different format. Even if the output connects successfully, that does not tell you how the service stores the input. Prefer methods supported natively by your client. If conversion is necessary, first verify the tool's source and data-handling practices.
Exposed Subscription: Revoke Access First, Then Review Records
If a link has been made public, deal with the credential's validity first rather than just deleting the message. It may already have been forwarded, cached, or screenshotted. Removing public content can limit further sharing, but it cannot automatically invalidate links that have already been copied.
- Stop sharing it. Remove public messages, shared files, and screenshots. Note where it was exposed so you can clean up thoroughly.
- Open the dashboard through a trusted route. Check whether it offers a subscription reset or credential revocation. If there is no clear option, ask through a support ticket after logging in; do not guess what a button does.
- Confirm what was invalidated. Check whether the subscription URL, node authentication details, or both were updated. An old link failing to refresh does not necessarily mean an exported configuration can no longer connect.
- Update your devices. Retrieve a new configuration according to the support instructions, remove the old subscription, and check whether any device is still using a cached configuration.
- Review your account password. If it was also exposed, or you may have entered it on a fake page, change it to a unique password immediately and update it anywhere else you reused it.
Changing your password does not replace subscription revocation. The dashboard password and route authentication may be managed separately, so updating one does not guarantee the other is invalidated. Likewise, increased traffic alone does not prove unauthorized use. First rule out video playback, background sync, and your other devices, then provide the necessary records to support.
When asking for help, describe your operating system, client name, error message, and what you did. Do not include your account password in a ticket. If support needs to check a configuration, ask which redacted fields are safe to share. Use the on-site support page or a dashboard ticket, not a link from an unfamiliar private message.
Public Wi-Fi: Connect Safely, Then Verify the Connection
The main challenge with public Wi-Fi is verifying the network's identity. A hotspot with a similar name may not be provided by the venue. Confirm the name with staff, and turn off automatic joining for networks you no longer need. A system message saying you are online does not prove the hotspot is legitimate.
Some captive portals require authentication before a VPN connection can be established. At that point, complete only the necessary network access steps. Do not enter your VPNEdit password, subscription link, payment password, or other saved account credentials into an unfamiliar portal. If it asks you to install an unknown certificate, profile, or management configuration, stop and verify why it is needed.
Once connected, start your client and visit a familiar HTTPS website. If you see a certificate warning, stop before entering sensitive information; do not ignore the warning just to restore access. HTTPS protects traffic between your browser and the destination website, but fake sites can also have valid certificates, so check the domain and the page's purpose.
- ✅ Confirm the hotspot name, complete any required authentication, and then open sites that need a login.
- ✅ Turn off device discovery and file sharing if you do not need them, and keep your system and client updated.
- ✅ Check that the VPN is connected and that the current mode covers the apps you are using.
- ❌ Do not repeatedly submit your password when the network is unstable or disable security checks at an unfamiliar prompt.
If your client offers a kill switch, read its documentation and test it yourself. A system proxy usually affects only apps that follow that proxy setting; it does not automatically cover the entire device. Operating systems differ in how they handle background activity, tunnel permissions, and other network tools. Do not assume another platform uses the same setting names, or that closing a window leaves the connection active.
Split Tunneling and DNS: Understand What Tests Can Tell You
Split tunneling determines where traffic goes, while DNS determines how domain names are resolved. In rule-based mode, some websites may connect directly and others through a proxy. This is often expected behavior, not a connection failure. The actual coverage of global proxy mode also depends on how the client handles traffic; its name alone does not prove that every app's traffic enters the tunnel.
A DNS leak usually means that resolution requests expected to use a protected route were sent through another route, such as the local network. This may reveal the domains being queried, but it does not mean HTTPS page contents have been decrypted. Browser encrypted DNS, the system resolver, and the client's DNS settings can affect one another, so troubleshoot with the actual configuration in mind.
Use the on-site network check to review your browser's current exit route, then use a trusted DNS test tool to check the resolution path. The resolver name shown by a test is only a clue: public resolvers may use distributed exits, and a location mismatch does not necessarily indicate a leak.
Define what you expect before testing, then make changes one at a time. Keep a copy of your current configuration, check whether the system proxy or tunnel is active, whether routing rules match, and whether the browser uses its own DNS settings. Change one setting and test again to avoid confusing route changes with caching or rule updates. For further troubleshooting, see the troubleshooting guide.
Everyday Security Checks: Credentials, Devices, and Safe Use
Build security habits into every important action. Check a client's source when adding a device, verify the account entry point when updating a subscription, redact troubleshooting details before sharing them, and clear configurations and account sessions when retiring a device. If a device is lost or handed to someone else, remove its saved credentials even when your plan allows unlimited simultaneous devices.
A VPN protects a specific scope of network traffic; it does not erase website accounts, browser cookies, or information you have submitted. After you log in, a website can still associate activity with your account. A malicious extension, compromised device, or password entered on a fake page cannot be fixed simply by changing your exit route.
Key takeaway: Treat subscriptions as credentials, use connection status as a starting point, and verify website identity and app coverage separately. Limiting exposure first, then learning more complex settings, does more to protect accounts and public-network use than repeatedly switching routes.