Speed after connecting isn't the only factor when choosing an Android VPN. Check whether it stays connected with the screen off, recovers after a network change, and supports the per-app routing you need. This guide breaks down repeatable tests without unverified speed claims or treating app features as proof of route quality.
First, distinguish disconnects, sleep restrictions, and routing issues
If it works with the screen on but stops after the screen locks, check background restrictions first. If the client still says connected but one app won't load, the cause may be routing rules, DNS, or the destination service. The VPN icon in the status bar only indicates that Android has a VPN connection; it doesn't confirm that every request reached its destination through the remote exit. Separating these symptoms helps avoid switching routes without fixing the underlying issue.
Android Doze can restrict background network access and tasks when a device is idle. Manufacturers may add their own battery management, auto-start, and background cleanup features. A client using a foreground service isn't guaranteed to stay active on every system. Force-stopping an app, Android reclaiming its process, and a remote connection dropping are different problems with different fixes.
| Symptom | Check first | Test |
|---|---|---|
| Stops when the screen locks; resumes when it turns on | Battery optimization, background activity permissions, and client service status | Keep the route unchanged; adjust background restrictions only, then test again |
| Can't access the internet after switching networks | Tunnel reconnection, network authentication, and changes to the underlying connection | Confirm the network itself works, then reconnect |
| Browser works, but a specific app doesn't | Per-app list, domain rules, and the app's regional requirements | Include the app in proxy routing, then restart it and check again |
| Connected, but domain names won't load | DNS settings, Private DNS, and the app's own encrypted DNS | Check the DNS path in the client documentation; avoid stacking settings |
Keep the VPN running in the background: check system restrictions
Open the client's app info and check its battery settings to see whether background activity is allowed or an option such as “Unrestricted” is available. Menu names vary across Android versions and manufacturers, so not finding the same option doesn't mean the client can't run in the background. Follow the instructions for your device, rather than turning off every battery feature based on screenshots from another brand.
If your system has auto-start or background launch controls, allow the client to start. Locking it in the recent apps screen can help, but it doesn't replace battery settings. A whitelist in a cleanup utility applies only to that utility. After force-stopping an app, you'll usually need to open the client again; don't treat a force-stop as a normal screen-lock test.
- ✅ Confirm the client has Android VPN permission and its service remains active.
- ✅ Check battery management and background activity settings; note their state before and after changes.
- ✅ If the client needs a persistent notification, check notification permissions and service alerts as prompted by Android.
- ✅ Check for separate restrictions, such as auto-start controls and background cleanup whitelists.
- ❌ Don't assume allowing notifications removes all background restrictions, or that locking an app in Recents guarantees a persistent connection.
Removing restrictions may increase background battery use. Once the connection is stable, restore unnecessary permissions one at a time and see which changes actually matter. The result should be a setup that works for your device, not a switch-by-switch checklist for every Android phone. If your device is managed by a work profile or organization policy, check whether the settings can be changed first.
Per-app proxy: understand what the app list means
Per-app proxy controls which apps use the VPN; domain rules determine how requests handled by the client are routed. They can work together, but neither replaces the other. If an app is excluded from Android's VPN, adding its domains to the client's rules may not bring that app's traffic back into the proxy.
Common modes are “Proxy only selected apps” and “Bypass selected apps.” The names are similar, but the lists work in opposite ways. To route only a few international work apps through the proxy, choose the first mode and select those apps. If most apps should use the proxy while a few local services connect directly, consider the second. You'll usually need to reconnect the VPN for the new list to take effect.
How app lists and domain rules work together
Web pages in a browser, embedded pages inside apps, and links opened by another app may run in different app processes or packages. Selecting only your browser doesn't mean every embedded page will take the same route. After changing the settings, fully close and reopen the target app, then test the feature you need; refreshing a page may reuse an existing connection.
Apps in a work profile may be managed separately from apps in your personal profile. If the client can't show an app, check profile isolation and system permissions rather than installing an untrusted helper tool. If the client has no per-app controls, don't assume the subscription service can add that feature for you.
What to look for: If you only need a few apps to access international services, prioritize clients with a clear app list and per-app routing. For broader use across many websites, compare domain rules and DNS settings. The important questions are whether you can understand the rules and verify the results—not how many menu options the client has.
Comparing clients: check compatibility, not just protocol names
Android VPN clients commonly use the system's VpnService to create a local virtual network interface, then pass traffic to a proxy core. Android's VPN connection prompt and the proxy protocol in a subscription are different things. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC need a compatible client core and configuration; the ability to import a link doesn't mean clients handle them in the same way.
Hysteria2 and TUIC use QUIC, so how a network handles UDP can affect performance; that doesn't mean they'll be faster on every network. Trojan and VLESS also depend on the transport and server configuration. A protocol name alone says nothing about route congestion, and doesn't prove that a particular subscription supports it.
When comparing Android clients, check whether the current version supports your subscription format, per-app proxy, rule updates, DNS settings, and connection diagnostics. Support for rule syntax and subscription content varies by core, so copying the same configuration into another client may not produce the same result. Check the compatibility notes in the service dashboard.
Check subscription imports and route types separately
Subscription links distribute nodes and related configuration, and may contain access credentials. Treat them as sensitive: don't post them in public chats, online conversion tools, or screenshots shared for troubleshooting. Sign in to the dashboard to get your subscription and compatible client, then follow the setup guide to import it. Afterward, confirm the configuration is enabled, the subscription is up to date, and your plan has available data.
A direct connection typically links your device straight to a remote entry point; a relay adds a forwarding hop; IEPL usually refers to a carrier-provided international Ethernet private line. These describe different routes or transport methods, not levels of Android background reliability. A route's marketing label alone doesn't prove how it is delivered; check the details with the provider. This article makes no claims about VPNHear's route types.
A repeatable test procedure
The goal is to separate the effects of client settings from those of the network path. Establish a baseline using the same device, network, exit route, and target app, then change one setting at a time. Recording the Android version, client version, proxy mode, and error messages is more useful than simply noting that it “feels more stable.”
- Check the network first. Turn off the proxy and confirm that the local network is authenticated and can load ordinary web pages. If the underlying network isn't working, don't continue with the comparison.
- Establish a baseline with the screen on. Start the client, confirm the selected configuration and exit route, then perform a real task in the target app. Note any errors in the connection log.
- Compare before and after locking the screen. Keep the network and route unchanged, lock the screen, and leave the device idle before checking whether the task stopped and the service is still running. If something goes wrong, change only the background settings and repeat the same test.
- Test network switching. Switch between Wi-Fi and mobile data and check whether the client reconnects. Record brief interruptions after a network change separately from cases where the background process was terminated.
- Check the per-app list. Test apps that should use the proxy and apps that should connect directly. After changing the list, reconnect and reopen the target apps to avoid interference from existing connections.
- Retest everyday tasks. Repeat the checks with document syncing, web sign-ins, or other real work. A normal download speed doesn't tell you whether long-running connections will stay active.
When comparing clients, disconnect the current one before starting another. Android generally allows only one standard VPN app per user profile to manage network traffic at a time; a local firewall or ad blocker may also occupy that slot. If Android prompts you to replace the existing VPN, check for a conflict instead of repeatedly tapping Connect.
DNS and battery use: easy details to misread
A DNS leak usually means DNS requests aren't following the expected path—for example, a domain that should be resolved by the proxy is instead sent to the local resolver. Encrypted DNS in a browser, Android Private DNS, and the client's DNS settings can all affect the result. A changed exit IP alone doesn't prove DNS requests followed the same route.
If some domains won't load, first check the client documentation for how DNS and routing rules work together, then check Android Private DNS and any DNS resolver built into the app. Don't change the exit route, routing rules, and resolver all at once, or you won't know which change made a difference. Before sharing connection diagnostics, hide any subscription URLs or credentials they contain.
Battery comparisons also require consistent conditions. An always-on screen, large file transfers, frequent reconnects, and weak signal can all affect battery readings. More useful questions are whether the connection repeatedly restarts while idle, whether the client uses unusually high background power, and whether the problem continues during normal use. This article doesn't provide a client battery ranking because device and network conditions haven't been standardized.
Picks for different use cases
For frequent work on the move, test background operation with the screen locked and recovery after network changes. If only a few apps need the proxy, test the per-app list. For complex routing, check core compatibility, rule maintenance, and the DNS path. Make sure your everyday tasks work reliably before deciding whether you need more configuration options.
Choose a plan separately from your background settings. VPNHear allows unlimited simultaneous devices, but data isn't unlimited. Monthly plans are ¥9.9/month for 60GB, ¥18/month for 250GB, and ¥28/month for 500GB; data resets monthly on your activation date. Data add-ons remain valid until used and never expire. Occasional browsing and continuous file syncing have different needs; see the plans page for full details.
VPNHear doesn't require an email address; create an account with a username and password. Sign in to the dashboard to get the client and subscription. The no-logs policy reflects the service's privacy position; it doesn't mean your device, browser, or destination websites leave no records. You can request a full refund for any reason within 14 days of your first payment; see the terms for full details.
Bottom line: When choosing an Android VPN, check background reliability first, then client compatibility and routing; compare route performance under consistent conditions last. If it disconnects when the screen locks, check background restrictions. If one app fails, check its routing list and DNS. Route comparisons only make sense after ruling out these differences.