Cloudflare 1.1.1.1

Is Cloudflare 1.1.1.1 safe?

Yes. Cloudflare's 1.1.1.1 app is one of the safer free tools of its kind. In its basic mode it encrypts your DNS lookups so your internet provider or the Wi-Fi owner cannot read them; with WARP switched on it tunnels all your traffic to Cloudflare as well. It shows no ads, asks for no account and, according to its App Store label, collects nothing linked to you. We score it 83/100.

The catch is what WARP is not. Cloudflare says it "does not provide anonymity" and will not make you look as if you are in another country. And while the DNS resolver's privacy promises have been audited, WARP's traffic handling never has been. For a free tunnel on café Wi-Fi it is a far better bet than ad-funded VPNs such as Turbo VPN (42). For hiding your identity it is the wrong tool.

What does Cloudflare keep about you?

Less than most free VPNs, and it says so in detail. For the public resolver, Cloudflare promises that your IP address is never written to disk and that resolver logs are deleted within 25 hours. Two exceptions are disclosed: routers sample at most 0.05% of packets for troubleshooting and attack defence, and aggregated, anonymised data can be kept indefinitely for its Radar statistics and shared in limited form with the research body APNIC.

Those promises were checked once. When it launched the resolver in 2018, Cloudflare said it had hired KPMG to audit it every year. The only published examination, by a Big Four accounting firm that Cloudflare's announcement does not name, covered February to October 2019, and Cloudflare published the results in March 2020. It confirmed that querying IP addresses were not stored with DNS queries. Cloudflare also admitted that some of its earlier statements about "anonymous" logs had been confusing. The docs still point to that report, so the outside check is now several years old.

The app collects a little more. Its privacy policy says it holds a random installation ID, connection and performance data, device model and crash logs, and keeps account and operational data for up to two years after you last use the app. It says this data contains no unique device identifiers and that it keeps no link between your IP address and the sites you visit. Cloudflare also tracks aggregate traffic by website and region to plan new data centres.

How secure is WARP?

The current WARP client tunnels traffic over a protocol called MASQUE, and Cloudflare says all of it is protected with post-quantum encryption. DNS is always encrypted, by DNS-over-HTTPS or DNS-over-TLS. One gap is in the FAQ: apps and sites you let use your camera or microphone, such as video calls, bypass WARP and see your real IP address.

Cloudflare's record has blemishes, though none exposed app users. In November 2023 what Cloudflare believes was a nation-state attacker used credentials leaked in an October 2023 Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's internal wiki, bug tracker and some of its source code. Cloudflare says no customer data or systems were affected. In September 2025 it disclosed that Fina, a Croatian certificate authority, had issued 12 certificates for 1.1.1.1 without permission between February 2024 and August 2025. Using them would have needed a device that trusted Fina plus an attacker on the network path, and Cloudflare saw no sign of abuse. The resolver also went down worldwide for 62 minutes on 14 July 2025 because of a configuration error.

The Italian piracy fine

Cloudflare's one recent clash with a regulator is not about user privacy. In January 2026 Italy's communications regulator, AGCOM, fined it €14.2 million under the Piracy Shield law for refusing to block domains and IP addresses reported by rights holders on the 1.1.1.1 resolver. Cloudflare appealed on 8 March 2026, arguing the fine should have been capped at €140,000. The regional administrative court for Lazio, in Rome, rejected its challenges in June 2026, and Cloudflare said it would take the case to the Council of State, Italy's top administrative court. Cloudflare has threatened to remove its servers from Italy if it loses. We take a small deduction for a fine that names the service, but this is a copyright case, and the harm alleged is to rights holders, not users.

Getting the most out of it

1. Pick the mode you need. "DNS only" encrypts lookups alone; "Traffic and DNS" (WARP) tunnels everything and is the one to use on public Wi-Fi.
2. For a family device, turn on 1.1.1.1 for Families in the DNS settings to block malware and, if you want, adult sites.
3. Do not use WARP to hide who you are. Sites still see a Cloudflare address tied to your region, and anything you log in to knows it is you.
4. Remember that video calls skip the tunnel and reveal your real IP address.
5. Parents who rely on router or school filters should know WARP can bypass them, as any VPN can.

How we scored it

The regulatory record (85) is the highest factor even after the deduction for the Italian piracy fine. Privacy (84) is close behind, helped by a label with nothing linked to you, 25-hour resolver logs and a published audit, held back by the audit's age and WARP's lack of one. Transparency and control (83) and security (82) follow, and scams and harmful content (80) is the lowest, mainly because WARP can get around family network filters. It sits above NordVPN (79), which has more audits but a late-disclosed breach and links a user ID to its own marketing.