Turbo VPN

Is Turbo VPN safe?

Not if privacy is the reason you want a VPN. Turbo VPN, with more than 500 million downloads on Google Play, hides your traffic from the café Wi-Fi you are sitting on, but it hands a lot of trust to a developer that has not been open about who owns it, and independent researchers found weaknesses that can undo the encryption. We score it 42/100, about half of what NordVPN gets.

Three findings drive that score. A 2025 academic study found a single password built into the Android app that can be used to decrypt Turbo VPN traffic. The same study saw the app send users' ZIP codes to the developer while its policy said it collects no addresses. And the Tech Transparency Project (TTP), a US watchdog group, traced the Singapore developer back to Qihoo 360, a Chinese security company the US government has sanctioned.

Who owns Turbo VPN?

The App Store lists Innovative Connecting Pte. Ltd., with an office in Asia Square, Singapore, and the privacy policy says Singapore law applies. That is as far as the app goes.

In April 2025 TTP reported that Singapore corporate records name a single shareholder, Lemon Seed Technology Ltd. in the Cayman Islands. A 2019 annual report Qihoo 360 filed in Shanghai said it bought Lemon Seed and two other companies for US$69.4 million. Qihoo 360 said it sold them in September 2020, but filings from March 2025 for Lemon Seed, Innovative Connecting and two sister VPN developers still listed one director whose name TTP linked to a Qihoo 360 employee.

Why it matters: the US Commerce Department put Qihoo 360 on its Entity List in June 2020 over military end-use concerns, and the Defense Department lists it as a Chinese military company. China's 2017 intelligence law can require companies to help state intelligence work. A VPN sees which sites you connect to, so the owner's jurisdiction is not an abstract point. TTP checked again in May 2025 and found Turbo VPN still on the US App Store, with more than $5 million in estimated lifetime US revenue there.

Is Turbo VPN's encryption secure?

The strongest evidence comes from "Hidden Links", a paper presented at the FOCI 2025 workshop by researchers from Arizona State University and Citizen Lab. They took apart eight VPN apps from Innovative Connecting and two sister developers, Autumn Breeze and Lemon Clove, and found nearly identical code and shared servers.

For Turbo VPN they found:

• A hard-coded password. The Shadowsocks setup in the Android app uses a password built into the app and shared by every user of Turbo VPN, Turbo VPN Lite and VPN Monster. Anyone who extracts it and can watch the link between you and the VPN server can decrypt your traffic. The authors say this can leave users more exposed than using no VPN at all.
• A deprecated cipher. That configuration uses rc4-md5, one of Shadowsocks' outdated options.
• Connection inference. All eight apps were open to a "blind in/on-path" attack that lets someone on your network work out who you are talking to and interfere with connections.

The paper tested Android versions, and it does not say whether the flaws were fixed. Turbo VPN has published no independent security audit or no-logs audit, unlike VPNs that pay outside firms to check their claims.

What data does Turbo VPN collect?

The labels disagree. Apple's privacy label lists email, user content, a user ID, usage data and diagnostics, all marked as not linked to you, and no tracking. Google Play's data safety section says device IDs are shared with other companies for advertising.

The privacy policy, last updated in June 2025, is closer to Google's version. It says the free app is funded by ads from AdMob, Liftoff, InMobi, Unity, Bigo Ads and TradPlus, and that these partners "may otherwise collect or have access to data about you which they may collect over time and across different online services". It also uses Adjust to measure ad campaigns and Firebase for analytics. We scored privacy on the policy, because it discloses more than the Apple label.

Then there is the ZIP code. The Hidden Links researchers saw the app look up the ZIP code of the user's public IP address and upload it to a Firebase endpoint, even when the app had no location permission. The policy said it does not collect users' addresses.

Snap VPN, a sister app

Snap VPN, published on Google Play by Autumn Breeze Pte. Ltd., is one of the eight apps in the Hidden Links study. The researchers found near-identical code to Turbo VPN's, and servers of all three developers accepted the same hard-coded credentials, which is how they confirmed the shared infrastructure. In June 2025 TTP reported that Apple pulled Snap VPN from its store after the Financial Times asked about the apps' Qihoo 360 links. Snap VPN remains on Google Play, with more than 50 million downloads and an update in September 2026. Autumn Breeze told TTP that it is incorporated in Singapore, "operates independently" and "has no affiliation with Qihoo 360". A newer App Store app called "Snap VPN" comes from a different developer, Arct Technology LLC.

Safer ways to use a VPN

1. If you need a VPN for privacy rather than just reaching a blocked site, pick one with a published independent audit and a clear owner. NordVPN, for example, has passed six no-logs assessments since 2018.
2. If you only want encrypted DNS and a quick tunnel on public Wi-Fi, Cloudflare's 1.1.1.1 app is free, has no ads and publishes its privacy terms.
3. If you keep Turbo VPN, use it only on networks you do not control, never for banking or work logins, and remember that HTTPS on the sites themselves is doing most of the protecting.
4. Avoid the Shadowsocks-based modes. The study's authors say users who value privacy should avoid this family's Shadowsocks connections.
5. Cancel auto-renewal in your Apple or Google account settings if you buy a plan. On the App Store a month costs $11.99 and a week $9.99, so the weekly plan is the most expensive way to pay.

How we scored it

Security (28) and privacy (30) are Turbo VPN's weakest factors, driven by the shared hard-coded password and the undisclosed ZIP code collection. Transparency and control (45) is low because the ownership chain TTP found appears nowhere in the app or policy. Its best factor is the regulatory record (85): no regulator has fined or ordered it, though we treat the Qihoo 360 sanctions as context.