VPN Potato

Is VPN Potato safe?

It is a risky choice if privacy is the point. VPN Potato, also sold as PotatoVPN, encrypts your connection to its servers and works as a quick way past a blocked site, but you are trusting an operator that is hard to identify, whose store labels contradict each other, and whose app shared code and keys with another VPN in a 2025 study. We score it 49/100.

That puts it a little above Turbo VPN (42), where researchers showed outright that traffic could be decrypted, and far below audited services such as NordVPN (79). We rate our confidence as low because so little about the company is public.

Who is behind VPN Potato?

The answer depends on where you look. The App Store and Google Play list the developer as Free VPN Potato Pte. Ltd. The website footer, privacy policy and bug bounty page say FastPotato Pte. Ltd. The terms of service say claims are governed by Singapore law. The policy says most data sits on servers in the European Union and is accessed from Singapore when needed.

Singapore's company register, which the government publishes as open data, does list Free VPN Potato Pte. Ltd., set up in July 2019 with a registered address on Anson Road in the city's business district. It has no current entry under the FastPotato name, so the two names most likely refer to one company that changed its name. The open register does not show who owns it.

Independent researchers dug further. In "Hidden Links", a paper presented at the FOCI 2025 workshop by researchers from Arizona State University and Citizen Lab, the authors searched OpenCorporates and found no business filings for Fast Potato. Instead they found its Android app was built from the same parts as X-VPN, which was then published by Free Connected Limited, a Hong Kong company; since July 2025 X-VPN's listing and policy name LIGHTNINGLINK NETWORKS PTE. LTD. in Singapore (X-VPN). Both apps contain the same hard-coded pre-shared key, load the same oddly named native library from a class with the same name, and use the same obfuscation to resist analysis. The authors grouped the two as one family.

We do not know who the ultimate owner is, and neither did the researchers. That alone matters for a VPN, which can see which sites you connect to.

Is VPN Potato's connection secure?

The study gives a partial picture. Both VPN Potato and X-VPN use a custom tunnelling protocol over port 53, the port normally used for DNS, with obfuscated data that is not real DNS. The researchers think this helps it slip past firewalls. Both apps also put most of their code in native libraries with anti-reverse-engineering measures, leaving little in the Java code beyond advertising and analytics imports.

They confirmed one flaw. Both apps were open to a "blind in/on-path" attack, which lets someone on your network infer who you are connecting to. They did not analyse the cryptography itself, so the paper does not say whether the hard-coded key lets anyone decrypt traffic, as it did for Turbo VPN.

PotatoVPN runs a bug bounty that pays $50 to $500 per valid report, a small amount for a security product. It has published no independent security audit and no no-logs audit.

What data does VPN Potato collect?

Its three disclosures do not match.

Apple's label and the policy both show advertising partners getting data, which the Google Play statement of no sharing does not reflect. We scored privacy on the broader disclosures. The policy's promise that it never collects your IP address or the servers you use is reassuring on paper, but nobody outside the company has checked it.

How to use it more safely

1. Use it only to reach a blocked site or on public Wi-Fi, never for banking, health or work logins. HTTPS on the sites themselves still protects what you type.
2. If you want a free tunnel without ads, Cloudflare's 1.1.1.1 app publishes its privacy terms and has an audited DNS resolver.
3. Do not let children install it. The terms bar anyone under 18 even though the App Store shows 4+.
4. In Android settings, turn off ad personalisation and reset your advertising ID, since ad networks are part of how the free version is paid for.
5. If you subscribe, check which store or payment service holds the renewal. The terms say refunds are only guaranteed within 30 days of the first purchase.

How we scored it

Privacy (38) and security (40) are the weakest factors: ad data goes to third parties, the store labels conflict, and a 2025 study found a hard-coded key and a connection-inference flaw. Transparency and control (50) suffers from the unclear operator. The regulatory record (85) is its best factor, simply because no regulator has looked at it.