VPN Phone Battery: The Radio, Not the Logo

A tunnel is extra packets and extra wakeups. The phone already had a radio. The VPN asks that radio to stay useful: keepalives, handshakes, encrypted payloads instead of clear payloads. Encrypted payloads are not magically heavier in a way you can feel on every site. Wakeups are. If the client pokes the network every few seconds, the modem never dozes. If the client is quiet and WireGuard is idle, drain can be boring. Idle is the word vendors skip because idle does not screenshot well.

The status-bar icon is not a battery setting. It is a reminder that a peer exists. iOS and Android will still blame VPN in the battery screen because that is the process that held the interface. The process is guilty of existing. The radio is guilty of working. Split them when you debug. If battery says Maps used 40 percent and VPN used 8, do not rewrite history so the tunnel ate Maps. If battery says VPN used 40 and you had always-on plus a flaky SSID all afternoon, believe it.

I will not walk Android lockdown steps here. That walkthrough exists. Here the claim is simpler: a tunnel uses radio. Always-on uses more. A logo on a landing page uses none. Farms that print military-grade encryption as a battery feature are selling a feeling. Encryption is why you bought the tunnel. It is not a sleep mode.

Klox does not publish milliamps. Neither should you quote a blog percentage as if it were your Pixel. Screen brightness, age of the cell, 5G versus LTE, a chat app that never stops, a bad captive portal: those move the graph more than your choice of marketing adjective. Debug the radio. Then debug the client. Then, maybe, switch protocol.

Connecting costs more than sitting connected. The handshake is CPU, a burst of packets, maybe a DNS lookup through the tunnel once the peer is up. If you connect once in the morning and leave WireGuard idle, you paid that burst once. If the tunnel dies every two minutes and reconnects, you paid it all day. Flaky Wi-Fi plus a kill switch is a reconnect factory. The factory is hot.

Idle WireGuard on a stable network can be cheap enough that you stop noticing. Cheap is not free. The peer still exists. The interface still exists. Some phones will still attribute a slice to VPN. If that slice is small and the phone lasted the day, you do not have a battery incident. You have a status bar. People who need the hop should keep the peer. People who connected out of habit on the couch might disconnect. That is a later section. Here the split is: one handshake, or a hundred.

OpenVPN handshakes are heavier in lived experience on a phone. More moving parts. More CPU while it comes up. If your commute is a captive portal every train, you are handshake-rich. Pause, garden, connect, like the cafe article. Then leave it up. Do not toggle Connect for fun. Toggling is how you turn a light peer into a workout.

DNS through the tunnel happens after you are up. It is not a second VPN. It should not be a second battery product. If DNS is broken, apps retry. Retries wake the radio. A misconfigured session can drain you without a single website loading. Confirm a boring site works after connect. Then put the phone in a pocket. Debugging DNS in a pocket is how you get a hot pocket and no mail.

Always-on means the OS will not give you a network without the tunnel. That is a security choice. It is also a battery choice. The phone cannot take a nap that includes 'skip the VPN for a minute.' Every wakeup that wanted NTP, push, or a background refresh now wants a handshake first if the peer was dead. On a solid home Wi-Fi that tax can be small. On a train that reassociates every tunnel, the tax is the whole day.

I will not walk the Android settings. The always-on article does. Here: if you turned it on, you bought the tax. If you did not, do not blame always-on. Smart Connect, if the row exists, is untrusted Wi-Fi only. That is a lighter tax than always-on everywhere. Home can stay manual. Cafes auto. The phone sleeps on the couch SSID you marked trusted. That is the compromise I actually like. If the row is missing, you live on the button. The button does not drain you while it is off.

Kill switch is not always-on. Kill switch is fail-closed when the tunnel dies. It can cause retry loops. It does not save battery. People turn it on because it sounds like a power feature. It is a leak feature. If the switch is fighting a portal, you get zero useful traffic and a busy radio. Pause it. The cafe and airplane pieces already said this. On a phone in your pocket the same deadlock is quieter and more expensive because you do not notice until 4pm.

I will not invent an On Demand toggle for Klox consumer. Some other vendors have a named switch. If your Klox build does not show it, it does not exist on that build. Do not write into a ticket asking us to enable a screenshot from another brand.

Lived experience, not a lab. WireGuard is usually gentler on a phone. Faster handshake. Less user-space thrash. Cooler pocket. OpenVPN still exists because some networks hate UDP and some networks want TCP. Then you take the heavier path on purpose. You will feel it on a long day. You will also get a route. Battery is not the only score.

Do not protocol-hop as a personality. WireGuard until it is rude. OpenVPN when it is. Back to WireGuard on the next normal network. Collecting protocols on a commute is fidgeting, and fidgeting is handshakes, and handshakes are drain. The speed article can talk throughput. Here, OpenVPN is the spare tire that costs warmth.

I will not quote a percentage difference. I will not quote a city. I will not quote a dedicated-IP SKU as a battery feature. We do not sell a Klox dedicated-IP consumer line. Exit choice can change latency. Latency is not milliamps by itself. A far exit that causes timeouts and retries is milliamps. If WireGuard is stable, leave the server alone. Fidgeting through a list is another reconnect factory.

Five devices: the phone is one. The laptop on OpenVPN is a different battery, a different article. Do not debug the phone by changing the laptop protocol. Per device. Per radio.

Mail, chat, maps, OS updates: they already wanted the radio. A VPN does not invent push. It wraps it. If you wrapped a chatty app, the radio still wakes for the chatty app. The battery screen may still say VPN because the traffic left through the interface. That accounting is honest and misleading at the same time. Honest: the packets went through the tunnel. Misleading: turning the tunnel off would not have stopped the chatty app. It would have stopped the wrap.

Test like an adult. Same day shape, tunnel off, see if the graph recovers. If it does not, the VPN was a convenient villain. If it does, you found a real tax. Then decide whether the hop is worth it. I still connect on networks I do not run. I disconnect on the couch more often than a lockdown blog would like. That is a bias. I am stating it.

WebRTC leak blocking and IPv6 leak protection do not explain a 40 percent cliff. They are small compared with a screen and a modem. If a page is spinning on WebRTC in a browser you left open, that is a browser tab, not a VPN SKU. Close the tab. DNS through the tunnel should not keep a modem hot by itself. Broken DNS will, because every app retries. Fix the session before you hunt leak features as a battery story.

Cookies in apps are not Klox's cookie page. Our cookie policy is the website. Push tokens and app cookies live on the phone. A tunnel does not delete them and does not charge them milliamps in a special way. Do not mix CMP language into a battery ticket.

Disconnect when you are on a network you trust and you want the phone to last. Home Wi-Fi you ran. Maybe work Wi-Fi you already hate for other reasons, with a clear-eyed skip. I still tunnel on cafe Wi-Fi. I still tunnel on inflight Wi-Fi after the airline page. I do not treat the couch as a cafe. Skip is not a personality flaw. Skip is a battery decision you can name.

Disconnect when the radio is already dying: 8 percent left, a long night, maps on, you need the handset to ring. The hop can wait. Cellular with a tunnel is still cellular. This is not the billing article. You can owe the carrier money and still disconnect to save the cell. You can also stay connected and carry a charger. I carry a charger. I also disconnect when I am being precious about a dying phone.

Do not disconnect because the app felt slow once. Switch protocol. Move seats. The speed piece is next door. Do not disconnect because a farm said VPNs always drain 30 percent. Measure your day. Do not disconnect as a substitute for a stolen-phone remote logout. If the phone is gone, that is a portal kick, not a battery setting.

Smart Connect, if you have it, can disconnect you from the tax at home if home is trusted. That is the point of the row. Always-on fights that point. Pick one philosophy per day. Mixing always-on plus trusted-SSID exceptions is the Android article. Mixing them in your head without looking at the glass is how you get a hot phone and a story that does not match the toggles.

A bright screen. A dead battery that was already old. 5G hunting in a basement. A navigation session. A camera. A cheap case that cooks the back. An OS update overnight. A chat app. A live wallpaper you will not admit to. Blame those before you write a novel about WireGuard.

A VPN cannot make the cell tower closer. It cannot make Android's battery accounting pretty. It cannot stop you from leaving maps on in a pocket. It cannot replace a charger. It cannot match a farm's lab phone. It cannot be a custom DNS picker we do not ship. It cannot be an IAP SKU that saves milliamps. It cannot be a dedicated IP that cools the modem. Those products, where they exist at other vendors, are not Klox consumer facts.

Malware can drain a phone. A tunnel does not remove it. If the graph went feral after a sideload, look at the sideload. Phishing does not drain milliamps. It drains accounts. Different article. Portal splash deadlock drains you because the radio retries. That is the VPN stack interacting with a garden, which we already covered. Fix the garden. Do not uninstall as the first move.

Seven-day money-back on first purchase is for trying the apps, including whether your phone stays livable. If the phone cooks on WireGuard idle at home, write in with the OS, the protocol, and whether always-on was on. Do not invent a SOC 2 complaint. Do not invent an SLA percentage we owe your battery. We do not publish one. If you are inside the clock and the product is unusable on your handset, use the window. If you are outside the clock, debug. Renewals are not that window.

Pick two ordinary days. Same commute shape if you can. Day A: WireGuard, always-on off, Smart Connect only if you have the row and you understand it. Day B: tunnel off. Do not also change screen brightness, do not also install three games, do not also switch from LTE to 5G as a personality. You are trying to see a difference, not win a science fair.

Write down where you were. Home, cafe, train. If day A includes a captive-portal deadlock and day B does not, you did not test the tunnel. You tested the garden. Pause the switch, finish the splash, then count hours. If OpenVPN was on for day A because WireGuard failed, note that. OpenVPN days are warmer. That is expected.

I will not give you a spreadsheet template. I will not give you a mAh meter ritual. The phone's battery screen plus whether you reached night is enough. If you reached night with the tunnel and you needed the hop, you are done. If you did not reach 4pm and day B did, you found a tax. Then: WireGuard not OpenVPN, always-on off on trusted nets, kill switch not looping, disconnect on the couch. In that order. Do not start at uninstall.

The phone is one of five seats. Testing does not require a family seating chart. It requires one handset and two days. If a tablet at home is holding a session, that is not this phone's battery. That is a seat. Different heat. Different gadget. Look at the list if Connect fails. Look at the radio if the percentage fails.