VPN for China 2026: Which VPNs Work, eSIM Alternatives, and the Complete Pre-Trip Checklist

Jump to

What exactly is blocked in China, and what still works?

The Great Firewall blocks Google, Meta, most Western news, and many messaging apps, but Chinese services and a handful of international tools work without restriction. The Great Firewall blocks the entire Google stack (Search, Gmail, Drive, Maps, Translate, YouTube), all Meta properties (Facebook, Instagram, WhatsApp, Messenger), X (Twitter), most Western news outlets (NYT, BBC, Reuters, Bloomberg), Reddit, Wikipedia (intermittently), Telegram, Signal, and many cloud-hosted business tools. What still works without a VPN: Bing search, Apple Maps, Apple Music, Booking.com, Hotels.com, LinkedIn (Microsoft-owned, generally accessible), Microsoft 365 and Outlook, Spotify (with occasional gaps), and Steam. All Chinese apps work natively — WeChat, Alipay, WeChat Pay, Didi (ride-hailing), Meituan, Taobao, Baidu, Douyin (TikTok’s domestic twin). For a typical traveler, this means your daily flow needs Google and Meta replacements, and a working VPN fills the gap.

Sources: U.S. Department of State — China travel information, Wikipedia — Internet in China, Great Firewall Report — independent testing

Which VPNs still work in China in 2026?

ExpressVPN remains the most consistent paid option for most travelers, with Astrill and LetsVPN as the strongest alternatives. ExpressVPN’s Lightway protocol with automatic obfuscation handles firewall updates well, and its server network across Hong Kong, Tokyo, and Singapore provides the lowest latency from mainland China. Astrill’s StealthVPN mode is the most aggressive obfuscation on the market and often works when ExpressVPN temporarily fails during crackdown periods. LetsVPN is a smaller, China-specialized provider with a lightweight app and lower price point, though its smaller server pool means fewer fallback options during outages. NordVPN works but requires manually selecting obfuscated servers, and its success rate is notably lower than the top three. Free VPNs — Hola, TunnelBear free tier, ProtonVPN free tier, Windscribe free tier — are blocked at the protocol level and do not connect reliably inside mainland China. Avoid "China-optimized" VPNs from unknown vendors on app stores; many are fronts that collect user data. Stick to well-known paid services with a clear money-back guarantee and a track record of updating against Great Firewall changes.

How effective are the 10 popular VPNs rated as of June 2026?

The table below rates ten widely used VPN services on their real-world performance inside mainland China as of June 2026, based on testing across Shanghai, Beijing, and Guangzhou on both WiFi and mobile data. VPN Service | Status (June 2026) | Best Protocol | Avg Speed (China) | Monthly Price | iOS App | Android APK | Notes ---|---|---|---|---|---|---|--- ExpressVPN | Reliable, 90%+ uptime | Lightway (auto-obfuscation) | 25-40 Mbps | $12.95/mo | Yes, home App Store | Yes, direct download | Most consistent overall; automatic protocol rotation; 30-day money-back guarantee; Hong Kong and Tokyo servers give lowest latency. Astrill | Reliable, 85%+ uptime | StealthVPN | 20-35 Mbps | $15.00/mo | Yes, home App Store | Yes, direct download | Most aggressive obfuscation; often works when others fail during crackdowns; steeper learning curve; pricier than alternatives. LetsVPN | Reliable, 80%+ uptime | Proprietary protocol | 15-30 Mbps | $7.99/mo | Yes, home App Store | Yes, direct download | China-specialized; lightweight app; lower price; smaller server pool means fewer fallback options during outages. NordVPN | Intermittent, 55-70% uptime | Obfuscated servers (manual) | 10-25 Mbps | $12.99/mo | Yes, home App Store | Yes, direct download | Requires manually enabling obfuscated servers under Settings; success rate notably lower than top three; large server network is an advantage when it connects. Surfshark | Intermittent, 45-60% uptime | Camouflage mode | 8-20 Mbps | $10.99/mo | Yes, home App Store | Yes, direct download | Camouflage mode works sometimes; NoBorders mode helps in restricted networks; inconsistent but can serve as a backup. Private Internet Access | Low, 30-45% uptime | WireGuard (multi-hop) | 5-15 Mbps | $9.99/mo | Yes, home App Store | Yes, direct download | Large server fleet but obfuscation is weaker than top providers; multi-hop can help but doubles latency; not recommended as primary. ProtonVPN (paid) | Low, 25-40% uptime | Stealth protocol | 5-12 Mbps | $9.99/mo | Yes, home App Store | Yes, direct download | Stealth protocol introduced in 2025 shows promise but inconsistent in China; strong privacy reputation; free tier is non-functional in China. Windscribe (paid) | Low, 20-35% uptime | Stealth/WStunnel | 5-10 Mbps | $9.00/mo | Yes, home App Store | Yes, direct download | WStunnel protocol wraps in WebSocket; occasionally connects but speeds are poor; free tier blocked outright. Mullvad | Very low, 10-20% uptime | WireGuard with obfuscation | 3-8 Mbps | EUR 5.00/mo | Yes, home App Store | Yes, direct download | Strong privacy model (anonymous accounts); obfuscation not prioritized for China; rarely connects reliably; good for other use cases. Psiphon (free) | Very low, 10-25% uptime | SSH/Obfuscated SSH | 1-5 Mbps | Free | Yes, home App Store | Yes, direct download | Only free option that sometimes connects; speeds too slow for browsing; blocked during political events; useful only as last-resort text messaging fallback.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, Great Firewall Report — independent testing, LetsVPN — official site, NordVPN — obfuscated servers guide

How do paid and free VPNs for China compare in detail?

Free VPNs are not a viable option inside mainland China in 2026 and should not be part of your travel plan. The comparison is stark: paid VPNs invest in obfuscation technology to wrap VPN traffic in TLS/HTTPS so it looks like ordinary browsing, rotate protocols when the firewall learns their signatures (sometimes weekly), maintain server networks with Hong Kong and Tokyo endpoints for low latency, and provide customer support that can guide you to working servers. Free VPNs lack all of these — their protocols are fingerprintable within seconds, their IP ranges are blacklisted preemptively, and they have no infrastructure to respond to blocking events. The cost delta is small: a one-month ExpressVPN or Astrill subscription costs roughly USD $13 and covers an entire trip. Compare that to the cost of being unable to access Gmail, confirm a hotel booking, or reach your bank’s fraud department. If USD $13 is the difference between connectivity and isolation, the choice is clear. The only free option that sometimes works is Psiphon, an open-source circumvention tool — but even Psiphon is blocked during sensitive political periods and offers speeds too slow for anything beyond basic messaging.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, Great Firewall Report — independent testing

Which VPN protocols and connection modes work best in China?

Obfuscated protocols that wrap VPN traffic in TLS/HTTPS are essential — plain WireGuard and OpenVPN are usually blocked outright because their traffic signatures are easily detected. What works is obfuscation — providers wrap VPN traffic in TLS/HTTPS so it looks like ordinary browsing. ExpressVPN calls this "Automatic" mode with Lightway; Astrill uses "StealthVPN" and "Wireguard" with obfuscation; LetsVPN relies on its proprietary protocol; NordVPN requires enabling "Obfuscated Servers" under settings. Most providers rotate these methods as the Great Firewall learns signatures, so the best protocol changes every few months. Keep your app updated — providers ship protocol updates in response to blocking events, sometimes weekly during sensitive political dates. If one protocol stops connecting, switch to another in the app before assuming the service is dead.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, Great Firewall Report — independent testing

How to set up ExpressVPN, Astrill, and LetsVPN before departure

Each of the top three VPNs requires specific configuration steps to maximize reliability inside mainland China. Complete the setup for your chosen provider before you leave home — none of these steps are recoverable after you land on a Chinese network.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, LetsVPN — official site

How do I set up a VPN before arriving in China?

Set up your VPN at home before you board your flight — once you arrive in mainland China, you cannot download or reinstall VPN apps because the App Store and Play Store will show zero results.

What is the before-departure VPN and connectivity checklist?

Complete every item on this list before you leave for the airport — missing a single step can leave you without access to Gmail, WhatsApp, or Google Maps for your entire trip.

How do I install everything before arriving in China?

Do this at home, on your home network, before you board your flight — each step must be completed before departure because none are recoverable after you land.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status

How do VPN, travel eSIM, and international roaming fully compare?

These three approaches solve internet access in China differently — a VPN tunnels through the firewall, while eSIMs and roaming bypass it entirely by routing traffic abroad. The table below compares them across the dimensions that matter most to travelers. Feature | VPN | Travel eSIM (non-CN routing) | International Roaming ---|---|---|--- How it works | Encrypts and obfuscates traffic through the Great Firewall to a server abroad. | Routes all data through a non-Chinese carrier (e.g., Hong Kong, Singapore), bypassing the firewall entirely. | Uses your home carrier’s network; traffic routes through your home country, never touching Chinese infrastructure. Reliability | 80-95% uptime for top providers; drops during political events and firewall updates; requires active management. | 95-99% uptime; independent of firewall; reliability depends on local partner network signal (China Unicom/China Mobile). | 98-99% uptime; most reliable option; depends on roaming agreements between your home carrier and Chinese networks. Speed | 50-70% slower than baseline; 15-40 Mbps on a 100 Mbps connection; video streaming at 1080p max. | 30-50% slower than domestic Chinese speeds; 20-50 Mbps typical; varies by eSIM provider and roaming partner. | 40-60% slower than domestic; 15-40 Mbps typical; throttled by your home carrier’s roaming fair-use policy. Cost | $5-15/month; one-month plan covers an entire trip regardless of data usage. | $5-50 for 1-10 GB packages (7-30 days); pay per GB; can add more data mid-trip. | $10-20/day for most carriers; some offer travel passes at $50-100/month; most expensive per-day option. Setup difficulty | Moderate — must install, configure protocol, and test before departure; 15-30 minutes. | Easy — purchase online, scan QR code, activate before departure; 5-10 minutes. | Easy — call carrier or enable in account settings before departure; 5 minutes. Works for all apps | Yes — tunnels all device traffic; some Chinese apps may slow down when routed abroad. | Yes — all apps work as if you are in the eSIM’s home country; Chinese apps may lag slightly. | Yes — all apps work; no firewall applies to any traffic. Legal status | Gray area — unlicensed personal use is technically illegal but not enforced against tourists. | Fully legal — you are using a foreign carrier’s service, not circumventing Chinese regulations. | Fully legal — you are using your home carrier’s roaming service. Battery impact | High — 15-30% extra drain from constant encryption and frequent reconnects. | Low — no additional encryption overhead; similar to normal data usage on a foreign network. | Low — no additional encryption overhead; roaming radio handoff may add marginal drain. Requires pre-installation | Yes — must install and test before arriving; cannot download VPN apps on Chinese networks. | Yes — must purchase and activate eSIM before departure; cannot download eSIM profiles on Chinese networks without a VPN. | No — can be activated from China by calling your carrier, though this is more expensive and may require a working connection. Best for | Budget-conscious travelers staying 1+ weeks who need unrestricted access and are comfortable troubleshooting. | Short trips (3-14 days) where guaranteed connectivity for messaging and maps is worth the data cost. | Short trips (1-7 days) where cost is not a concern and zero-configuration reliability is the priority.

Sources: U.S. Department of State — China travel information, UK FCDO — foreign travel advice: China, Airalo — travel eSIM store, Holafly — travel eSIM store

Can a travel eSIM or roaming bypass the firewall entirely?

Yes — international roaming and non-China travel eSIMs bypass the Great Firewall entirely because traffic routes through your home country or a foreign carrier. International roaming from your home carrier routes traffic through your home country, so the Great Firewall never applies. The same principle works with travel eSIMs from providers like Airalo, Holafly, Ubigi, and Nomad when you select a non-China roaming profile. Speeds are slower than domestic data and costs vary widely (USD $5-20 per day, or prepaid packages), but connectivity is consistent for Google, Gmail, WhatsApp, and social media without any VPN at all. Key details to verify before purchasing: some eSIMs use China Unicom or China Mobile as the underlying roaming partner, which can still apply firewall rules — read the product details carefully and pick a roaming profile that terminates in Hong Kong, Singapore, or Japan. Nomad and Airalo both offer "Asia" or "Global" eSIMs with non-China routing. This is the cleanest option for travelers who need guaranteed access and are willing to pay a premium for reliability. For a 10-day trip, budget USD $15-50 for a data-only eSIM that covers all essential apps without a VPN.

Sources: U.S. Department of State — China travel information, UK FCDO — foreign travel advice: China, Airalo — travel eSIM store, Holafly — travel eSIM store

What do I NOT need a VPN for in China?

Most of what travelers actually need day-to-day works without a VPN — WeChat, Alipay, Didi, Apple Maps, and Bing cover the essentials. WeChat (messaging, voice, video calls), Alipay and WeChat Pay (mobile payments), Didi (ride-hailing), Meituan (food delivery and hotels), Taobao and JD (e-commerce), Baidu Maps and Apple Maps (navigation), 12306 (train tickets), Trip.com (flights and hotels), and Douyin all run on Chinese infrastructure with no restrictions. Apple iMessage and FaceTime generally work. Bing works for English search. If your home bank has a mobile app that does not rely on Google services, it usually connects fine. The honest case for a VPN is narrower than people assume: Gmail and Google Workspace, Google Maps (if you prefer it over Apple or Baidu), WhatsApp and Instagram for staying in touch with people back home, and any news or work tool hosted on blocked infrastructure. Plan around the apps that already work.

Sources: Wikipedia — Internet in China, Great Firewall Report — independent testing

How much data and battery does a VPN use in China?

A VPN adds 10-20% more data usage and 15-30% extra battery drain per day from constant encryption overhead and frequent reconnection cycles. Expect roughly 10-20% more data usage than unmetered browsing because VPN traffic is encrypted and obfuscated, which adds overhead. A typical day of messaging, maps, and light browsing burns 200-500 MB through a VPN; streaming video can hit 2-4 GB per hour. Battery impact is more noticeable — constant encryption and frequent reconnects (every 30-90 minutes) drain an extra 15-30% over a day, especially on older phones. Mitigations: turn the VPN off when using only Chinese apps (WeChat, Alipay, Didi all work without it), choose nearby servers to reduce latency-induced retransmits, carry a 10,000-20,000 mAh power bank, and pre-download maps and entertainment before you leave home. Hotel WiFi is metered differently — most Chinese hotels include it free, but business hotels may throttle or require re-authentication every 24 hours.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status

What should I do if my VPN keeps disconnecting?

Switch servers, rotate protocols, force-quit the app, and use a backup provider — connection drops every 30-90 minutes are normal in China and usually fixable within a few minutes. Switch servers (Hong Kong, Japan, Singapore are usually fastest), try different protocols (WireGuard, OpenVPN, or the provider’s "stealth" mode), and have a backup mobile hotspot from a different provider. Connection drops are normal — reconnect every 30-90 minutes. Save offline copies of important documents (boarding passes, hotel bookings) in case you cannot reconnect at a critical moment.

What are the common VPN problems and how do you solve them?

Most VPN issues inside China have specific causes and straightforward fixes — use this table to diagnose and resolve problems without needing internet access to search for help. Problem | Diagnosis | Fix ---|---|--- VPN app won’t connect at all | Protocol signature blocked by firewall update; or server IP blacklisted. | Switch protocol in app settings (e.g., Automatic > StealthVPN > WireGuard). If none work, switch server region (try Hong Kong > Tokyo > Singapore > Los Angeles). Wait 5 minutes between attempts — rapid reconnection triggers rate limiting. VPN connects but no internet | DNS leak or split-tunnel misconfiguration; VPN tunnel is up but DNS queries route through Chinese DNS servers unfiltered. | Enable "DNS leak protection" in VPN settings. Toggle airplane mode on/off for 10 seconds to reset network stack. Switch from WiFi to mobile data or vice versa to rule out network-specific blocking. VPN connects but specific apps don’t load | App-level blocking or CDN geo-restriction; some services block known VPN IP ranges. | Switch to a different server in the same region. For Netflix/streaming, try servers in your home country instead of Asia. Clear the app’s cache in device settings. VPN worked yesterday, dead today | Firewall signature update overnight; your VPN’s current protocol fingerprint is now recognized. | Update the VPN app — providers push protocol updates within 6-24 hours of major firewall changes. If no update available, switch to a different protocol. Check the provider’s status page or Twitter/X account from hotel WiFi. Hotel WiFi blocks VPN | Hotel network uses deep packet inspection or blocks non-standard ports; some hotels restrict VPN protocols on their guest network. | Try mobile data instead. If mobile data also blocked, ask hotel front desk for a wired connection (Ethernet) which is often less restricted. Use your travel eSIM or international roaming as a temporary fallback. Some hotels offer a "business" WiFi tier with fewer restrictions. Battery drains extremely fast | VPN encryption is CPU-intensive; frequent reconnects keep the radio active and processor engaged. | Turn VPN off when using only Chinese apps (WeChat, Alipay, Didi). Select a nearby server (Hong Kong) to reduce latency and retransmission overhead. Enable battery optimization for the VPN app in device settings. VPN download mirror is blocked | The provider’s website is itself blocked by the Great Firewall, creating a catch-22. | Use the mirror URLs you saved before departure (providers maintain alternate domains specifically for users inside China). If you didn’t save mirrors, connect to hotel WiFi and try the provider’s site there. As a last resort, use the Tor Browser (download before travel) to reach the mirror. Cannot receive 2FA SMS codes | Your home SIM has no signal in China or SMS delivery is delayed across international gateways. | Use the 2FA backup codes you saved before departure. Switch 2FA to an authenticator app (Google Authenticator, Authy) which works offline. For banking 2FA, call your bank’s international number via hotel phone or Skype credit. VPN works on WiFi but not mobile data | Carrier-level blocking on China Mobile, China Unicom, or China Telecom; mobile carriers apply different filtering than fixed-line ISPs. | Switch protocol to TCP-based mode (StealthVPN TCP on Astrill, or OpenVPN TCP). Mobile carriers sometimes block UDP traffic more aggressively than TCP. If persistent, rely on WiFi at hotels and cafes, and use mobile data only for Chinese apps without VPN.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, Great Firewall Report — independent testing

What do I do when my VPN stops working mid-trip?

VPN outages are normal and usually temporary — follow this step-by-step recovery procedure before assuming your service is dead. Most outages resolve within 6-24 hours as providers push protocol updates.

Sources: ExpressVPN — China connectivity guide, Astrill VPN — China server status, Great Firewall Report — independent testing

Is using a VPN legal in China?

Technically, only government-approved VPNs are legal, but enforcement targets commercial providers and corporate users — not individual tourists checking Gmail. In practice, enforcement targets providers, not individual travelers. Thousands of foreigners and Chinese citizens use VPNs daily. Do not discuss VPN use on Chinese social media (Weibo, WeChat), and avoid torrenting or accessing politically sensitive content. Tourist use for Gmail and Google Maps is tolerated.

Is it actually illegal for tourists to use a VPN?

No tourist has been prosecuted solely for using a personal VPN to access Gmail, Google Maps, or social media — enforcement targets unlicensed commercial operators, not short-term visitors. China’s 2017 and 2024 regulations target unlicensed commercial VPN operators and companies routing business traffic through unapproved channels — not individual short-term visitors. The realistic risk for travelers is service disruption, not legal action. Border checks occasionally inspect phones, but VPN apps are not on any enforcement list and immigration does not search for them. Use common sense: avoid torrenting copyrighted material, do not post political content on Chinese platforms, and do not run a VPN-dependent business while on a tourist visa. If you are traveling for work, your employer should arrange a properly licensed enterprise connection. Carry your VPN subscription confirmation in case customs asks, which is rare.

Sources: U.S. Department of State — China travel information, UK FCDO — foreign travel advice: China, Reuters — China coverage

Can I use my corporate or university VPN in China?

Often yes — properly licensed enterprise VPNs registered with Chinese authorities route through approved gateways and usually work reliably, sometimes faster than consumer VPNs. If your employer issues a Cisco AnyConnect, GlobalProtect, or similar corporate client, it should connect, though you may need to use a dedicated China endpoint your IT team provides. Unlicensed consumer-grade corporate VPNs face the same blocking as personal services. If your work depends on Google Workspace, Slack, Zoom, or Microsoft 365 with non-China tenancy, confirm your corporate VPN handles that traffic — some companies split-tunnel and only route internal traffic through the VPN, leaving Google still blocked. Test with your IT team before travel.

Sources: U.S. Department of State — China travel information, UK FCDO — foreign travel advice: China, Reuters — China coverage

Are there VPN alternatives that work without a VPN?

Some international services are accessible in China without a VPN, and hotel WiFi often reaches blocked sites better than mobile data — but no free workaround replaces a VPN for Google and Meta apps. Some services are accessible in China without a VPN: Microsoft Bing, Apple Maps, Apple Music, Booking.com, Hotels.com, WhatsApp (intermittently), LinkedIn. Hotel WiFi often reaches blocked sites better than mobile data. International roaming from your home carrier typically bypasses the firewall but at high cost (USD $10-15/day).