Here’s the bottom line in this VPN security guide for beginners: treat your subscription link like a credential, check both the network and the website when using public Wi-Fi, and share only what’s needed to create an account or get help. A connected icon doesn’t mean every app is protected, and it doesn’t replace checking for phishing pages, verifying where your client came from, or avoiding password reuse.
What your password and subscription link protect
Your username and password are typically used to sign in to the account dashboard, view your plan, manage your account, or get configuration details. A subscription link lets a client download server configurations and may contain an account token. Downloaded configurations may also include server addresses, authentication passwords, or other connection credentials. Someone with the link might not be able to sign in to your dashboard, but could still retrieve and use your routes. Don’t share it publicly as if it were an ordinary URL.
A QR code isn’t a safer way to share credentials. If it encodes a subscription URL or an individual server configuration, anyone who scans it may still obtain the credentials. Screenshots, clipboard syncing, chat histories, and cloud backups can all leave behind copies. After copying, check the shared device’s clipboard history. When saving a configuration, make sure it isn’t stored in a publicly shared sync folder.
| Information type | Primary use | Risk if exposed | How to protect it |
|---|---|---|---|
| Username and password | Sign in to the account dashboard | Someone could access the account and obtain settings or credentials | Use a unique password and store it in a trusted password manager |
| Subscription link | Get and update server configurations | Someone could download the configuration and use the route | Import it only into a trusted client; don’t post it publicly |
| Server configuration and QR code | Import specific connection settings | Connection credentials could be reused directly | Don’t share screenshots or upload unredacted troubleshooting logs |
| Public guide URL | Read setup and configuration instructions | Usually contains no account authorization details | Before sharing, check for account tokens or private parameters |
Sensitive information in a URL isn’t always limited to what comes after the question mark; it can also appear in the path. Removing query parameters alone doesn’t fully redact a link. If you’re unsure, describe the error in words instead of sending the original URL.
Importing a client: verify its source before providing credentials
Before importing, make sure the client came from its official release channel or a trusted app store. Avoid unknown installers and guides that ask you to disable system protections. VPNTU’s client downloads are available on the account dashboard download page; sign in to get your subscription. For import instructions, see the Guides. Don’t sign in to your account through an unfamiliar website on your behalf.
The subscription format must be supported by your client. Shadowsocks, VMess, Trojan, and VLESS are distinct proxy protocols; changing a label won’t convert one into another. Whether a connection is encrypted or uses TLS also depends on the protocol and transport settings. For example, VLESS does not encrypt content on its own; it needs an appropriate secure transport layer. Don’t remove certificate checks or transport settings just to make a configuration appear to work.
Some online subscription-conversion sites ask you to submit the full link, which may expose your account credentials to them. Prefer compatible configurations provided by the service or import options built into a trusted client. If conversion is necessary, first understand where it happens and who can see the input. Don’t rely solely on a page’s claim that processing happens locally.
- ✅ Check the download source, app publisher, and subscription format; keep system security checks enabled.
- ✅ After importing, check the server, routing mode, and DNS settings—not just whether the client says it’s connected.
- ❌ Don’t submit a full subscription to unfamiliar online conversion, speed-test, or configuration-diagnosis sites.
- ❌ Don’t disable TLS certificate verification to clear an error or install root certificates from unknown sources.
Public Wi-Fi: risks beyond the tunnel
Weak signal isn’t the only concern with public Wi-Fi. A hotspot with a familiar-looking name may not be provided by the venue, and its sign-in page could impersonate another service. Confirm the network name with staff before connecting, and turn off automatic joining when it isn’t needed. If you have to authenticate through a captive portal, check what the page is for and don’t enter credentials for other websites there.
A properly configured encrypted tunnel can reduce local network monitoring or interference with traffic carried through it, but the protection depends on the actual routing. HTTPS protects the connection between your browser and the destination website; it serves a different purpose. If you see a certificate warning, stop. A VPN connection is no reason to keep entering passwords. If the page is a phishing site, the tunnel will simply carry your information to the wrong site.
The hotspot operator may be able to see connected devices and metadata about their communication with the tunnel server. The service provider is also part of the network trust chain. A VPN doesn’t prevent identification through website accounts, browser cookies, or device fingerprinting. On public networks, turn off unnecessary file sharing and device discovery. If your system allows it, select the public network profile to avoid exposing local shared resources to other devices on the same network.
For payments, account recovery, or sensitive files, switch to a trusted network if you can’t verify the hotspot. After leaving, you can forget the network to reduce the chance of automatically reconnecting later. A connection tool handles the data path; it can’t determine whether every website, attachment, or app is trustworthy.
Split tunneling and DNS: why a connection still needs checking
Proxy clients commonly offer rule-based modes that decide whether traffic goes through the proxy or connects directly based on the domain, destination address, or app. This helps manage everyday traffic, but also means not every request necessarily enters the tunnel. If an app still connects directly, a rule may have matched it—or the app may be bypassing the system proxy. A working browser connection doesn’t tell you how other apps are routed.
Windows and macOS clients may use the system proxy or offer a virtual network adapter mode. The former mainly affects apps that follow system proxy settings; the latter can carry more traffic, but is still subject to routing, exclusion rules, and DNS settings. Mobile operating systems typically use a system VPN interface. Check the client and the system’s per-app settings to understand what’s covered; don’t infer coverage from the platform name alone.
A DNS leak generally means domain lookups aren’t taking the expected protected route and are instead handled by a local or otherwise unintended resolver. Lookup requests may reveal the domains you visit, but that isn’t the same as exposing the contents of an HTTPS page. Encrypted DNS built into a browser, the system resolver, and DNS handling by the client may follow different paths, so check the configuration as a whole.
To verify routing, review the client’s rule-match log and check your exit route and DNS resolution path without sharing private configuration details. A test only shows what happened at that time for that app; it doesn’t prove all traffic is protected. If you want traffic to stop rather than connect directly when the VPN drops, confirm that the client or system supports and has enabled the relevant blocking feature, then test it. A reconnect setting isn’t the same as drop protection.
Creating an account and getting help: what not to share
VPNTU doesn’t require an email address; you can create an account with a username and password. Use a password you don’t use on other sites, so a breach elsewhere won’t put this account at risk. Your username also doesn’t need to match a public handle that identifies you. Not needing an email address doesn’t mean you can afford to lose your credentials: keep your account details safe and check the recovery options available in the dashboard.
Technical support usually needs the client name, operating system, exact error text, and what you were doing when the issue occurred—not your account password, full subscription link, or browser login cookies. Crop account identifiers, subscription URLs, and QR codes out of screenshots. Logs may contain visited domains, server addresses, or authentication parameters; inspect them before sending, and never paste a full configuration into a public comment.
Installing a proxy client generally doesn’t require you to give identity documents, card details, or credentials for other websites to an unfamiliar guide page. Keep payment steps separate from technical support: provide necessary information only through a verified, legitimate process. Don’t let strangers ask for payment verification details or remote access to your device under the pretext of “fixing” a route. Stop if a request seems suspicious and verify it through support on the site.
What to do if your subscription link is exposed
If you accidentally post a link in a group chat, public repository, or forum, deleting the message can limit further spread, but it can’t retrieve configurations others have already downloaded. The priority is to invalidate the old authorization, not just hide the link. Whether the dashboard supports resetting a subscription, rotating server credentials, or revoking sessions depends on its actual features. If you can’t find the option, contact official support to confirm what steps are available.
- Remove the public post. Note whether the exposed item was a subscription URL, server configuration, or dashboard password, and don’t forward the original credentials again.
- Use the dashboard or contact support to confirm how to invalidate the old subscription and any configurations already downloaded. Generating a new URL alone may not revoke old server credentials.
- If your password was also exposed, change it. If you reused it elsewhere, check those accounts too and revoke old sessions where the option is available.
- Get a fresh configuration on a trusted device and update your clients. Remove public backups, clear shared clipboard history, and delete configuration copies you no longer need.
- Check the traffic and account activity visible in the dashboard. If anything looks unusual, send a redacted description to support for review.
Whether changing your login password also revokes subscription authorization depends on how the service works; don’t assume the two are linked. Afterward, fix the source of the exposure—for example, stop using an untrusted conversion site or change cloud-sharing permissions—so new credentials aren’t exposed the same way.
Route types and encryption labels don’t replace routine checks
IEPL, relay, and direct connection describe routing paths and how routes are organized. They don’t determine how client credentials are stored or confirm a website’s identity. Protocol suitability, certificate verification, and whether routing rules send an app’s traffic through the tunnel are separate issues to check. Choose a route based on your needs and reliability; assess privacy by reviewing your account, configuration, and trust boundaries.
VPNTU uses “quantum encryption” as a service trust claim; the label is no substitute for understanding the client, protocol configuration, and privacy terms. Don’t treat any encryption label as a promise of anonymity. Signing in to a website or submitting personal information can still link your activity to your account.
You don’t need to keep changing every setting. Keep track of where your configuration came from, update your client and operating system, and recheck important apps after changing devices, networks, or rules. For more help, visit the Help Center. Describing what happened and what you’ve already checked is more useful than sending your entire private configuration.