Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s how we research.
ChromeOS doesn’t ship with a VPN of its own, and it offers three different ways to add one. They aren’t equivalent.
An Android app encrypts everything leaving the device. A Chrome extension encrypts your browser traffic and nothing else. Native configuration in ChromeOS settings supports certain protocols manually.
Most guides recommend the extension because it’s easiest. That’s fine if you only use Chrome — and misleading if you don’t.
The Short Answer
Chromebook from 2019 or later: install the provider’s Android app from the Play Store. Full device coverage, two minutes.
Older Chromebook without Android support: the Chrome extension is your option, covering browser traffic only.
Managed device: whether either works depends on your administrator, and if both are blocked there’s no user-level workaround.
Check What Yours Supports
Android app support arrived by default on Chromebooks launched in 2019 and later. If the Google Play Store appears in your app drawer, you have it.
No Play Store? Either the device predates 2019 or an administrator removed it. Both lead to the same place — the extension.
Managed by a school or employer? Look for a briefcase icon or a “managed by your organisation” notice in settings. That changes what’s possible, covered below.
Path 1: The Android App
The recommended route, because it covers the whole device rather than one application.
Open the Play Store, search for your provider, install, sign in, connect. Everything on the Chromebook routes through the tunnel — Chrome, Android apps, Linux container, background services. The Linux container has its own options if you use it heavily.
Protocol matters on ChromeOS hardware. WireGuard performs best, along with provider implementations like NordLynx and Lightway. Older OpenVPN tunnels are noticeably heavier on lower-end Chromebooks, which most Chromebooks are.
⚠️ Set auto-connect on untrusted networks while you’re in settings. Chromebooks travel, and that’s when the protection matters most.
Path 2: The Chrome Extension
Covers your browser and stops there.
Install from the Chrome Web Store, sign in, connect. Simple, lightweight, works on any Chromebook including ones without Play Store access.
What it doesn’t cover: Android apps, the Linux container, system-level connections, anything outside Chrome. If your Chromebook is genuinely just a browser, that distinction is academic. If you run Android apps, it isn’t.
Extensions sometimes add features apps don’t have — ExpressVPN’s includes WebRTC blocking and location spoofing for the browser specifically.
Path 3: Native ChromeOS Configuration
Less known, and occasionally useful.
ChromeOS supports several VPN protocols natively in network settings — including L2TP/IPsec and OpenVPN. You can add a VPN profile manually under Settings without installing anything.
Why you’d bother: it works without the Play Store or extensions, and it covers the whole device.
Why most people shouldn’t: it’s slower to set up, gives you fewer features than an app, and requires configuration details from your provider. For most users the app or extension is faster and better.
Managed Chromebooks: The Honest Answer
School and workplace Chromebooks are administered through Google Admin, and the administrator controls what installs.
They can block the Play Store, block Chrome extensions, or both.
If only the Play Store is blocked, a browser extension may still install.
If both are blocked, there is no clean user-level workaround — and this is where the honest answer differs from most guides.
⚠️ Working around an organisation’s IT policy isn’t a technical problem. It’s a policy question, and the consequences of getting it wrong land on you rather than on your device. If a VPN is genuinely needed for legitimate reasons — remote work, protecting credentials on public Wi-Fi — the conversation belongs with your IT department, not with a workaround.
Note also that the device belongs to the organisation, and administrators typically retain visibility regardless of what’s installed on it.
Which Provider to Choose
Three things matter for ChromeOS specifically.
Support for both paths. Providers offering an Android app and a Chrome extension give you options if your situation changes. NordVPN, ExpressVPN and Surfshark all do.
Modern protocol support. Chromebook hardware is typically modest, and WireGuard-based protocols are measurably lighter than OpenVPN — our speed guide covers the difference.
Device limits, if the Chromebook is one of several. Surfshark’s unlimited connections remove the arithmetic.
| Provider | Simultaneous | Notes |
|---|---|---|
| NordVPN | 10 | — |
| Surfshark | Unlimited | no cap in terms |
| ExpressVPN | 10/12/14 | by tier |
| CyberGhost | 7 | router counts as one |
| PureVPN | 10 | up to 50 with paid add-on |
| IPVanish | Unlimited | no cap on any plan |
| Windscribe | Unlimited | including Build a Plan |
| Private Internet Access | Unlimited | no tier gating |
| Mullvad | 5 | no paid add-on |
| TunnelBear | Unlimited | no cap on any plan |
| Norton VPN | 5 | 10 on Ultimate, US only |
| Hotspot Shield | Disputed | sources give five and ten |
| IVPN | 5 | 10 on Pro Suite |
| PrivadoVPN | 10 | 1 on the free tier |
| StrongVPN | 12 | more than either market leader |
| PrivateVPN | 10 | free dedicated IP on one plan |
| VyprVPN | Disputed | sources give five and ten |
⚠️ On free options: the usual problems apply — data caps, slow speeds, and the question of how a service with no paid product makes money. Proton VPN’s free tier is the exception worth knowing about, and our free VPN guide covers what it does and doesn’t offer.
How We Research
This guide draws on published documentation from Google and VPN providers, technical testing from named sources including TheBestVPN, Security.org and Cloudwards, and our own full reviews of the providers we rank — cross-checked and verified at publication. Several sources are VPN companies describing their own ChromeOS support; we used those only for their own product details. Our full approach lives on the About Us page.
Chromebook VPN FAQ
If your Chromebook has the Google Play Store — standard on models from 2019 onwards — install the provider’s Android app. That covers the whole device. Without Play Store access, install the provider’s Chrome extension instead, which covers browser traffic only. ChromeOS also supports manual VPN configuration in network settings.
The app encrypts all traffic leaving the device, including Android apps, the Linux container and background services. The extension encrypts only what passes through Chrome. If your Chromebook is genuinely just a browser, the difference doesn’t matter — if you run Android apps, it does.
It depends entirely on your administrator. School devices are managed through Google Admin, which can block the Play Store, Chrome extensions, or both. If only one is blocked, the other route may work. If both are blocked, there’s no user-level workaround — and that’s a policy matter rather than a technical one.
Not a service of its own, but it supports several VPN protocols natively in network settings, including L2TP/IPsec and OpenVPN. You can add a profile manually using configuration details from your provider. Most people find the app or extension faster to set up and more featured.
WireGuard, or a provider’s implementation of it — NordLynx or Lightway. Chromebook hardware is typically modest, and these are measurably lighter than OpenVPN tunnels, which show up as better speed and battery life on lower-end devices.
The usual concerns apply regardless of device: data caps that make streaming impractical, slow speeds, and the question of how a service with no paid product funds itself. Proton VPN’s free tier is the notable exception, with an audited no-logs policy and open-source clients, though it limits you to three locations and one device.
The Short Version
If your Chromebook has the Play Store, install the Android app. Whole-device coverage, and the only option that protects everything.
If it doesn’t, use the Chrome extension and understand what it covers — your browser, nothing more.
Native configuration exists in ChromeOS settings if neither suits, though it’s slower to set up for fewer features.
And on a managed device, what’s possible is decided by your administrator. If both routes are blocked, that’s a policy answer rather than a technical one.