Best Split Tunneling VPNs: Per-App, Per-Site and Inverse Modes Compared

Top 3 by page score

All three sit outside surveillance alliances and hold independent no-logs audits. NordVPN (4th, per-app mode), Surfshark (8th, its Bypasser) and ExpressVPN (11th) also publish the feature.

Why the scores spread so far apart

Security carries 40% of the page score, and the top three perform well there; the divergence comes from everything else. Proton VPN loses ground on censorship bypass: it runs its own Stealth obfuscation, but none of the protocols the bypass sub-score counts (VLESS Reality, Trojan, Hysteria2, Shadowsocks), and its renewal price runs roughly double the first term. IVPN is the opposite: privacy is its strongest suit (audits since 2019), but with no published price, no free plan, no trial and a network of 41 countries and 80 gateways, its price and network sub-scores stay low. None of CitadelVPN's sub-scores on this page is below 7.5.

Three ways to split the traffic

NordVPN and PrivadoVPN offer per-app rules, and Mozilla VPN does per-app exclusions on Windows, Android and Linux. HiroVPN works with sites and apps; Hotspot Shield matches by site and covers apps and sites on Windows and Mac, only sites on iOS. VPN 360 runs inverse mode, where only selected apps touch the tunnel. The Wikipedia article on split tunneling covers the inverse variant as well as dynamic, hostname-based split tunneling. ChibaTunnel and UH VPN split by IP or subnet, and proxy clients like Shadowrocket or v2rayNG route by domain, IP range or country. That last option is powerful and remarkably easy to misconfigure.

Which platforms actually get the feature

In the provider notes on this list, Windows and Android are the platforms named most often for split tunneling. iOS is the narrow end: many providers leave exclusions out of the iPhone app entirely, and some allow only site rules there. An app on a platform proves little about the feature inside it, so check the settings page before paying.

Free plans and locked exclusions

Ninety-two services on the list have a free plan, yet the free tier does not guarantee the feature. According to the site's data, TunnelBear (SplitBear), Touch VPN, VPN Proxy Master, FreeVPN.com, Symlex VPN and SkyVPN keep split tunneling for paying users. McAfee offers only a fixed list of streaming apps, off by default. Read the plan comparison, not the feature page.

What leaves with the traffic

Excluded traffic goes over the normal connection: your ISP and the local Wi-Fi see it, destinations see your real IP, and DNS requests usually land on the ISP resolver. A kill switch may not cover excluded apps, and on some platforms the two features refuse to run together, so test both after every rule change.

FAQ

Short answer

Choose a service whose app has the mode you need on your device, exclude as little as possible, keep torrents and browsers inside the tunnel, and verify your IP and DNS from both sides each time you edit a rule. The basics of the feature are covered in the glossary.