Best VPN for Cruise Ship: Free and Paid Options

Updated 30 September 2026 · vpn, crew-wifi, connectivity, cruise-ship-life

Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you — it never changes which product we recommend.

For most crew and passengers, the VPN apps that hold up best on cruise ship wifi are the ones built around WireGuard, a lightweight connection method designed to re-establish a secure tunnel within seconds after a network drop. Surfshark, NordVPN, and ExpressVPN's own Lightway protocol are the paid options that fit that description; ProtonVPN's free tier is the most reputable no-cost option for light, occasional use. Reconnect speed matters more than server count or top speed for one simple reason: a ship's satellite link disconnects routinely, every time the antenna loses its lock during a turn, a heavy sea, or a handover, and a VPN that takes thirty seconds to resume a tunnel after each drop costs far more time and data than one that resumes in a few seconds. This guide compares five apps against that specific test, plus the settings that decide whether any VPN works on ship wifi at all.

Quick pick for crew: Surfshark. Unlimited devices on one plan and a WireGuard app commonly reported to reconnect fast after a satellite dropout make it the simplest default for a shared cabin. Check Surfshark's current plan, or read the full five-app comparison below first.

The short answer

Prices are the rates each provider listed when checked on 26 August 2026, in the currency it quotes.

The strongest general-purpose pick for crew: Surfshark. Its WireGuard app is commonly reported to reconnect reliably on ship wifi, and one subscription covers unlimited devices, which makes it straightforward to split with a cabin-mate. A short plan, tested during a reader's own first week aboard at their own peak usage hours, is a safer starting point than committing to a two-year plan before confirming it works on a specific ship's network.

This comparison focuses specifically on shared ship wifi and satellite conditions rather than home broadband or mobile data, because the failure mode is different: a satellite link disconnects for a specific physical reason described below, and a VPN's reconnect behavior around that disconnection matters more here than a VPN's average download speed does.

Below is a look at the five apps that hold up on real ship networks, the settings that decide whether any of them works at all, a comparison of connection protocols for links with a long delay before each reply, a first-week test plan so no one pays for a year before knowing, and an honest section on what a VPN cannot do for you no matter which one you buy.

Why crew wifi breaks normal VPN advice

Most VPN comparisons assume a connection like home broadband or 5G, the newer mobile network standard built for fast, steady speeds. Ship wifi is usually neither. Onboard, the connection normally runs over a system called VSAT, short for "very small aperture terminal": a small satellite dish that sends the ship's whole internet connection up to a satellite and back down to a ground station on land. Some newer fleets add Starlink, a different kind of satellite system, as a supplement. That bandwidth is split between hundreds of crew, and it is often deliberately slowed down, or throttled, by the ship's own IT policy to keep it from being overwhelmed. The result is latency, the delay between sending a request and getting a reply, running far higher than on a home connection. Packet loss is common in bad weather, and the connection drops every time the ship's antenna loses its lock on the satellite, which happens routinely during a turn or in heavy seas.

The high latency has a physical cause, and understanding it explains why certain VPN settings help while others do nothing. A traditional VSAT link talks to a satellite sitting in geostationary orbit, meaning it stays fixed above one spot on the equator, roughly 35,786 km up. The signal travels up to that satellite, back down to a ground station, and then the reply makes the same round trip again. That alone puts a floor of several hundred milliseconds on every exchange, before congestion, routing, or the ship's own firewall adds anything on top. That physical floor is where the familiar figure of roughly 600ms round-trip time comes from. Starlink and similar low-earth-orbit constellations, satellite networks flying only a few hundred kilometres up instead of tens of thousands, avoid most of that delay. That's why latency on a Starlink-equipped ship can feel like ordinary home broadband, until a handover between satellites or a heavy rain squall interrupts it.

High latency by itself is something a connection can survive. What actually breaks VPN apps is the combination of that delay with packet loss and sudden total dropouts. A handshake, the back-and-forth exchange a VPN app uses to set up its secure tunnel, normally takes a fraction of a second. Over a satellite link it can take several seconds instead, and if even one packet in that exchange goes missing, the whole handshake restarts from the beginning. Multiply that by an antenna losing its lock while the ship swings at anchor, and the result is a familiar scene in the crew mess: someone tapping "connect" over and over while their data allowance drains into failed handshakes.

A VPN built for hiding your location while torrenting on home fiber is not built for this. What actually matters for crew:

• Reconnect speed, how fast the app re-establishes the tunnel after a drop, since drops are routine, not rare.
• Protocol flexibility, WireGuard or a lightweight proprietary protocol handles a high-delay link far better than older OpenVPN TCP setups (an older, heavier way of building the tunnel).
• Low overhead, every extra kilobyte of a handshake matters when you're paying by the megabyte or fighting a shared 2 Mbps pipe split between 200 other crew.
• Works with crew wifi portals, some ship networks require a login page before internet even opens, and a few VPN apps fight with that captive portal instead of letting it load first.

If a VPN doesn't handle those four things well, its price and server count don't matter. Server count in particular is close to meaningless at sea. You will realistically use two or three servers for a whole contract: one near the ship's satellite gateway for speed, one in your home country for banking, and perhaps one more for a service that geo-blocks you. Whether a provider advertises 3,000 or 7,000 servers changes nothing about the experience on a 2 Mbps shared pipe.

VPN for cruise ship: is it different for crew than for passengers?

Mostly yes, with one real difference. Crew and passengers usually sit on separate networks with different bandwidth caps and different rules about what's allowed, so a VPN that works well for a passenger's evening browsing can behave differently on the crew side, and the other way around.

Passengers typically buy a shore-side internet package through the cruise line at a per-day or per-voyage rate and get access to the same satellite backbone crew wifi runs on, just on a separate allotment. Everything in this guide about protocol choice, reconnect speed, and avoiding heavy protocols applies just as much to a passenger cabin as it does to a crew berth, because the limiting factor for both is the same shared VSAT or Starlink pipe, regardless of who's connecting. The real difference is policy. Many cruise lines are stricter about VPN use on the crew network than on the guest one, since crew agreements often include acceptable use clauses that guest wifi terms don't spell out. If you're a passenger reading this, check your cruise line's guest wifi terms of service instead of a crew handbook, but the technical advice on protocol and reconnect behavior here carries over directly to your situation.

There's a second, quieter difference: time of day. Passenger traffic peaks in the evening and during sea days. Crew traffic peaks in the hours right after watch changeovers and late at night when the off-duty shift comes online. If you're crew, the practical consequence is that your worst throughput window may sit at a completely different hour than a passenger's, and the right time to test whether a VPN is usable on your ship is during your own peak, not at 05:00 when the pipe is empty and everything looks fine.

Which cruise lines block VPNs on guest wifi

This is the question most passengers actually type into a search box, so here is what the lines themselves say. Each source below was checked on 30 September 2026. Rules change between ships and seasons, so treat the table as a starting point and read the login page on your own ship.

"Not supported" is not the same as "blocked." It means the line will not help you if the tunnel fails, and some protocols may simply not get through. The fix is the same one this guide gives crew. Install and test the app while you still have shore internet. Keep WireGuard as the main protocol and one fallback on TCP port 443. Log in to the ship's portal with the VPN switched off, then turn it on. If your job depends on a company VPN that only speaks one protocol, ask your IT team before you sail, not from the pool deck.

Comparison: VPNs that actually hold up on ship wifi

A note on currencies before you compare that table line by line: Surfshark's and Mullvad's listed prices above are in euros, while NordVPN, ExpressVPN, and ProtonVPN are quoted in US dollars on the sources checked here. Don't read a lower euro figure as automatically "cheaper" than a higher dollar figure, or the reverse, they're different currencies, and what you actually pay depends on the exchange rate and your card issuer's conversion fee at the time you buy, not on the raw number in the table.

Prices on satellite-served ship wifi vendors change often and crew discount codes float around messenger boards, so treat these as ballpark figures anchored to the specific pricing pages and check-dates noted above, and check the provider's own pricing page before you buy anything, since promotional rates like ProtonVPN's and NordVPN's listed figures are secondary, time-limited numbers rather than fixed list prices.

A separate check of the market, an aggregated web-search summary of 15 sources run on 23 September 2026, lists broadly similar figures for three of the five providers above and adds two more free options worth knowing about. Because that check summarizes secondary reporting rather than a direct visit to each provider's own pricing page, treat every number in the table below as listed at that figure on the date checked, not as an official confirmed price.

None of the six rows above come with a cruise-ship-specific benchmark. The same 23 September 2026 check turned up individual crew and passenger reports rather than controlled tests: one Reddit report describes VPNs as prohibited on Royal Caribbean and Celebrity sailings, with connections disconnecting immediately once detected, while a separate report says NordVPN worked over Carnival's wifi on at least one sailing. Read those the way you'd read any single passenger's account, as a data point about one ship on one day, not as a verified fleet-wide policy, and confirm the current rule for your own line before you install anything.

Who each option is wrong for

The table above tells you what each app does. This one tells you when to walk past it, which is usually the more useful half of a comparison.

What the same prices work out to over a contract

Crew contracts run in months, so monthly figures can mislead. The arithmetic below simply multiplies the listed monthly rates from the table above by the term length. Providers normally charge these terms upfront in one payment, and renewal prices after the first term are usually higher than the introductory rate, so treat these as the cost of the first term only.

Two things fall out of that table. First, the gap between the cheapest and the most expensive option over a two-year term is real money by crew standards, and it is entirely down to promotional pricing rather than to how well the app works at sea. Second, Mullvad's flat rate looks expensive next to a promo, and it looks reasonable next to ProtonVPN's $7.99 standard rate, which is what you may well be paying in year three when the introductory term expires. If you are the sort of person who forgets to cancel, the flat rate is worth more than the headline discount.

Mullvad's billing also works differently from every other row in that table, which is worth a plain explanation rather than a number. Instead of registering with an email address, a Mullvad account is identified only by a random number, topped up with credit as needed. For crew, that means no forgotten renewal charging a card while at sea without notice, and no account tied to a name in a provider's database. The trade-off is that losing that number means losing the account, so it needs to be written down somewhere that survives a lost or dropped phone. This is Mullvad's own description of how the account system works and has not been independently verified beyond that.

Protocols: the setting that decides everything at sea

If you change one thing in your VPN app before sailing, change the protocol. It matters more than the provider you picked.

That last row explains a symptom crew describe constantly: the VPN connects, everything works for a minute, then the whole session grinds to a halt without actually disconnecting. That is TCP meltdown on a lossy link, and no amount of switching servers fixes it. Switching to WireGuard usually does.

There is one exception where a heavy protocol earns its place. If the ship's network blocks UDP outright, WireGuard cannot get out at all, and OpenVPN over TCP on port 443 (or a provider's obfuscated or stealth mode, which does much the same thing) may be the only tunnel that establishes. Treat that as the fallback you keep in your pocket, and go back to WireGuard the moment you are on a network that allows it.

Settings to change before you sail

These are the adjustments that turn a VPN from unusable to fine on a ship network. Make them on shore internet, where a mistake costs you seconds instead of megabytes.

1. Set the protocol manually to WireGuard, or Lightway on ExpressVPN, or NordLynx on NordVPN. Do not leave it on "automatic", which often picks a heavier protocol when it detects an unusual network.
2. Turn off "connect on app launch" and any always-on setting until after you have logged in to the ship's captive portal. This single change solves most "my VPN worked in the airport and not on the ship" complaints.
3. Understand the kill switch before you enable it. A kill switch is a setting that cuts off all internet access the instant the VPN tunnel drops, so nothing leaks outside the encrypted connection. On a link that drops several times an hour, a strict kill switch means your messaging app stops delivering every time the antenna loses lock, and your captive portal session may expire behind it. Many crew leave it off on ship wifi and switch it on only for banking.
4. Lower the MTU to around 1280 if tunnels begin to connect and then stall. MTU is the largest chunk of data a single network packet is allowed to carry; satellite links add encapsulation overhead, and an oversized packet that cannot be fragmented simply disappears. Most desktop apps expose this setting; on mobile you may need a manual WireGuard configuration file to change it.
5. Pick a server manually, somewhere geographically near the satellite gateway your ship uses rather than near the ship itself. Automatic selection measures latency, and on a satellite link every server looks equally slow, so the algorithm chooses close to at random.
6. Enable split tunneling and exclude anything that is already encrypted or bandwidth-heavy. More on this below.
7. Save your login credentials and any configuration files offline, along with your account recovery codes. Two-factor codes sent by email are miserable to collect on a congested connection in your first hour aboard.
8. Turn off auto-updates for the VPN app on ship wifi. A background 120 MB update pushed at the wrong moment can eat a meaningful slice of a crew data package.

How to test a VPN in your first week aboard

Do not buy a two-year plan from the airport lounge. Buy a month, or use a free tier, and run this sequence during your first week. It takes about twenty minutes of attention spread across a few days, and it will tell you more than any review, including this one, can tell you in advance.

1. Day one, before installing anything: get online through the crew portal with no VPN running, and note what the connection feels like at your usual off-watch hour. That's your baseline.
2. Confirm the VPN connects at all. If it fails on WireGuard, try the provider's obfuscated or stealth server list, then OpenVPN over TCP on port 443. If nothing establishes, the fleet is blocking VPN traffic and you should stop before spending money.
3. Measure the honest cost. Load the same three pages with the tunnel off and then on, at the same hour, and compare how long each takes. You are looking for a modest penalty. A tunnel that doubles or triples page load time on your ship is telling you something.
4. Test the drop. Turn the ship wifi off on your device for thirty seconds, turn it back on, and time how long the VPN takes to resume by itself without you touching it. This is the single most important number for crew use, and it is one no review site can measure for you in advance.
5. Test at your peak hour, not a quiet one. Repeat step three during the busiest window on your deck.
6. Test the thing you actually care about. If the point is calling home, make the call. If the point is your bank app, open your bank app, and check that the bank does not lock the session because the traffic suddenly appears to come from another country.
7. Only then commit. If steps two through six all pass, buy the long term and take the discount. If any of them fail, try the next provider on the list before you conclude that ship wifi is hopeless.

Starlink ships versus legacy VSAT ships

Fleets are mid-transition, and which side of it your ship sits on changes what you should expect from a VPN.

On a legacy geostationary VSAT vessel, the round trip is the enemy. Every handshake, every DNS lookup, every TLS negotiation pays the latency toll. This is where protocol choice makes an obvious, measurable difference, and where OpenVPN over TCP can render a connection unusable. Throughput is usually the harder cap too: a shared package measured in single-digit megabits across hundreds of people leaves very little for anyone.

On a Starlink-equipped vessel, latency stops being the problem and interruption takes its place. The link feels fast, then vanishes for a second or two during a handover, in heavy weather, or when the vessel's structure blocks the antenna's view. A VPN with sluggish reconnect logic turns each of those small gaps into a thirty-second outage for you. Fast resume matters more here than encryption efficiency ever will.

One practical warning: plenty of fleets have installed Starlink for bridge and operational use while crew wifi continues to run on the older VSAT allotment, or on a heavily rate-limited slice of the new one. Do not assume that seeing a Starlink dome on the monkey island means your cabin gets low-latency internet. Ask the ETO or whoever administers the crew network which backbone the crew SSID actually rides on, because the answer changes which half of this section applies to you.

Captive portals: the problem that isn't the VPN's fault

Most crew networks put a login page between you and the internet. Your device connects to the wifi, gets an address, and every request is redirected to a portal where you enter a crew number, a voucher code, or a card. Until you complete that, nothing else passes.

A VPN set to connect automatically will try to build its tunnel the instant it sees a network, before you have logged in. The tunnel fails because the portal is intercepting traffic, the app retries, and on some setups the retries and the kill switch together prevent the portal page from ever rendering. From the outside this looks like the VPN breaking the wifi. It is really an ordering problem.

The sequence that works, every time:

1. Join the ship's wifi with the VPN completely off, including any always-on or auto-connect option.
2. Open a plain HTTP page to trigger the portal if it does not appear by itself. Many browsers now default to HTTPS, which the portal cannot intercept cleanly.
3. Log in and confirm you have real internet by loading any normal page.
4. Now start the VPN.

If the portal times out your session after a period of inactivity, you will have to repeat this each time, which is another reason a strict kill switch is more trouble than it is worth on many ship networks.

Free VPN options for cruise ship wifi: what's realistic

A free VPN can work for light use on a cruise ship, but it's rarely a good full-contract solution. The data caps on most free tiers are small enough that a single day of normal browsing over a slow satellite link can burn through them.

ProtonVPN's free tier, mentioned in the comparison table above, is one of the few reputable free options because Proton doesn't log traffic and doesn't cap you by data volume the way many free apps do. It does limit which servers you can connect to and can run slower during peak hours, which matters more on an already-congested ship connection than it would at home. Most other "free" VPN apps you'll find in an app store make their money by logging and selling browsing data, showing ads inside the app, or capping you at a few hundred megabytes a day, any of which defeats the purpose of using a VPN on a connection you're already paying by the byte to access.

If free is the deciding factor, a few approaches work better than just grabbing whatever app has the highest app-store rating:

1. Use a reputable provider's free tier for occasional needs, like checking a banking app once a week, rather than as your main browsing tunnel.
2. Try a paid provider's short trial or a one-month plan before committing to a year. Most of the providers in the comparison table above offer a short refund window.
3. Skip a VPN app entirely for tasks that already encrypt themselves, like most messaging apps, and reserve any VPN budget for genuinely sensitive traffic like banking.

Given how tight crew wifi data packages usually are, stacking a free VPN's hidden data cap on top of your ship's own cap tends to cost more in wasted retries and re-downloads over a contract than a cheap paid plan would in flat monthly cost, whether that plan is billed in dollars or euros.

Two other names come up in general free-VPN roundups, Hotspot Shield and TunnelBear, but a broader web-search summary checked 23 September 2026 could not confirm current pricing, device limits, or any cruise-specific performance for either one, only a loosely shared claim that free VPNs in that category cap out somewhere between 500 MB and 2 GB a day. Treat both as unverified for ship use until you've read their own current terms, rather than assuming they behave like ProtonVPN's free tier.

There is one more use for a free tier that pays for itself even if you never keep it: it is a free way to run the first-week test above. Installing ProtonVPN's free tier answers whether a ship's network permits VPN traffic at all and how fast a WireGuard tunnel resumes after a dropout, before any paid plan is chosen. Crew who skip that step are the ones who end up with an unusable annual subscription and a refund window that closed while the ship was mid-Atlantic.

Split tunneling: keep the bulk of your traffic outside the tunnel

If a VPN app supports split tunneling, a setting that sends only chosen apps through the encrypted tunnel while everything else uses the ordinary connection, it's worth using. There's no reason to route a video call app or a big download through the encrypted tunnel without a privacy need for that traffic; doing so just adds latency the satellite link is already short on. Reserve the VPN for traffic that actually needs it: banking apps, messaging with family, anything a reader would rather the ship's network operator not see in plaintext.

In practice, a sensible split on a crew phone looks like this. Inside the tunnel: a browser, banking and payment apps, anything work-related that shouldn't be read by a third-party contractor. Outside the tunnel: WhatsApp, Signal, Telegram and similar apps that already encrypt end to end, the ship's own crew portal or intranet applications, which frequently refuse to load through a VPN anyway, and any app store or system updater, so a background download doesn't also pay encryption overhead. Some banks go the other way and flag a login that appears to arrive from a foreign VPN server, so if that happens, either keep the bank app on a home-country server or leave it outside the tunnel and rely on the app's own encryption.

Money apps and geo-locked services

One underrated reason crew buy a VPN has nothing to do with privacy: services from home stop working when your traffic appears to originate wherever the satellite gateway lands. Government portals, some banks, tax filing sites, and streaming subscriptions already paid for can all refuse access or silently degrade. A home-country server fixes that in a few seconds.

Two cautions. Connecting to a bank through a VPN can occasionally trigger a fraud hold rather than prevent one, particularly if the account was accessed from a home country an hour ago and now appears to connect from somewhere else. Anyone planning to rely on it should test it early in the contract, while a support channel is still reachable. And check the terms of any subscription service before routing it through a tunnel, because using a VPN to reach a regional catalog is usually a breach of that service's terms even where it is perfectly legal.

What a VPN doesn't fix: getting online in the first place

A VPN encrypts a connection that already exists; it doesn't create one. That distinction matters the moment a crew member walks down the gangway in port. Ship wifi drops off, a phone starts hunting for a local cellular network, and if nothing has been set up to get onto that network, no VPN changes that, there's simply no connection yet for it to route.

That's a different problem than everything else in this guide, and it's worth naming instead of pretending a VPN is a full connectivity plan. The fix for the in-port gap is a way onto the local network itself, which for most crew now means a data eSIM installed on ship wifi before the ship even docks. Airalo is a commonly used option for this: installing the profile over ship wifi ahead of arrival lets it activate on the local network the moment the ship reaches port. Once on that local connection, a VPN goes right back to doing its job on top of it, for anyone who still wants encryption for banking or messaging. A full rundown of the options is in the best eSIM for seafarers guide, the connectivity at sea pricing breakdown covers what a ship's own satellite plan is likely costing on top of it, and for the hours actually spent off the ship, the offline maps and apps for shore leave guide covers getting around once there's no signal left to spare on a VPN tunnel.

The pairing is worth being deliberate about, because the two purchases cover different halves of the same problem. The eSIM gets you a connection where the ship's wifi cannot reach. The VPN protects whatever connection you're on, and it's arguably more useful ashore than aboard: port terminal wifi, seafarer centre networks, and café hotspots are open networks used by thousands of strangers, and they're a far more realistic threat than a ship's own IT department. Installing the eSIM profile while ship wifi is still available matters because eSIM installation itself needs a working connection, and trying to do it at the terminal gate with no data is a trap plenty of crew fall into once.

With that gap covered, the rest of this guide is about the VPN itself, once already connected to something.

Honest pros and cons

Pros of using a VPN on crew wifi:

• Encrypts your traffic so the ship's network admin (or a curious IT contractor) can't casually see which sites you're on.
• Lets you reach services that some ship networks or flag-state filters block, like certain news sites or messaging apps.
• Modern WireGuard-based apps add surprisingly little latency once connected, even over VSAT.
• A good app auto-reconnects after satellite dropouts, saving you from manually restarting the tunnel every time.
• Keeps home-country services working, from banking portals to government sites that refuse connections arriving from an unexpected country.
• Covers you ashore on open port wifi, which is a genuinely riskier network than the ship's own.

Cons, and there are real ones:

• A VPN adds encryption overhead, which on an already-slow or bandwidth-capped connection can make a bad connection feel worse, especially with heavier protocols.
• Some cruise line IT policies explicitly prohibit VPN use on the crew network, and getting caught can mean a warning or loss of wifi privileges, check your contract and the crew handbook before you install anything.
• Free VPN apps are a bad idea on ship wifi specifically: many log or sell your data, and on a connection you're already paying for by the byte, that's a double loss.
• A VPN does nothing about the underlying speed problem. If your ship's satellite package gives you 512 kbps shared across the crew, no VPN in the world turns that into fast internet.
• Multi-device VPN limits vary a lot by provider, from Mullvad's reported 5-device cap up to Surfshark's unlimited devices, so check the device count against how many phones, tablets, and laptops your cabin actually needs covered before you commit to a plan.
• Ship intranet resources, crew portals, and some onboard services often refuse to load while a tunnel is up, so you will be toggling it more than you would at home.
• Long prepaid terms are how these prices get cheap, and a two-year commitment is awkward when your next contract might be on a ship where the network blocks VPNs entirely.

Rules, policy and the sensible way to handle them

Worth separating three things that get muddled in crew mess conversations. Using a VPN is legal in most of the world, though a small number of countries restrict or license them, which is worth checking if your trading pattern includes one. Separately, your employer is entitled to set conditions on its own network, and a crew acceptable use policy that forbids VPNs is a contractual matter rather than a legal one. Finally, the ship's network may simply block the traffic regardless of what any policy says.

The practical approach is the boring one. Read the network clause in your crew agreement or handbook before you install anything. If it prohibits VPN use, respect it, because losing wifi privileges for a six-month contract is a much worse outcome than browsing unencrypted for a few months. If it says nothing, which is common, you are in ordinary territory and normal use is unremarkable. Either way, never use the ship's network to bypass billing or to get around a filter that exists for operational or safety reasons. The line between protecting your own banking traffic and interfering with the vessel's network is not subtle, and IT departments notice the second one.

Who should not buy a VPN for this

If a cruise line already blocks all third-party VPN traffic at the network level, and some do, particularly on ships where IT security policy is stricter, buying a subscription is money wasted until it's been confirmed to work from that specific ship's network. Asking around in the crew mess or checking an internal crew forum before paying for a year up front is worth the few minutes it takes.

Crew who only ever use ship wifi to check email and call home over an approved app may not need a VPN's privacy layer at all; the extra encryption overhead might just slow things down without a clear benefit. And anyone with a genuinely tight budget is generally better off spending it on more data in the crew wifi package before spending it on a VPN subscription; a VPN cannot create bandwidth, it only encrypts what's already there, whether that subscription is billed at NordVPN's roughly $3.49/month or Surfshark's roughly €2.49/month.

One more group: anyone about to sign a two-year plan for a single short contract. Someone sailing four months and then home for two is often better off with a flat monthly rate that can be paused, or a one-year term, than with the headline two-year discount, since half of it would otherwise go unused while sailing on shore broadband they already pay for.

More for crew: fixes for slow crew WiFi, offline maps for shore leave, cheap calls home from port, apps for marine engineers, digital tools for chief engineers.

FAQ

Does a VPN slow down cruise ship wifi even more? Slightly, yes, because encryption adds overhead. WireGuard, a lightweight connection method built for quick reconnects, usually adds only a modest penalty, often cited at under 10-15% compared with no VPN at all, though no controlled test of this exists for ship wifi specifically. On an already-congested satellite link during peak evening hours, that overhead is more noticeable than it would be on fast home broadband.

Can cruise lines see what I do if I use a VPN? They can see that you're connected to a VPN server (the connection pattern is visible even if the content isn't), but not the content of your encrypted traffic. Some ship IT policies treat VPN use itself as against the rules regardless of what you're using it for, so check your crew agreement first.

Is a free VPN good enough for crew wifi? Generally no. Free VPN providers often have data caps low enough to be useless on a whole contract, and some monetize by logging or selling browsing data, which defeats the point of using one on a connection you're already paying to access.

Will a VPN help me stream Netflix or watch shows on crew wifi? It might unblock regional catalogs, but it won't fix bandwidth. Streaming over shared satellite crew wifi is usually a bad experience with or without a VPN, since video needs sustained throughput that most crew wifi packages simply don't offer during peak hours.

Do I need a VPN just for messaging apps like WhatsApp? Not really. Most messaging apps already encrypt end-to-end. A VPN adds value mainly for browsing traffic, banking, or apps that don't encrypt well on their own — it's a supplement to good data-saving habits on crew wifi, not a replacement for them.

Which VPN reconnects fastest after the ship loses satellite signal? There's no independent, ship-specific test of this. WireGuard's design, a short handshake that resumes quickly once a link returns, is why NordVPN's and Surfshark's WireGuard-based apps are the ones most often cited for reconnecting reliably after a dropout, typically within a few seconds once the satellite link itself is back. Results vary by ship and by how the vessel's network is configured, so treat this as unverified and test during the first week aboard rather than assuming.

What's the best free VPN for cruise ship wifi? ProtonVPN's free tier is the most reputable no-cost option because it doesn't log your traffic or cap you by data volume, though it limits which servers you can use and can run slower during peak hours. Treat any free VPN as a backup for light, occasional use rather than your main tunnel for a full contract, since data caps and slower speeds on most free tiers make them impractical for daily use on an already-slow satellite connection.

Is a VPN for cruise ship wifi different for passengers than for crew? The technology is the same since both usually share the same satellite backbone, so protocol choice and reconnect speed matter equally either way. The main difference is policy: crew agreements often restrict VPN use more strictly than passenger wifi terms do, so check the rules for your specific network before you install anything.

Can I even use a VPN on a cruise ship, or is it blocked? On most ships it connects fine, especially over WireGuard on UDP port 51820 or a provider's own port 443 fallback. A minority of fleets block third-party VPN traffic at the network level or forbid it in the crew acceptable use policy. Blocked and forbidden are two separate problems, so confirm both before you buy a year up front: try a free tier or a refundable monthly plan on your own ship first, and read the crew handbook clause on network use.

My VPN won't connect on crew wifi. What do I check first? Four things, in this order. Log in to the captive portal with the VPN fully off, since an always-on tunnel or a kill switch will block the login page itself. Switch the protocol to WireGuard or the provider's lightweight option instead of OpenVPN TCP. Drop the MTU to around 1280 if handshakes start and then stall. Pick a nearby server manually rather than letting the app auto-select one on the other side of the world, because auto-selection measures latency badly on a satellite link.

Which VPN protocol is best for satellite internet? WireGuard, or a modern custom protocol built on the same idea such as ExpressVPN's Lightway. Both use a short handshake and resume quickly after the antenna loses the satellite, which matters far more than raw encryption speed when your link drops several times an hour. OpenVPN over TCP is the worst choice on a lossy satellite link because TCP inside TCP makes retransmissions pile up on themselves.

Does a VPN work on Starlink maritime? Yes, and it usually feels better than on legacy VSAT because latency is tens of milliseconds instead of the roughly 600ms round trip of a geostationary link. Starlink maritime still drops briefly during satellite handovers and heavy weather, so fast reconnect stays the feature that matters. Note that some fleets run Starlink for operations and keep crew wifi on the older VSAT allotment, so ask which network you are actually on.

Can I use a VPN to get around cruise ship wifi charges? No. A VPN encrypts traffic that has already been allowed onto the network, so it cannot unlock a package you have not bought, and every byte still counts against your allowance. Attempting to bypass billing is a straightforward breach of the crew acceptable use policy and the fastest way to lose wifi privileges for the rest of the contract.

Should I install and test my VPN before I join the ship? Yes. Install the app, log in, download any server configuration files, and save your credentials offline while you are still on shore internet. First logins sometimes need an email confirmation link or a two-factor code, and those are painful to receive on a congested satellite connection in your first hours aboard.

Can I share one VPN subscription with my cabin-mates? Technically the device limits allow it, from Mullvad's reported 5 up to Surfshark's unlimited, and splitting a plan is common practice on crew decks. Most provider terms describe the licence as personal use, so you are relying on the device count rather than on permission. Each extra device also holds its own tunnel over the same shared pipe, so four people sharing one plan does not make the bandwidth go further.

Does a VPN use more mobile data or drain the battery? Both, a little. Encryption overhead adds roughly a few percent to data volume, and keepalive packets plus constant reconnection attempts on a flaky link are what really hurt the battery. If your crew package bills by the gigabyte, turn the VPN off for traffic that is already encrypted and use split tunneling for the rest.

Is a VPN or an eSIM the better buy for a seafarer? They solve different problems and most crew end up with both. An eSIM gives you a connection in port when ship wifi is gone; a VPN encrypts whatever connection you already have. If you only have money for one this month, buy the connection first, because encryption with nothing to encrypt is worthless.

Latest updates

• Can Your Ship's IT See Through a VPN? More Than You Think — our newest guide on this topic.
• Does a VPN Drain Your Phone's Battery on a Ship? (2026) — our newest guide on this topic.
• Oil Record Book Part I: 10 Entries Engineers Get Wrong — our newest guide on this topic.