VPN Safety Guide for Beginners: Subscription Links, Public Wi-Fi & Personal Data

Keep passwords and subscription links separate

Your username and password let you access the user panel; a subscription link usually lets a client retrieve node configurations. The link may contain a token that identifies your account. Anyone who obtains it may be able to retrieve the configuration and use the associated resources without signing in to the panel. Treat it like a credential, not a URL to share freely.

Services handle subscription tokens, node credentials, and update permissions differently. Do not assume that changing your password will invalidate an existing subscription, or that deleting a configuration from your client revokes it on the server. If a link is exposed, follow the panel's available controls and confirm the outcome with support.

Do not reuse passwords from other websites. If your password manager can generate passwords, use it to create and save a unique credential. On a shared computer, avoid saving login details in the browser. Sign out of the panel when you finish, and remove configuration files downloaded to the device. Closing a tab alone may not end your session.

Importing a client: verify the source before granting permissions

When installing a client, start from the service's official instructions to find the project's release channel or app store listing, then verify the developer and project name. Ads in search results, installation files forwarded in group chats, and lookalike apps are not trustworthy just because their icons match. VPNCJ clients and subscription access are available from the user panel downloads page; sign in to view them.

Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different proxy protocols or protocol options, and client support varies. A client being able to read a subscription does not mean every node in it will work. Check the client core, version, and configuration format. Do not submit a full subscription to an unfamiliar website just to try an “automatic repair.”

Be especially cautious with online subscription converters. A conversion service that receives a full link may be able to read the configuration it contains. If you need to convert it, first find out how the tool works and who handles the data. If a trusted client can import it directly, there is no need to add another intermediary.

1. Open the client's download page from the official instructions and confirm the source and supported system.
2. Copy the subscription from your own panel and import it into a trusted client. Avoid routing it through public notes or group chats.
3. Grant the system permissions needed to establish a VPN connection, as described in the documentation. Read each permission prompt and do not approve unrelated permissions with unclear purposes.
4. Check that the configuration appears and that the selected node is supported, then connect using the intended rule mode.
5. After importing, delete temporary screenshots and exported files you no longer need, and check whether clipboard history saved the link.

A VPN permission prompt on a mobile system usually means the app can establish the relevant network interface; it is not an endorsement of the service's privacy policy. A desktop client's system proxy may affect only apps that follow proxy settings. TUN mode can cover more traffic, but its behavior still depends on routing, exclusions, and implementation. Do not rely on a status bar icon to determine the route used by every app.

Public Wi-Fi: identify the network before handling sensitive tasks

Public Wi-Fi risks include more than intercepted traffic: fake hotspots, spoofed sign-in pages, and prompts to install configurations can also pose problems. Ask venue staff to confirm the network name and connection process, and turn off automatic joining when it is not needed. A familiar-looking name does not prove that the hotspot is operated by the expected provider.

Some networks require you to accept terms on a portal page before internet access is available. If authentication is incomplete, your client may not connect. In that case, pause sensitive tasks such as payments or password changes, complete the necessary network sign-in, and then establish your connection. Do not treat requests to install a root certificate, unknown profile, or remote-control tool as ordinary steps for getting online.

HTTPS protects data in transit between your browser and the destination website, but it does not prove that the site operator is trustworthy or prevent a phishing page from collecting information. If you see a certificate error, check the URL, system time, and network status instead of dismissing the warning. An encrypted connection cannot undo information you have submitted to a fake website.

• ✅ Verify the hotspot's source and check the actual domain in your browser, not just the page title or logo.
• ✅ Wait for the client to connect reliably before handling sensitive tasks; pause data submissions if the connection drops.
• ✅ When your system allows it, turn off file sharing, network discovery, and receiving features you do not need.
• ❌ Do not install certificates, profiles, or tools from unknown sources to authenticate with a hotspot.
• ❌ Do not dismiss browser certificate warnings as routine prompts.

Split tunneling and DNS: connected does not mean all traffic takes the same route

Split-tunneling rules determine which connections go direct, use a proxy, or are blocked. In rule mode, some websites may use the local network as intended; that alone does not indicate a fault. Conversely, choosing global proxy mode does not prove that every app on the system uses the proxy. Check whether each app follows system settings and whether any bypass rules apply.

DNS translates domain names into network addresses. A DNS leak generally means that a lookup request went outside the intended protection route and reached an unplanned resolver. This may expose queried domains to the relevant network operator, but it does not mean HTTPS page content was also decrypted. The client, system, browser's encrypted DNS, and app-specific lookups may all play a role.

Before checking, clarify what you expect: should the target app use a proxy or connect directly, and who should handle DNS? Then review the client's current configuration, rule-match records, and results from a trusted testing tool. A browser exit test reflects only that browser's request at that time. DNS results also need to be interpreted in context; an unfamiliar name alone is not enough to draw a conclusion.

If the configuration does not match your expectations, first consult the client's official documentation. Do not paste in an entire set of rules from an unknown source. Retest the relevant apps after making changes, and check whether paths such as IPv6 behave as intended. Keep only necessary fields in troubleshooting screenshots, and do not upload full logs to public forums.

Personal data: share only what is needed for the task

Before submitting information, ask what it will be used for, who will receive it, and whether it is necessary. VPNCJ does not require an email address; you can register with a username and password. Do not add your identity details, employer, home address, or identity document images just to make a profile look complete when they are unrelated to using the service.

When contacting support, start by describing your system, client, error message, the action that caused the issue, and the general circumstances. If more information is needed, confirm exactly what to provide. Logs may contain domains, tokens, device names, or local paths. Screenshots may also reveal browser tabs, account balances, or other sessions, so review each one before sending.

A privacy policy and an encryption protocol answer different questions. A protocol concerns how a connection transmits data; a policy explains how a service handles data. When reading a policy, look at what is collected, why, how it is stored, who it is shared with, and how to make contact. Even if a policy says “no logs,” read the scope of that statement rather than treating it as a guarantee of anonymity in every situation.

What to do after a subscription leak

If you discover that a link was sent to the wrong group, a screenshot was posted publicly, or a subscription was given to an untrusted tool, stop sharing it. Deleting a message can limit further exposure, but it cannot retrieve copies that have already been saved. Do not assume the issue is resolved just because the content is no longer visible on the public page.

1. Remove public copies. Delete the relevant messages, shared files, or screenshots, and check for publicly accessible backups.
2. Identify what was exposed. Distinguish between the panel password, subscription token, node credentials, and logs so you do not overlook one item.
3. Revoke or replace credentials through official channels. Check whether the panel offers subscription reset or revocation. If unclear, contact support to confirm how old credentials can be invalidated.
4. Update your devices. After obtaining new credentials, import them again and check old configurations and automatic update tasks to avoid continuing to use an old link.
5. Review account access. If your password was also exposed, change it and check for session-management tools in the panel. Do not assume a password change automatically revokes every other credential.

You do not need to repeatedly rework your configuration. Keep a trusted way to obtain it, update your system and client, and check for sensitive details before sharing. These steps reduce practical risks more directly than frequently changing nodes. For setup instructions, see the user guides. For permissions or revocation questions you cannot resolve, visit the help center.