Start with the basics of VPN security: understand the different risks associated with account passwords, subscription links, and public Wi-Fi. A password controls access to your account dashboard, while a subscription link lets a client retrieve connection settings. On public networks, security depends on encryption, site authenticity, and device settings. A successful connection doesn’t resolve every security concern.
The most useful approach isn’t to keep switching servers; it’s to limit exposure of your credentials. Don’t reuse passwords, keep subscription links private, verify where your client comes from, and stop if you see a certificate warning. Here’s what to do, step by step.
Account Passwords vs. Subscription Links: What’s the Difference?
Your account password is typically used to sign in to the user dashboard, check your plan, manage your subscription, or contact support. If another site exposes that password, attackers may try the same credentials elsewhere. Use a unique password for your VPN account and store it in a trusted password manager. Convenience isn’t worth reusing passwords across sites.
A subscription link isn’t just an informational page. When a client accesses it, the link usually provides server addresses, protocol settings, and connection credentials. Anyone who has the link may be able to import the configuration on their own device without signing in to your dashboard, using your subscription traffic. Links may also be redirected or converted, but they still grant access to connection settings.
| Credential | Primary purpose | Risk if exposed | How to protect it |
|---|---|---|---|
| Account password | Sign in to the user dashboard | Someone else may access your account and view subscription details | Use a unique password and store it in a password manager |
| Subscription link | Let a client retrieve connection settings | Someone else may copy the configuration and use your traffic | Treat it as an access credential; never share it publicly |
| Server QR code or configuration file | Import a specific server or configuration | The connection credentials it contains may be reused directly | Don’t post it in public forums or screenshots |
| Login session | Keep a browser signed in | Someone else on a shared device may continue accessing the dashboard | Sign out before leaving a shared device |
Changing your account password doesn’t revoke a subscription link. Dashboard login credentials, subscription access tokens, and server connection credentials may be managed separately. If something is exposed, confirm exactly which credential needs replacing.
Check for security issues when entering details and importing a client
VPN34 doesn’t require an email address. When creating an account, set a username and password as requested in the official dashboard. Don’t add your real name, home address, or identity documents just to make your profile look complete. Avoid usernames that could be linked to a public account associated with your work.
Access the login page and client downloads through this site. Don’t rely on a search result’s title or icon to verify a page, and never enter your password on a “customer support verification” page sent by a stranger. HTTPS in the address bar means the connection is encrypted; it doesn’t prove the site belongs to the brand you’re looking for. Fake sites can use HTTPS too.
Get the VPN34 client from the user dashboard. Sign in to download it for Windows, macOS, Android, or Linux. For iOS, available options depend on your subscription status in the dashboard. Sign in to retrieve your subscription, then follow the Quick Start Guide to import it. Client support for protocols and configuration formats varies, so a file extension alone won’t tell you whether it can be imported.
- ✅ Check the page’s domain and source before entering your account credentials. Don’t sign in through a link forwarded in a chat.
- ✅ Download the client from a trusted source, and check the developer information, signature, and permission prompts shown by your device.
- ✅ Import your subscription using the client’s built-in feature. Verify the source before enabling the connection.
- ❌ Don’t paste your full subscription link into an unfamiliar online converter, diagnostic tool, or speed test site.
- ❌ Don’t post screenshots or logs containing QR codes, tokens, or server passwords in public chats.
Online subscription converters need to read the original configuration. Even if the converted format works, the operator may have access to your connection credentials. Importing locally in the client, or using a trusted local conversion method, usually exposes your credentials to fewer parties. If a format isn’t supported, check the client’s documentation instead of repeatedly giving your link to different websites.
Public Wi-Fi: Real Risks and the Limits of Encryption
Public Wi-Fi risks aren’t limited to whether the network has a password. Lookalike access point names, fake sign-in pages, outdated routers, and altered network settings can all affect your connection. Confirm the network name with the venue, turn off automatic joining when it isn’t needed, and avoid enabling file sharing on unfamiliar networks.
HTTPS with a properly validated certificate encrypts content between your browser and the destination website. Public network operators generally can’t read your passwords or page content directly, but they may still observe connection times, destination addresses, and traffic patterns. Whether domain names are exposed also depends on DNS and related encryption mechanisms. It’s inaccurate to assume that using public Wi-Fi means all your passwords are visible.
A correctly configured encrypted proxy or VPN tunnel can limit what the local network can observe about traffic sent through it, but the protection depends on the client’s mode. A browser proxy may cover only browser traffic; a system proxy may not handle every app. TUN mode usually covers more, but routing, DNS, and exception rules still matter. A setting labeled “Global” doesn’t automatically mean every connection on your device goes through the tunnel.
Use HTTPS between the exit server and the destination website too. A tunnel can’t make a fake website legitimate or identify malicious attachments for you. Some captive portals need to be accessed before you connect to a tunnel; use the authentication page provided by your device or venue. If a page asks you to ignore certificate errors, install an unknown root certificate, or disable security checks, stop and switch to a trusted network.
Bottom line: On public Wi-Fi, a trusted access point, properly validated HTTPS, and a suitable tunnel configuration each protect a different part of the connection. They aren’t interchangeable, and none replaces checking login pages and download sources.
DNS and Traffic Routing: Verify Name Resolution, Too
DNS translates domain names into addresses your device can connect to. A DNS leak usually means that requests expected to use a protected route are instead sent to another resolver, such as one provided by the local network. This is separate from whether a website loads, and your browser’s apparent exit address alone can’t confirm it.
Some clients handle system DNS, while others only process domains sent through the proxy. Browsers may also use their own encrypted DNS. Encrypted DNS protects queries in transit to the resolver, but doesn’t guarantee they follow the route you selected. When troubleshooting, check the client’s DNS mode, system network settings, and browser settings to make sure they aren’t overriding one another.
Traffic-routing rules decide whether a connection goes direct or through a proxy. Sending local services direct may be intentional, so seeing a local resolver in a test doesn’t necessarily mean your setup is wrong. The important thing is to check whether domains you want protected are resolved and connected to as intended, and whether your current client mode supports IPv6 and UDP traffic.
Check the client documentation first, then compare results using trusted exit-IP and DNS test tools. A test page can see the route taken by its own requests; it can’t prove that every app follows the same rules. You don’t need to provide your subscription link or account password to run a test. Stop if a test site asks for those credentials. For more on routing rules, see the Technical Reference.
Protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC each have different implementations and use cases. A protocol name alone can’t tell you whether an entire setup is secure. Client updates, credential storage, certificate validation, and which traffic is routed through the client usually have a more direct impact on the actual security boundaries.
What to Do If Your Subscription Link Is Exposed
If your full link has appeared in a public post, shared document, untrusted conversion service, or screenshot others can access, treat it as exposed. Deleting the original may limit further spread, but it can’t retrieve copies already made. Don’t wait for unusual traffic before taking action, and don’t forward the original link again when asking for help.
- Stop it from spreading and keep only the details you need. Remove the accessible content and note where and roughly when it was exposed. If you need to save evidence, hide tokens, QR codes, and connection passwords.
- Check credential management in your dashboard. Look for an option to reset the subscription link or revoke the affected credentials. If it’s unclear what the available controls do, confirm through official support. Don’t assume that changing your password has resolved the issue.
- Distinguish revoking a link from revoking server credentials. If you can’t update the old link, configurations already downloaded may not stop working immediately. Ask whether connection credentials also need to be changed and when those changes take effect.
- Update your client. Import the new subscription or update the configuration as instructed, then remove old configurations and clipboard history. If clipboard contents sync across devices, check those synced copies too.
- Check your account and devices. If your password may also have been exposed, change it promptly and update any other accounts where you reused it. Review available usage records and session controls, and contact support if you notice anything unusual.
For troubleshooting screenshots, include only the error message, client name, and settings that are needed. Full configuration files often contain more sensitive information than a screenshot; don’t post them publicly, even if the filename looks harmless. Before sending anything to support, ask which fields they need and which channel to use.
What “No Logs” Means and Everyday Credential Hygiene
VPN34’s privacy policy says it keeps no logs. That statement describes the service’s policy; it doesn’t mean your browser, operating system, destination websites, or third-party extensions keep no records. Websites can still associate activity with your account after you sign in, and using a server doesn’t automatically erase browser history or downloaded files.
IEPL, transit, and direct connections describe how network routes are arranged, not levels of anonymity. A dedicated line may improve the transmission path, transit adds forwarding steps, and a direct connection reduces them. None replaces end-to-end encryption in your apps or protects your account and subscription credentials for you.
For everyday security, keep your client and operating system updated, remove unnecessary browser extensions, and set a reliable screen lock on your devices. Avoid saving subscription details or login sessions on shared devices. If you must use one temporarily, sign out of the dashboard and remove imported configurations afterward. Unlimited devices are a usage policy, not a reason to share configurations with strangers.
Check your plan and usage in the official dashboard. Don’t sign in through an unfamiliar link in a “traffic alert.” Instead, open the official address you’ve saved and check your status there. This lets you investigate a real issue without letting a notification choose your login destination.
Everyday essentials: Use a unique account password, protect your subscription link like a key, verify sources before connecting, and revoke the right credentials if they’re exposed. On public networks, check the protection offered by HTTPS, DNS, and your routing settings separately.