Overview
The client does one thing: it wraps the machine's traffic in an encrypted tunnel to a server somewhere else, so the local network sees an encrypted stream and the destination sees the server's address rather than yours. On a hotel or airport connection that is the difference between a browsing session anyone on the same access point can watch and one they cannot.
The protocol side is the part worth caring about. This build carries the current tunnelling protocol with a fallback that runs over a standard web port, which is what keeps it connecting on restricted networks that block anything unusual. Reconnection is automatic, and the kill switch drops all traffic if the tunnel goes down rather than letting the connection quietly fall back to the open network.
Split tunnelling decides what actually goes through the tunnel. Applications can be added to a list that bypasses it, which matters for anything that breaks when the apparent location changes, or inverted so only nominated applications are tunnelled and everything else takes the normal route. Rules can be set per network, so a home connection behaves differently from an unknown one.
The premium configuration removes the free tier restrictions: the daily bandwidth cap, the single location, the device limit and the advertising. The full server list is available with a latency readout per location, and the client can connect automatically on an untrusted network before anything else has a chance to talk.
What it does well
Encrypted tunnel
Current tunnelling protocol with a fallback over a standard web port so it still connects on restricted networks.
Kill switch
Traffic is blocked entirely if the tunnel drops, rather than silently reverting to the open connection.
Split tunnelling
Per-application include or exclude rules, configurable per network, so only what should be tunnelled is.
Full server list
Every location available with a live latency readout, no restriction to a single region.
Automatic connection
Connects on its own when the machine joins a network that is not on the trusted list.
Changes in this build
- Protocol updated with faster handshake and better throughput on high latency links.
- Split tunnelling rules can now be set per network profile.
- Kill switch rewritten to engage before the tunnel fully drops rather than after.
- Server list gained live latency and load readouts.
- Reduced idle CPU use in the background service.
What is in the package
- Hotspot Shield client installer, 32 and 64-bit
- Tunnel driver component
- Full server location list
- Split tunnelling and kill switch modules
- Multilingual interface files, 22 languages
System requirements
| Processor | Any x86 or x64 processor |
| Memory | 2 GB |
| Graphics | Not applicable |
| Storage | 300 MB free |
| Display | 1024 x 768 minimum |
| System | Windows 7 through Windows 11, 32 or 64-bit |
Installation
- Extract the archive and close any other tunnelling client.
- Run the installer and allow the tunnel driver when the system prompts.
- Reboot so the driver registers cleanly.
- Apply the included configuration step to enable the premium tier.
- Turn on the kill switch and add your home network to the trusted list.
Before you start
Two tunnel drivers on one machine conflict. Remove any other client first.
Some services detect and block tunnelled connections. Split tunnelling is the way around that.
The kill switch blocks all traffic when engaged, which looks like a dead connection. Check its state before troubleshooting anything else.
Questions about this title
Is bandwidth capped?
No, the daily cap that applies to the free tier is removed in this configuration.
Can I choose any location?
Yes, the full server list is available rather than a single region.
Does the kill switch work?
Yes, it blocks traffic if the tunnel drops rather than falling back to the open network.
Will it work on a restricted network?
The fallback protocol runs over a standard web port, which gets through most restrictions.
About this listing
This entry was checked on a clean install of Windows 7 / 8 / 10 / 11 before it was published, and it is rechecked whenever the package is rebuilt. The figures on this page come from the site index rather than from the publisher, so the download count is what people here have actually pulled.
If a mirror stops answering, use the contact form and it gets replaced. Reports about a specific title are handled faster than general messages because they name the file, the mirror and the point at which the transfer stopped.
Requests for a different version, a different language build or an older release go on the requests page. Older versions of a title are usually still held even when only the current one is listed.