Best VPN for Firefox in 2026

Which VPNs actually publish a Firefox add-on?

Eight of the nine providers in our database publish an official Firefox add-on. One — TotalVPN — publishes none, and we could find no listing under its name on addons.mozilla.org. That is not a criticism so much as a design decision: its coverage of Firefox comes from the desktop app, which protects the whole device rather than one browser. But if you specifically wanted a toolbar button in Firefox, it is worth knowing before you go looking for it.

Three things in that table are worth slowing down for. First, the scale: those eight add-ons come to roughly 656,000 daily users between them, and one of them accounts for about 45% of that. For comparison, the same providers' Chrome extensions are counted in the millions. Firefox VPN add-ons are a genuinely smaller world, which is part of why several of them get less engineering attention than their Chrome siblings.

Second, only two of the eight do anything without a paid plan. Proton VPN's add-on works on the free plan — the company confirmed in its own documentation that the extension is available to everyone with a Proton account, including Proton VPN Free — and CyberGhost's listing describes its proxy plugin as free to use. Every other listing here is a front door to a subscription: install it without one and it will simply ask you to sign in. If you arrived at this page hoping to avoid paying, the honest shortlist is two names long. Our guide to free VPNs covers what that actually buys you, and the VPN price index tracks what each provider charges today if you decide a paid plan is worth it.

Third, one listing in that table is not a VPN proxy add-on at all. IPVanish Secure Browser opens a browser session running in IPVanish's cloud rather than routing your Firefox traffic through a proxy — a different product solving a different problem. We confirmed this from the manifest rather than the marketing: it is the only listing here that does not request Firefox's proxy permission, which a proxy add-on cannot function without.

The maintenance gap: when each add-on was last updated

This is the column most Firefox VPN round-ups leave out, and it may be the most useful one on the page. A VPN add-on is proxy plumbing living inside a browser that ships a new version roughly every four weeks. Firefox changes; the add-on has to keep up. The Last updated date on a listing is the only free, public, provider-independent signal you get about whether anyone is still doing that work.

The split is stark. Four add-ons — ExpressVPN's, Surfshark's, NordVPN's and Proton VPN's — were all updated within the last six weeks. The other four were not. CyberGhost's was last updated in June 2025, IPVanish's in February 2025, Private Internet Access's in January 2025, and PureVPN's in February 2024, which is a little over 29 months ago. In Firefox release terms, PureVPN's add-on has not shipped a change against roughly the last two dozen versions of the browser it runs inside.

A stale listing is not automatically dangerous, and it does not mean the add-on has stopped working. Proxy code is relatively stable, and a well-built add-on can sit untouched for a long time without breaking. But it does tell you something real about where a provider is spending its effort. It is also visible in the listing text itself: CyberGhost's add-on description still references Flash content and a Google social network that shut down in 2019 — copy that has clearly not been revisited in years, whatever the code underneath is doing.

What these add-ons ask permission to do — and what Mozilla has vouched for

Every Firefox add-on declares its permissions in a manifest, and that manifest is public. It is the closest thing to a contract you get: whatever the marketing says, the manifest is what the add-on is technically allowed to do once installed. Here is what each of these listings declares, read on 31 July 2026.

Two entries stand out. Proton VPN is the only one that makes proxy an optional permission rather than a required one, meaning Firefox asks you to grant it rather than handing it over at install time. That is a small but real difference in how much the add-on can do before you have said yes to anything. At the other end, Surfshark's manifest declares access to Google search result pages on around 190 Google country domains — every google.co.uk, google.de, google.com.br and so on. That is an unusually specific request for a VPN add-on, and while there are legitimate reasons an extension might touch search pages, it is the kind of thing worth knowing you have agreed to.

There is also something none of them have. Mozilla runs a vetting programme that puts a Recommended badge on add-ons that have passed a manual technical and policy review, and a By Firefox badge on ones Mozilla publishes itself. Not one of these eight VPN add-ons carries either badge. We checked the same field against Mozilla's own Multi-Account Containers add-on, which does carry a badge, so this is a real absence rather than a gap in the data. It does not mean these add-ons are unsafe — the VPN category as a whole sits outside the recommended programme — but it does mean the store is not vouching for any of them, and neither should a list that tells you otherwise.

WebRTC leaks in Firefox: what is actually true in 2026

This is the question Firefox users ask most after installing a VPN add-on, and most of the advice floating around is a decade out of date. The short version: Firefox already protects your local network address by default, but it does not hide your real public IP from WebRTC on its own. That is the gap a VPN is supposed to close, and it is worth understanding precisely, because the standard advice — "disable WebRTC" — breaks video calling for a problem you may not have.

WebRTC is the browser technology behind in-browser video calls and voice chat. To connect two people directly it has to work out what addresses each end can be reached on, and that discovery process is what can expose an IP address to a website. There are two different addresses at stake, and they are not equally exposed.

• →Your local (LAN) address — something like 192.168.1.14. Firefox has obfuscated these behind randomised mDNS hostnames by default for years; the preference that controls it, media.peerconnection.ice.obfuscate_host_addresses, ships set to true. This one is already handled.
• →Your real public IP — the address your ISP gave you, the one that identifies your household. This is the one that matters, and Firefox does not mask it by default. If a browser add-on reroutes your page traffic but leaves WebRTC alone, a website can still learn your real IP through it.

That is why the privacy permission in the table above matters more than it looks. It is what lets an add-on change Firefox's WebRTC handling on your behalf — either switching WebRTC off entirely or, better, telling Firefox to route WebRTC's address discovery through the proxy instead of leaking around it. Seven of the eight add-ons declare it. And at least one provider is explicit about it in its own store listing: NordVPN's Firefox listing states that the extension prevents WebRTC leaks by controlling hidden WebRTC privacy settings, which is exactly this mechanism described in marketing language.

You can also fix this yourself in about a minute, without any add-on. Firefox exposes the relevant switches in about:config, and unlike Chromium browsers it lets you change WebRTC's behaviour without uninstalling anything. Here are the preferences that actually matter, with the values Firefox ships by default — all four confirmed against Firefox's own source in July 2026.

So the sensible order of operations is the reverse of the usual advice. Start with the targeted settings, and only reach for the switch that disables WebRTC if you genuinely never make browser-based calls:

1. Connect your VPN — add-on or app — the way you normally would.
2. Check whether you actually have a leak before changing anything. Our WebRTC leak test shows you what a website can see through WebRTC right now; if the address shown is your VPN's and not your own, there is nothing to fix.
3. If your real IP is showing, type about:config in the address bar and accept the warning.
4. Search for media.peerconnection.ice.default_address_only and set it to true. Re-run the leak test.
5. Still leaking? Set media.peerconnection.ice.no_host to true as well, and test again.
6. Only if you have no use for in-browser video calls at all, set media.peerconnection.enabled to false. This ends WebRTC leaks permanently because it ends WebRTC.

Why a Firefox VPN add-on is not just the Chrome one recompiled

It is easy to assume the Firefox and Chrome versions of a VPN extension are the same software with a different icon. They are not, and the reason is architectural. Firefox and Chrome both expose an extension API called proxy, but Mozilla's documentation is blunt that the two are completely different designs and mutually incompatible — Firefox's version is only reachable through the browser namespace precisely because it cannot pretend to be Chrome's.

The practical difference is where the decision gets made. Chrome's API is essentially a configuration you hand to the browser: here is my proxy, use it. Firefox's includes proxy.onRequest, an event that fires per request and runs inside the add-on's own background script, with access to the rest of the WebExtensions toolkit while it decides. The add-on can look at each individual request and answer the question "should this one go through the tunnel, and if so which one?" in code.

That is what makes genuinely per-site and per-context routing possible in Firefox in a way it is not in Chrome. It is also the technical foundation under the container workflow Firefox users like — routing one browsing context through one location while another goes direct — because a per-request hook is exactly what you need to implement it. Mozilla's own Multi-Account Containers add-on, which has around 386,000 daily users and a 4.6-star rating from more than 8,000 reviews, does not itself request the proxy permission; the routing has to come from the VPN add-on's side.

The takeaway for choosing: a provider that has genuinely built for Firefox has written Firefox-specific code, not ported Chrome's. The maintenance chart above is a reasonable proxy for who has. And if you want the same comparison for the other side of the browser split, we did the identical exercise on the Chrome Web Store listings in our free VPN for Chrome guide and our Chrome VPN guide.

How to read all of this when you are actually choosing

Put the store data together and the decision collapses into three questions, in this order.

1. Do you need protection beyond the browser? If anything outside Firefox matters — email clients, cloud sync, torrents, games, anything at all that is not a tab — an add-on cannot help you and the add-on comparison is the wrong comparison. Install the app instead.
2. Are you willing to pay? If not, the field narrows to two of the nine providers: Proton VPN's add-on on its free plan, and CyberGhost's free proxy plugin (with the WebRTC caveat its own listing discloses). Everything else will ask you to sign in.
3. Is somebody still maintaining it? Four of these eight add-ons were updated within the last six weeks and four have not been touched in over a year. That is a fact you can re-check yourself in five seconds on any listing, and it will still be true after this page goes stale.

What none of this tells you is which service is fastest or unblocks what you want to watch — those depend on the underlying network, not the add-on. For that side of the decision, our fastest VPN comparison and the price index are the more useful pages. What the store data does settle is the narrower question this page exists to answer: which providers have actually built something for Firefox, and which ones are pointing you at a listing nobody has opened in two years.