Split tunneling explained: run your VPN only where it counts
Per-app routing solves the classic conflict between streaming through a VPN and the apps that refuse to work with one.
What split tunneling does
Split tunneling divides your traffic into two lanes: some apps or sites travel through the encrypted VPN tunnel, and the rest connect to the internet directly, as if no VPN were running. Instead of the all-or-nothing choice, VPN on for everything or off for everything, you draw the line per app. The feature lives in your VPN client's settings, usually as a simple include or exclude list.
The classic use case: banking plus streaming
The scenario that sells split tunneling: you are streaming a foreign catalog through a VPN server abroad when you need to check your bank. Banks treat logins from VPN data-center IPs, especially foreign ones, as fraud signals, and lock accounts accordingly. With split tunneling, the banking app is excluded from the tunnel and connects directly from your real location, while the streaming app stays routed abroad. Both work simultaneously; neither compromises the other.
Other jobs it quietly handles
Exclusions fix most VPN friction: printers and smart-home devices that need your local network, game launchers where every millisecond of latency counts, and work tools that block VPN ranges. Inclusions run the other way, routing only your torrent client or browser through the tunnel while everything else stays fast and direct. Once configured, the routing is invisible; apps simply work the way each one needs to.
The security trade-off to respect
Every excluded app is naked: its traffic is unencrypted by the VPN and carries your real IP address. That is the entire mechanism, so treat the exclusion list as a security document. Keep browsers and anything handling sensitive content inside the tunnel, exclude only what genuinely needs directness, and audit the list occasionally, because the exception you added for one trip has a way of surviving for years unnoticed.
How Surfshark and ExpressVPN implement it
Surfshark (9.3/10) offers per-app routing with the industry's most generous coverage terms, unlimited devices at $1.99 a month, so the same split-tunneling setup can exist on every gadget you own. ExpressVPN (9.5/10) pairs its desktop split tunneling with a unique extra: on its Aircove router, routing decisions can be made at the network level, deciding which devices in your home use the VPN. At $4.99 a month, it is the whole-house version of the same idea.
Setting it up well
Start from a default of everything tunneled, then exclude deliberately: banking and payment apps first, then local-network tools, then latency-critical games if you notice problems. Avoid the inverted approach of tunneling only one app unless you have a specific reason, since it leaves everything else exposed by default. After configuring, verify both lanes: check that an excluded app sees your real IP and an included one sees the VPN's.
Frequently asked questions
Is split tunneling safe to use?
What is inverse split tunneling?
Why can I not split tunnel on my iPhone?
Related reading
VPNsBest VPN for Windows in 2026
One pick for people who want it handled automatically, one for people who want every switch exposed.
VPNsBest VPN for routers in 2026: whole-home coverage
One router-level install protects every device you own, uses a single subscription slot, and covers gadgets that cannot run apps.
VPNsHow to Set Up a VPN in 2026: Phone, Desktop, TV, and Router
Every platform boils down to the same four moves: install, sign in, connect, verify; here is exactly how on each device.