A VPN's device allowance looks like a simple number until you try to use it across a phone, laptop, tablet and travel router. Some limits concern simultaneous connections; others involve devices registered to an account. A router can also change the count without removing the need to protect a device when it leaves that router.
For remote work, the best fit is the service whose rules match your actual arrangement. Paying for the highest advertised count is unnecessary if you cannot install the application on the work laptop in the first place.
Count routes, not screens
Make an inventory of devices that need a tunnel and where they will connect. A phone using mobile data and a laptop using hotel Wi-Fi are two separate routes. A tablet left offline in a bag does not create the same immediate demand.
Then mark ownership. Work-managed equipment belongs in a separate category because installation and routing may be controlled by the employer. A consumer subscription's allowance does not grant permission to change that equipment.
A simple inventory often reveals that the problem is smaller than expected. One person may need two simultaneous personal connections rather than protection for every device they own. Two people with independent schedules may need separate account arrangements, not merely a larger pool of slots.
The documented limits in this comparison
Proton describes one VPN connection on its free plan and up to ten simultaneous connections on VPN Plus. Mullvad permits up to five devices on an account, with device removal available when the account is full. The difference in wording matters. Proton plan documentation, Mullvad device registration instructions
| Situation | What the limit means in practice |
|---|---|
| One phone and one personal laptop connected at once | More than a one-connection plan supports |
| Four personal devices, each configured separately | Count the actual registrations and concurrent sessions under the provider's rules |
| A router plus a phone used away from the router | The router does not eliminate the phone's separate off-router requirement |
| A family or team sharing access | Device capacity does not establish account-sharing permission or separate administration |
Do not convert these facts into a security score. Ten connections are not twice as secure as five. The allowance is a capacity and licensing feature.
For example, suppose one person has a phone, laptop and tablet registered with Mullvad, plus two obsolete device registrations. All five slots are occupied even if only the laptop is online. Adding a router requires removing an obsolete registration through the official process first. That resolves a registration-capacity problem; buying a plan with ten simultaneous connections addresses a different need. Confirm which entry is obsolete before removing it.
Router installation changes the route
When a compatible router runs a supported VPN client, devices whose traffic is routed through that tunnel can share its upstream VPN connection. Mullvad explicitly identifies a WireGuard-capable router as an option when discussing its device allowance. Mullvad device-limit FAQ
The appealing part is centralized configuration. The limitation is that the protection follows the route, not the owner. When the phone switches to mobile data, it is no longer using that router's tunnel. If the laptop joins the venue network directly, the same applies.
You must also understand what the router does if the VPN fails. A router that silently sends traffic through its ordinary internet route may not match your intention. Check the exact firmware's routing and blocking controls rather than assuming a desktop application's settings exist on the router.
A router setup can simplify several personal devices, but it creates an additional device to update, power and troubleshoot. It is not automatically the simpler choice for a person carrying only a phone and laptop.
A phone VPN is not proof about hotspot clients
Do not infer that a laptop tethered to a phone uses the phone application's VPN merely because the phone displays a connected icon. Hotspot traffic handling depends on platform and configuration. NCSC guidance on VPNs and tethering
The safe planning assumption is that the laptop's route needs its own verification. Use a supported client on the laptop where permitted, or a documented router arrangement. Confirm the behavior through the provider's official guidance for the actual platform.
This distinction prevents a common diagram error: placing a VPN icon on the phone and drawing every nearby device inside its protection. Physical proximity is not routing evidence. Neither is sharing the same data allowance.
Keep employer access separate
A company VPN can require particular DNS, routing or device controls. Adding a personal VPN may interfere with those requirements. The right response is to ask IT, not to experiment until one combination happens to connect.
Tell the administrator what you are trying to achieve: approved work access over guest Wi-Fi, a mobile backup or a travel router. They can identify the supported arrangement and whether personal networking equipment is allowed.
Never use a consumer VPN to misrepresent your work location or evade a company's access restrictions. The device-count comparison does not change the employment, security or compliance rules attached to the account.
More people means more than more devices
Sharing one consumer login can make recovery and administration awkward. Who changes the credentials? Who can remove a device? What happens when a colleague leaves the trip or someone loses a phone?
Check the provider's account-sharing terms and choose an appropriate service rather than treating spare connection capacity as permission to resell or distribute access. For a business, separate identities and administrative controls may matter more than the cheapest consumer plan.
For travel companions, discuss what should remain independent. If both people's access depends on one person's phone, password manager and payment card, the arrangement has a concentration problem even if the VPN permits enough connections.
Compare total cost for your arrangement
Suppose a hypothetical service costs 6 currency units per month for five devices, while another costs 9 for ten simultaneous connections. A single traveler needing two connections does not gain useful capacity merely by spending the extra 3 units. A group with different needs cannot assume the second plan authorizes shared accounts.
Long subscriptions add another dimension. Compare the payment due for the period you intend to keep the service and the renewal terms, not only a monthly equivalent. Our hotel and airport VPN guide discusses the pricing evidence and the limits of this shortlist.
Do not divide subscription cost by every advertised device slot and call that your savings. Unused capacity has no practical value unless it preserves flexibility you genuinely need.
Rehearse the transitions
Test the moments when the arrangement changes: leaving the room with the phone, waking the laptop, switching to a hotspot and restarting the router. A setup that works only when every device remains in one place is not a complete travel setup.
Check the connection state on each device, not only on the router dashboard. Keep the recovery steps available without depending on the service currently being repaired. If a registration limit is reached, know the official route for removing an old device.
For personal use, Proton Plus is a candidate when the larger documented simultaneous allowance is useful; Mullvad is a candidate when five registered devices fit and its account model suits you. For managed work, the approved company solution leads. None wins merely by displaying the larger number.
Put the account limit into a complete multi-device travel setup, with a named connection and recovery route for each device. If a router is part of that design, the router-versus-hotspot guide explains which box supplies cellular internet and which only shares an existing connection.
Method: official limits checked on 11 October 2026. No multi-device routing or hotspot inheritance was tested. Examples are planning scenarios, not measured performance or permission to share accounts.
