7 min read
Turbo VPN, VPN Proxy Master, Super VPN, Jump Jump VPN and "Hero VPN" are among the most downloaded free VPNs on Google Play. Some of them have been examined by independent researchers, and the findings aren't pretty. In August 2025, Citizen Lab and Arizona State University found that Turbo VPN and VPN Proxy Master belong to the same group of companies, use outdated encryption and hard-code into the app a password shared by all users. Anyone who knows it can decrypt the traffic. We found no independent audits of Jump Jump or Hero, and that's useful information too.
These app names are searched a lot: "super vpn", "turbo vpn", "jump jump vpn", "hero vpn" and "vpn master", together with their "download" variants, get about 280,000 impressions a month in Russian search (Yandex Wordstat, August–September 2026). There won't be download links here. Let's look at what's known about each.
The developer of Turbo VPN on Google Play is Innovative Connecting Pte. Ltd., a Singapore company. In April 2025 the Tech Transparency Project traced the ownership chain: Innovative Connecting's shareholder is Lemon Seed Technology in the Cayman Islands, and in 2019 Lemon Seed was bought by the Chinese company Qihoo 360, which disclosed the deal in its annual report. In June 2020 the US Commerce Department added Qihoo 360 to its sanctions list. Qihoo later reported selling these assets, but 2025 filings still list as director a person whom Chinese media had described as a Qihoo 360 manager.
The same group publishes VPN Proxy Master, Thunder VPN, Snap VPN and several other apps. For users this means that "different" VPNs in the store may be the same service with different icons.
Citizen Lab's paper "Hidden Links" (FOCI 2025) examined 21 popular VPN apps with more than 970 million downloads in total. For the family that includes Turbo VPN, Turbo VPN Lite, VPN Proxy Master and VPN Monster, the findings are:
| What was checked | Result |
|---|---|
| Password to Shadowsocks servers | Hard-coded into the app, the same for all users of Turbo VPN, Turbo VPN Lite and VPN Monster. Anyone who knows it can decrypt intercepted traffic |
| Encryption | rc4-md5, an outdated cipher from the deprecated list |
| Location data | The app requests your zip code based on your IP and sends it to analytics, even though the privacy policy says addresses aren't collected |
| Connection attacks | All eight apps in the family are vulnerable to blind in/on-path attacks, which let an outsider interfere with active connections |
| OpenVPN | There's a switch in the settings, but at the time of testing it couldn't be selected |
An analogy: a shared password for everyone is like every resident in a building having the same mailbox key, with that key printed in the lock's manual.
"Super VPN" usually means "VPN - Super Unlimited Proxy" by Super VPN Inc (more than 100 million downloads on Google Play). Citizen Lab looked at this app too: the authors found no links to the Turbo VPN families, and the app supports OpenVPN and IPsec (IKEv2). That's better than a hard-coded shared password, but it isn't a full security audit: the researchers didn't analyze this app's cryptography in detail.
Also keep in mind that there are dozens of apps with "Super" in the name. Super Z VPN, for example, belongs to another family from the same study, and hard-coded passwords were found in it too.
We found no independent technical audits of Jump Jump VPN or of apps called Hero VPN. That doesn't mean they're dangerous, but it doesn't mean they're safe either. Identical names on Google Play and elsewhere often hide different apps from different developers, and an APK "from the Jump Jump website" may have nothing to do with the app in the store.
If you already use one of them, check its store listing:
More signs of clones and fakes in our article on fake VPN apps.
Even setting privacy aside, these apps have a practical problem. Turbo VPN and its family run on IPsec and Shadowsocks with an old cipher, and Super VPN on OpenVPN and IPsec. In Russia, traffic filters recognize these protocols, so such VPNs connect one moment and fail the next. Hence the popular queries "turbo vpn not working" and "super vpn won't connect".
Protocols that disguise themselves as ordinary HTTPS hold up much better. How it works: Reality and VLESS in plain words. Which other protocols work right now: VLESS, OpenVPN or WireGuard.
There are three options, and each has a price.
How to compare services, we covered in detail in free or paid VPN and which VPN to choose. There's a separate piece on "folk" apps like Tok and Tik: what are folk VPNs.
We have a direct interest in this topic: BessyConnect is a paid service with a trial period. So, only verifiable facts. The protocol is VLESS with Reality camouflage, a modern scheme without outdated ciphers like rc4-md5. There are more than a hundred servers, no logs, no required registration and no device limit. The developer is sole proprietor Pavel Alekseevich Onuchin, and the privacy policy is published: https://bessy.my/docs/privacy.
More about the service in our BessyConnect review.
Is Turbo VPN safe? According to Citizen Lab (2025), Turbo VPN contains a Shadowsocks password shared by all users and uses the outdated rc4-md5 cipher, so intercepted traffic can be decrypted. The app also sends the user's zip code to analytics.
Is Turbo VPN Chinese? The developer is registered in Singapore, but according to the Tech Transparency Project, its parent company was bought in 2019 by China's Qihoo 360, which has been under US sanctions since 2020.
Are Super VPN and Turbo VPN the same thing? No. Citizen Lab researchers didn't link "VPN - Super Unlimited Proxy" by Super VPN Inc to the Turbo VPN family. But there are many apps with "Super" in the name, and some belong to other families with similar problems.
Why doesn't Turbo VPN work in Russia? It uses IPsec and Shadowsocks with old encryption, which traffic filters recognize. Protocols disguised as HTTPS hold up better.
Is Jump Jump VPN safe? We found no independent technical audits of Jump Jump VPN. Judge it by its developer, permissions and stated protocol, and don't install APKs from third-party sources at all.
Which VPN to choose in 2026: 6 honest criteria — protocol, servers, logs, devices, traffic and sign-in. How to pick the best VPN and why BessyConnect fits. More
What you really pay for a free VPN and what a paid VPN gives you: encryption, servers, logs, speed. An honest comparison and where BessyConnect fits in. More
Reality vs Shadowsocks vs Trojan in 2026: which protocol beats blocks and DPI. An honest comparison of resilience, speed and setup — and where BessyConnect fits. More
