Two people can buy the same subscription, install it in two different places, and end up with two different things protected. Setting up VPN on home router vs VPN app per device is not a convenience question about how many taps it takes. It is a question about where the encrypted tunnel starts, and the answer decides which of your traffic is inside it.
This is an independent editorial review. NordVPN did not review or approve this article.
NordVPN is a service rather than a piece of hardware, and the setup details quoted here were read from its own published support pages on the date of writing; the federal standards publication quoted alongside them describes network architectures in general terms and was not written about this or any other consumer service, so it explains what each arrangement protects rather than recommending either one.
You can see NordVPN’s current lineup on its official site:
Reading VPN on home router vs VPN app per device in one table
The table below is the whole comparison. Every section after it unpacks one row.
| What you are comparing | VPN configured on the router | VPN app installed on the device |
|---|---|---|
| Where the tunnel starts | At the router, on the way out of the house | On the device itself |
| What sits outside the tunnel | Everything between each device and the router | Nothing, until the traffic leaves the device |
| What it covers | Anything that joins that network, app or no app | Only the device the app is installed on |
| Account slots used | One, however many devices connect | One per device |
| Control over individual apps | None. One setting for the whole network | Per app, and switchable in seconds |
| Away from home | Stops at the front door | Travels with the device |
| What has to support it | The router’s own firmware | The operating system on the device |
Two arrangements, and a standards guide already named both
This is not a new question, and it is not really a consumer question either. The National Institute of Standards and Technology describes the same two shapes in its Guide to IPsec VPNs, and the names it uses are more honest than the marketing ones.
A router carrying the VPN is what the guide calls a gateway arrangement. One connection establishes, in its words, “a cryptographically protected tunnel between the gateways.” The sentence that matters comes next: that design “only protects data between the two gateways.” Traffic between the clients and their local gateway, and between the far gateway and the machines it is talking to, is not protected by it.
An app on a laptop or a phone is the other shape, which the guide calls remote access, “also known as host-to-gateway.” There, “each remote access user then establishes a VPN connection between their remote device (host) and the VPN gateway.” The guide is equally blunt about its limits: that arrangement “does not provide full protection for data throughout transit” either, because the leg past the gateway is still in the clear.
So one arrangement is not a bubble around your whole life and the other is not either. They protect different legs of the same journey, and the leg each one leaves out is the useful thing to know.
Where the tunnel starts decides what is left outside it
Set the two descriptions against each other and the practical difference falls out. With the VPN on the router, the hop from your laptop to the router is outside the tunnel. On a home network that hop is your own wiring and your own Wi-Fi, which is a risk a household can reasonably accept. On a shared network it would be a different judgment entirely.
With the app, the tunnel starts inside the device, so that first hop is covered wherever the device happens to be. That is why the app keeps working on a hotel network and the router setup does not: the protection is a property of the machine, not of the building.
A VPN on home router versus VPN app per device changes the device count
The arithmetic is the part most buyers notice first, and NordVPN publishes it plainly. Its support pages state that “You can connect up to 10 devices to a single NordVPN account at the same time,” with a condition attached: “If you connect the devices to the same server, you have to choose different VPN protocols,” which it works out as “a total of five devices can be connected to one server at the same time.”
Against that, the router line is short and does the heavy lifting: “The router uses only one device slot, but the VPN will protect all the devices connected to the network.” The brand’s own feature page says the same thing from the other direction, offering to “Protect unlimited devices using NordVPN with your router.”
So weighing a VPN on home router versus VPN app per device on slot count alone has an obvious winner, and that is exactly why slot count is the wrong thing to weigh it on. The router buys you coverage for things that could never have run an app in the first place:
- A television or streaming stick with no VPN client available for it
- A games console that offers network settings but no VPN software
- Lighting, plugs, sensors and other fixtures with no screen at all
- A guest’s phone, which nobody is going to install anything on
Why the difference between VPN on home router and VPN app per device shows up app by app
The difference between VPN on home router and VPN app per device that catches people out is not coverage. It is exemptions.
The standards guide names the feature directly. Some networks “do not want to receive all of the internet traffic generated by a remote host,” so the client is configured to send only some of it through the tunnel. “This is called a split-tunnel VPN.” The opposite setting is full tunneling, where “a remote host will send all its traffic via the VPN connection.”
That choice lives on the device, because the device is the only thing that knows which application is asking. A router sees packets leaving a network; it does not see that one of them belongs to a banking app that refuses to load over a VPN, or to a work tool that expects your real address. On the router there is one switch and it governs the house. On the device there is a list.
The practical consequence: if even one service on your network breaks under the VPN, a router-only setup gives you two options, on or off, and the off applies to everybody.
Choosing VPN on home router or VPN app per device for beginners
Working out VPN on home router or VPN app per device for beginners is easier as a sequence than as a verdict, because the first answer is usually both.
- Check what your router actually runs. NordVPN publishes a list of models that cannot be used with their native firmware, and most equipment supplied by an internet provider is on it.
- Count the things on your network with no app available. If that number is zero, the router adds very little.
- Decide whether anything has to be exempt. If yes, you need the app on at least the device that runs it.
- Ask how much of your use happens away from home. Phones and laptops spend half their life on other people’s networks, where a router at your house is no help at all.
- Set the router up for the fixtures, and keep the app on the devices that travel. The router’s single slot leaves the other nine free.
What to check before you change anything
Three things are worth confirming before you start, and all three are free to check.
- Whether the router’s firmware supports a VPN client at all, as opposed to a VPN pass-through, which is a different and much weaker feature.
- What happens to the whole house if the VPN connection drops, since a router has no screen to warn you.
- Whether anyone else in the house needs to be able to turn it off, and how they would do that.
Frequently Asked Questions
These are the questions readers send after they have already read the setup guide and are still not sure which arrangement they want.
If the router is covered, do I still need the app on my phone?
For anything that leaves the house, yes. The router protects traffic that passes through it, so the protection ends where the network ends. A phone on mobile data or on someone else’s Wi-Fi is on its own.
Does running both at once double the encryption?
No, and it is not the reason to do it. A device running the app inside a network that already routes through the VPN is simply using its own tunnel instead of the router’s. The useful result is that the device keeps its own settings wherever it goes.
Can I put some devices on the router tunnel and leave others off it?
Not with one router setting. Some equipment supports a second network with different rules, which is the usual workaround, but the basic arrangement applies to everything that connects.
Why does my provider’s router not offer this?
Because the feature has to exist in the firmware, and provider-supplied equipment is usually locked to the firmware it shipped with. That is a hardware question rather than a subscription question, and no plan changes it.
You can see NordVPN’s current lineup on its official site:
Bottom line
The router covers what cannot cover itself, and it covers nothing once you walk out the door. The app covers one machine anywhere on earth and lets you make exceptions. Most households end up wanting both, and the single device slot a router consumes is what makes that affordable.
