This VPN safety guide for beginners answers practical questions: where to store a subscription link, whether a successful connection on public Wi-Fi means you are safe, and what personal information you need to provide when creating an account. The key is to check credentials, network connections, and website identity separately. A “connected” status alone is not enough.
Account Passwords and Subscription Links: Different Access, Both Need Protection
Your account password lets you sign in to the user panel, manage your plan, check usage, and retrieve your subscription. A subscription link usually contains an access token that a client uses to fetch route configurations. Someone with the link may be able to import a configuration and use the associated resources without knowing your account password. Protect it like an account key, but remember that it does not grant full account-management access.
The configuration returned by a subscription may also contain credentials needed to connect to nodes. Protect complete configuration files, exported backups, and QR codes just as you would the original link. Hiding only the username while leaving query parameters or a QR code visible does not effectively remove sensitive information.
| Information | Access it may provide | How to protect it |
|---|---|---|
| Account username and password | Sign in to and manage the account | Use a unique password and store it in a trusted password manager |
| Subscription link and QR code | Retrieve route configurations and use service resources | Treat them as secret credentials; do not share them in public chats or screenshots |
| Exported client configuration | May include node connection credentials | Restrict access and use protected storage for backups |
| Diagnostic logs | May expose addresses, request destinations, or tokens | Review each item before sending and share only what troubleshooting requires |
How to Store and Import a Subscription Link
Copy your subscription from the user panel after verifying its domain, then import it into a trusted client. Avoid installation packages forwarded by strangers, imitation links in search ads, and unknown online conversion tools. A conversion tool that asks for the full subscription address may gain access to its configuration; “format conversion only” does not mean it cannot read your credentials.
Client configuration formats and import steps vary by platform. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different connection options. Seeing a name in a configuration does not mean every client can recognize it, nor does it mean MeteVPN guarantees support for that option. Follow the configuration provided in the panel and the relevant client documentation. Do not change security settings at random just to clear an error.
- ✅ Store the subscription in a secure note in a trusted password manager, not in a public document or shared note.
- ✅ Before importing, verify the client’s source, maintenance status, and configuration format; grant only the permissions described in its official instructions.
- ✅ After importing, delete temporary configuration downloads and screenshots, and check whether they synced to shared storage.
- ❌ Do not paste the full link into forums, public support tickets, code repositories, or online testing pages.
- ❌ Do not share configuration QR codes in group chats or let strangers use your account for temporary testing.
If a Link Leaks, Revoke Credentials Before Investigating Further
Act as soon as you notice unusual usage, find a link posted publicly, or realize that you gave a configuration to an untrusted tool. You do not need to wait until you know someone has used it. Deleting a post may limit further spread, but it cannot invalidate a link someone has already saved.
- Identify what was exposed. Work out whether the leak involved a subscription, node configuration, account password, or login session. Note where it happened and what you observed, without sharing the original secret again.
- Find the reset or revocation option. Use the functions available in the panel. If you cannot find one, contact support and ask to revoke the exposed credential instead of posting the old link publicly again.
- Import a valid configuration again. Update your client and remove the old configuration. Confirm whether revocation also covers node credentials already issued; a changed link alone does not prove that it does.
- Address related risks. If your account password was also exposed, change it and check your sessions. Change it separately on any other sites where you reused it.
Changing your login password alone may not invalidate a subscription token or an already exported configuration. Likewise, resetting a subscription does not necessarily sign out existing panel sessions. The exact scope depends on how the service works, so check the panel documentation or confirm with support.
Public Wi-Fi: What an Encrypted Connection Can Protect
Risks on public networks include fake hotspots, tampered sign-in pages, untrusted local network devices, and users installing unknown certificates or software. Hotspots with the same name are not necessarily operated by the same organization. Verify the network name with venue staff before connecting, and turn off auto-join when you leave to prevent your device from reconnecting later.
HTTPS encrypts content between your browser and the destination website and checks the website’s identity through its certificate. When certificate checks have not been compromised, a public hotspot cannot read encrypted page content merely by being on the network path, though it may still observe metadata such as connection destinations. An encrypted VPN or proxy connection can further limit what the local network can observe about traffic routed through it; the coverage depends on the client’s mode.
This does not stop you from entering a password on a fake website, and it cannot remedy malware on your device. Do not dismiss certificate warnings. If a hotspot sign-in page asks you to install a root certificate, configuration profile, or program from an unknown source, stop and check with the venue. Hotspot authentication and service-account login are separate processes; never enter your MeteVPN password on a hotspot sign-in page.
After Connecting, Check Routing Rules and DNS
System-wide tunnels, system proxies, and in-app proxies cover different traffic. If your browser can access international websites, that does not mean terminal commands, games, or background apps use the same route. Rule-based modes may route traffic according to domain, address, or app, and requests matched by direct-connection rules may not pass through a proxy.
Check the client’s routing and DNS documentation, then use the network check page to see the current exit address reported to your browser. This result confirms only the route used by that request; it cannot prove that every app and DNS query is protected. Do not submit your subscription link or account password to a testing tool.
A DNS leak usually means domain lookups are taking a different route than expected—for example, you expect them to use the tunnel, but they are still sent to the local network. Browser encrypted DNS, system resolver settings, and client rules can affect one another. If a test shows an issue, compare the expected resolver, actual results, and client logs rather than drawing conclusions from the resolver’s location alone.
Windows and macOS clients may offer both system proxy and tunnel options. Android’s VPN interface, iOS network extensions, and Linux routing configurations also differ. Permission prompts and system connection indicators do not replace checking traffic coverage. For installation and import instructions, use the client guides on this site; do not copy rules that do not match your client.
When Creating an Account, Share Only Necessary Privacy Information
MeteVPN does not require an email address. You can create an account with a username and password. Your username does not need to be your real name, school, employer, or usual social media handle; avoiding those details makes it harder to link your accounts across platforms. Use a unique password and save it in a trusted password manager. Since no email is required, read the account recovery rules in advance rather than assuming recovery by email will be available.
Information needed to create an account, process a payment, and troubleshoot an issue serves different purposes. MeteVPN supports Alipay, WeChat Pay, and USDT. Payments may still create transaction records with the relevant provider, so not requiring an email address does not mean there can be no identity links at any stage. If asked for additional information, first check the page’s domain, purpose, and necessity.
When contacting support, start by sharing your platform, client name, error message, and the network environment where the issue occurs. Hide subscriptions, tokens, QR codes, and unrelated personal information in screenshots. If support needs more diagnostic details, confirm the recipient and scope before sharing the minimum necessary information. Do not upload the entire configuration directory.
Store subscription links as secret credentials and confirm what revocation covers if one leaks. Keep certificate checks enabled on public Wi-Fi, and review routing rules and DNS. Share only the information needed to create an account. Connection status, network encryption, and account security each cover different risks; check all of them.