Why you need both

Two separate problems, two separate solutions. An eSIM gives you a data connection inside mainland China — your U.S. carrier plan almost certainly won't work on Chinese networks, and even if it does, it'll be slow and expensive. A VPN lets you access the open internet from that connection — Google, Gmail, Instagram, WhatsApp, and most Western apps are blocked in mainland China without one.

Hong Kong is an exception: it has its own telecom infrastructure and no firewall. Your U.S. plan may roam there normally, and no VPN is needed. The moment you cross into Shenzhen, the firewall kicks in.

eSIM recommendations

Not all travel eSIMs work inside mainland China. Many route through Hong Kong towers even when you're physically in Shenzhen or Shanghai, which means poor signal or no data at all in buildings and metros. The ones that actually connect to mainland Chinese networks:

  • Airalo — China Unicom plan: The most widely used option among our participants. Buy through the Airalo app before departure, install the eSIM to your phone, and activate it when you land. Runs on China Unicom's network, which has solid coverage across all three cities. Pricing runs around $15–$20 for 10GB over 30 days.
  • China Unicom International eSIM: Available directly from China Unicom's international site. Slightly more setup friction but reliable. Good if you want to buy more data upfront.
  • Avoid generic "Asia" eSIM bundles that don't specify the underlying Chinese carrier. Most route around the mainland network and give you frustrating coverage.

Make sure your phone supports eSIM before buying — most iPhones from XS onward and recent Android flagships do. Install the eSIM before you leave; some providers block installation from Chinese IP addresses.

VPN recommendations

The VPN landscape in China shifts constantly. Services that worked fine a year ago sometimes stop working with no warning. Based on what's worked reliably for our groups:

  • ExpressVPN: Consistently the most reliable in our experience. Has China-specific obfuscation built in ("Lightway" protocol). Expensive at ~$10/month, but it works when cheaper options don't.
  • Astrill: Slightly more technical to configure but extremely reliable. Popular with expats in China for a reason. The StealthVPN protocol is specifically designed to avoid Chinese detection.
  • Mullvad and NordVPN: Work some of the time, but less consistently than the two above. Fine as a backup, not as a primary.

Free VPNs do not work reliably in China. Don't rely on one for a trip like this.

The setup order matters

This is the mistake most people make: they land, connect to Chinese Wi-Fi or their new eSIM, and then try to download or set up a VPN. You can't — the VPN provider's website is likely blocked from inside China, and app stores may not surface the app correctly.

Do everything before you board your flight:

  1. Subscribe to your VPN and install the app.
  2. Open the app and connect at least once from home to confirm it works.
  3. Download the eSIM profile and install it (keep it inactive until you land).
  4. On the plane or in Hong Kong (before crossing to mainland), activate the eSIM and connect the VPN.

Day-to-day use

Keep the VPN running in the background. Some apps (WeChat, Alipay, Chinese maps) actually work better with the VPN off — toggle it off for those and back on for everything else. ExpressVPN and Astrill both have quick-toggle widgets for your home screen that make this easy.

Hotel Wi-Fi in China is usable but slow, and the VPN adds latency. For video calls, switch to your eSIM data instead — it's faster for most use cases.