VPN Comparison
Compare providers on ownership, jurisdiction, logging, audits, technical safeguards, and payment privacy.
Compare 56 VPN providers side by side on the details that actually decide how private a service is: jurisdiction, logging, independent audits, encryption and protocols, and the account and payment fine print. Every entry is independently researched by Reclaim The Net against primary sources.
Looking for our picks? See the VPNs we recommend.
Tip: click any column heading to sort.
VPNs
Details
| Company & trust | Logging & audits | Encryption & protocols | Infrastructure | Leak protection & security | Network features | Account & payment | Apps | Pricing | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Legal jurisdiction | Outside 14 Eyes | Transparency report | Warrant canary | Court-tested | What it logs | No-logs audit | Security audits | Protocols | Data encryption | Handshake encryption | Open-source clients | RAM-only servers | Server ownership | Servers | Countries | Kill switch | Leak protection | First-party DNS | Custom DNS | Two-factor auth | Multi-hop | Obfuscation | Split tunneling | Port forwarding | P2P policy | Router support | Ad / tracker blocking | Streaming | Speed | Signup details | Account model | Anonymous payment | Simultaneous devices | Windows | macOS | Linux | Android | F-Droid | iOS | From | |
 AdGuard VPN | Cyprus (AdGuard Software Limited, Limassol); EU, subject to GDPR; outside 5/9/14 Eyes; no mandatory VPN data-retention law | ✓ | – | – | – | Policy states no activity or connection/session logs; retains account email and aggregate traffic volume used to enforce free-tier limits and manage subscriptions | ✗ | ✗ | AdGuard VPN protocol / TrustTunnel (custom; runs over HTTP/2 and HTTP/3 (QUIC)) | AES-256 | TLS (HTTPS) | ✗ | – | – | 800+ | 60+ | App-level | DNS / IPv6 / WebRTC | ✓ | ✓ | ✓ | ✗ | Native; custom protocol disguises traffic as ordinary HTTPS over HTTP/2, designed to resist deep-packet inspection and blocking | ✓ | – | Supported on paid plan; no dedicated P2P servers | – | Not built into the VPN app; separate AdGuard product; VPN DNS can apply filtering | ✓ | – | Email (or Google/Apple/Facebook sign-in) | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | – | ✓ | $2.99/month (2-year plan) |
 AirVPN | Italy: EU/GDPR; no mandatory VPN data-retention law, but Italy is within the 14 Eyes | ✗ | ✗ | ✗ | ✗ | No activity, traffic content, or IP logs; connection data handled only in RAM for the time needed to provide the service | No | No | WireGuard, OpenVPN | AES-256-GCM / ChaCha20 | RSA-4096 / Curve25519 (ECDH), PFS re-keyed every 60 min | ✓ | – | Rented | ~255 | ~23 | System-level | DNS, IPv6 | ✓ | ✓ | – | ✗ | Yes: OpenVPN over SSL or SSH tunnel | ✓ | Yes: up to 5 remote ports | Allowed on all servers | ✓ | Yes: DNS block lists (ads, trackers, malware) | Partial: not streaming-focused; inconsistent for Netflix and similar | Fast on WireGuard; weaker upload speeds | Username/password; real email address not required, no personal data forced | Username account (email optional, no personal data required) | ✓ | 5 | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ~€2.75/mo (3-yr plan, €99) |
 Amnezia VPN | Romania (EU): registered 2026; no mandatory VPN data-retention law. Project origins with Russian anti-censorship activists (Roskomsvoboda/OTF-funded) | ✓ | ✗ | ✗ | ✗ | No activity or connection logs; email kept for Premium accounts, Telegram ID for Free; temporary IP logging only during abuse/DDoS investigations | No | Yes: 7ASecurity, 2022, 2024 and 2025 (white-box pentests of mobile/desktop apps and infrastructure; findings remediated) | WireGuard, OpenVPN, IKEv2, proprietary/other | AES-256 / ChaCha20 | Curve25519 (WireGuard/AmneziaWG); RSA for OpenVPN | ✓ | ✓ | – | – | ~20 (Premium) | App-level | DNS | ✓ | ✓ | – | – | Yes: core focus: AmneziaWG, XRay VLESS Reality, Cloak, Shadowsocks | Yes: per-app and per-site (platform-dependent) | – | Yes: Premium, Switzerland location only | – | – | Yes: Premium unblocks Netflix, YouTube, etc. | Fast (up to ~200 Mbps on Premium) | Email (Premium); Telegram ID (Free); none for self-hosted | Email-tied account (Premium) | ✓ | 7 (Premium) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$4.00/mo (annual, $48/yr); self-hosted client and basic Free tier are $0 |
 AstrillVPN | Liechtenstein (Veloxee Corp., Vaduz); relocated from Seychelles around 2021; no mandatory data-retention law, but policy retains some connection metadata | ✓ | ✗ | ✗ | – | Retains last 20 connection records per account (connection time, duration, country, device type, client version); session IP/device/version tracked while connected and deleted on disconnect; per-account bandwidth totals counted | ✗ | ✗ | WireGuard, OpenVPN, OpenWeb, StealthVPN | AES-256 | – | ✗ | ✓ | – | 300+ | 57 to 58 | App-level (App Guard); desktop only | DNS / WebRTC | – | – | – | ✓ | StealthVPN / OpenWeb | ✓ | ✓ | ✓ | ✓ | – | Partial; some servers work with Netflix | – | Email-tied account | ✓ | 5 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | $12.50/month (2-year plan) | |
 Avast SecureLine VPN | Czech Republic (Prague); parent Gen Digital is US-based; EU member with no VPN-specific mandatory retention law | ✗ | ✓ | ✗ | – | Retains connection metadata: bandwidth (18 mo), connection events (12 mo), app events (18 mo), device context; states it does not log source IP, DNS queries or content. Parent Avast previously sold browsing data via Jumpshot (FTC US$16.5M order, 2024) | ✗ | – | WireGuard, OpenVPN, IKEv2/IPsec, Mimic | AES-256 / ChaCha20 (WireGuard) | – | ✗ | ✗ | – | ~700 | ~34 | App-level (desktop; off by default) | DNS / IPv6 | ✓ | ✗ | – | ✗ | Mimic | ✓ | ✗ | Allowed on P2P-optimized servers (select locations) | ✗ | ✗ | Partial (dedicated servers; inconsistent results) | – | Email-tied account | ✗ | 10 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$4.39/mo (3-yr plan, first term) | |
 AVG Secure VPN | Czech Republic (Brno); parent Gen Digital is US-based; runs on the same SecureLine backend as Avast SecureLine | ✗ | ✓ | ✗ | – | Retains connection metadata (timestamps, source IP subnet, server IP, bandwidth); connection events ~12 mo, app events ~18 mo; no browsing logs. Shared policy with Avast; parent involved in Jumpshot data-selling (FTC order, 2024) | ✗ | – | WireGuard, OpenVPN, IKEv2/IPsec, Mimic | AES-256 / ChaCha20 (WireGuard) | – | ✗ | ✗ | – | ~700 | ~37 | App-level (desktop; off by default) | DNS / IPv6 | ✓ | ✗ | – | ✗ | Mimic | ✓ | ✗ | Allowed on 8 P2P-optimized servers | ✗ | ✗ | Partial (some Netflix libraries; fails on Disney+, iPlayer, Prime) | – | Email-tied account | ✗ | 10 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$4.39/mo (2 to 3-yr plan, first term) | |
 AzireVPN | Sweden (operated by Netbouncer AB; owned by Malwarebytes, USA since 2024): no VPN-specific data-retention law in Sweden | ✗ | ✓ | ✓ | 2023 transparency report: 2 valid legal requests received, 0 bytes of user data provided (no seizure documented) | No activity or connection logs (no traffic, IP, DNS or timestamp logs) | Partial: X41 D-Sec (Dec 2025–Jan 2026) security audit reported no evidence of user activity logging; not a dedicated no-logs audit | Yes: X41 D-Sec, 2025–2026 (white-box software + hardware pen test) | WireGuard, OpenVPN | AES-256 / ChaCha20 | Curve25519 (WireGuard) | – | ✓ | Owned | ~153 servers / 62 locations | – | System-level and app-level (always-on) | DNS, IPv6 | ✓ | – | – | ✗ | ✗ | Android only | ✓ | Allowed on all servers | ✓ | ✗ | Limited: works with some services (Netflix, Prime, Disney+) but not guaranteed | Fast | Username/password; email optional (not required) | Anonymous account (email optional) | ✗ | 5 | ✓ | ✓ | ✓ | ✓ | – | ✓ | ~€3.75/mo (12-month plan, €45/yr) |
 Betternet | United States (Boston, MA): Five Eyes member; no VPN data-retention law but subject to subpoenas and National Security Letters | ✗ | ✗ | ✗ | – | Claims no activity logs; privacy policy admits collecting device IP (encrypted, session-only), device/mobile advertising identifiers, OS, ISP and connection timestamps; free tier is ad-supported and serves ads via third-party ad networks | Pango privacy-policy review report (published 2024; earlier 2023 version); a policy review, not a full no-logs infrastructure audit | ✗ | Catapult Hydra (proprietary), WireGuard, IKEv2/IPSec | AES-256 (WireGuard/IKEv2); AES-128 (Hydra) | RSA-2048 DHE (Hydra); Curve25519 (WireGuard) | ✗ | – | Mixed | 1,000+ | ~115 (many virtual locations) | App-level | DNS / WebRTC | – | – | – | ✗ | Catapult Hydra masks traffic (proprietary) | ✓ | ✗ | Restricted; conflicting reports (premium servers only per some reviews) | ✗ | ✗ | ✓ | – | Email account required; free tier needs an account but no payment | Email-tied account | ✗ | 10 (premium); 1 (free) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | Free tier (500MB/day); paid from ~US$7.99/mo (annual plan) |
 Bitdefender VPN | Romania: outside 14 Eyes, no mandatory VPN data-retention (retention law struck down as unconstitutional); note VPN backend/data processor is US-based Aura (formerly Pango) | ✓ | – | – | – | States no activity logs, no connection timestamps, no stored IP; runs on third-party Aura/Pango (Hotspot Shield) infrastructure as data processor; retains account email + minimal session data | Claimed 2025 independent audit of the infrastructure; auditor undisclosed and no public report | – | WireGuard, OpenVPN, IKEv2 | AES-256 (OpenVPN/IKEv2) / ChaCha20 (WireGuard) | Curve25519 (WireGuard) | ✗ | – | Rented | ~3,000+ | ~100 | App-level | DNS | – | – | ✓ | Double Hop | – | ✓ | – | Allowed | ✗ | Ad blocker (WireGuard-based clients) | Partial: Netflix US, BBC iPlayer | – | Email (Bitdefender Central account) | Email-tied account | ✗ | 10 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$2.92/mo (1-yr plan, first year) |
 BolehVPN | Malaysia-based; Seychelles governing law per ToS; no mandatory VPN data-retention regime | ✓ | – | ✓ | – | No-logs claimed; policy reserves the right to temporarily enable logging to identify service abuse (DoS, spam, or specific complaints); keeps anonymized aggregate server-use data | ✗ | ✗ | OpenVPN, L2TP/IPsec | AES-256 | RSA-4096 / DHE-4096 | ✗ | – | – | ~35 (as of 2025) | ~12 (as of 2025) | App-level (desktop only) | DNS / IPv6 / WebRTC | – | – | – | – | Cloak (xCloak) servers | ✗ | ✓ | Yes; on P2P/fully-routed servers | ✓ | ✗ | Partial | Slow | Email-tied account | ✓ | 3 | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | $6.66/mo on the annual plan (as of 2025) | |
 Brave VPN | United States; VPN backend operated by Guardian (Sudo Security Group, a US company owned by DNSFilter), Brave is US-based; no mandatory VPN data-retention law but subject to US subpoenas, NSLs and gag orders (Five Eyes) | ✗ | ✓ | – | – | Brave VPN is a resold/rebranded front end for Guardian's VPN infrastructure; stated no-logs (no traffic, DNS, connection data, IP or bandwidth logging); journald on production nodes set to non-persistent; Brave itself sees only signup email and payment method, and uses unlinkable purchase tokens so it cannot tell when the VPN is used | Yes: Assured (Sweden), 2024 | Yes: Assured; software audit Feb 2024, infrastructure audit Apr 2024 | WireGuard, IKEv2/IPsec | WireGuard: ChaCha20; IKEv2/IPsec: AES-256 | WireGuard: Curve25519 | ✗ | ✗ | – | 300+ | 40+ countries/regions | App-level | DNS leak protection | – | – | – | – | – | – | – | – | – | Tracker blocking (Guardian firewall) | – | – | Email address; payment method; billing address (desktop) | Email-tied account (unlinkable purchase token) | ✗ | 10 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | $99.99/year |
 Bytz VPN | United States (Marina del Rey, California; founder Rob Braxman): 5 Eyes member, no mandatory VPN data-retention law | ✗ | – | – | – | States no logging and no record of user IP addresses; servers configured with no storage allocated to keep logs; optional BytzTOR routes traffic through Tor | – | – | – | – | – | – | ✗ | – | – | – | – | – | ✓ | – | – | – | Anti-DPI stealth mode (obscures VPN use, aims to bypass VPN blocks) | – | – | – | – | Pi-hole DNS ad and tracker blocking | – | – | No KYC required | – | ✓ | 6 | ✓ | ✓ | ✓ | ✓ | – | ✓ | US$89/yr (VPN + BytzTOR bundle) |
 CactusVPN | Canada: 5 Eyes member; relocated from Moldova in 2016; Canada has no mandatory data-retention law but shares intelligence | ✗ | ✗ | ✗ | – | Claims no activity, IP, timestamp, bandwidth or DNS logs; retains account email and billing details, stated as not linked to VPN usage | ✗ | ✗ | OpenVPN, WireGuard, IKEv2/IPSec, SoftEther, SSTP, L2TP/IPSec, PPTP | AES-256 | 2048-bit DHE-RSA; SHA-256 auth | ✗ | – | Rented | ~35 | ~22 | App-level | DNS / WebRTC | – | – | ✗ | ✗ | Obfsproxy | ✓ | – | Dedicated P2P servers | ✓ | – | Smart DNS (340+ sites) | – | Email-tied account | ✓ | Unlimited | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | $3.96/mo (2-year plan) | |
 cryptostorm | Iceland roots and decentralized with no central HQ, but the operating entity Baneki Privacy Computing Inc. is Canada-based, and Canada is a Five Eyes member; no forced data-retention | ✗ | ✗ | ✗ | ✗ | No logs that can identify a customer: no connection times, source IP, or destination; minimal operational/security logs only | No | No | WireGuard, OpenVPN | AES-256-GCM / ChaCha20-Poly1305 | RSA-8192 / Curve25519 / ECC (Ed25519, secp521r1); ML-DSA-87 post-quantum option | – | ✗ | Rented | ~28-30 | ~16-17 | App-level | DNS / WebRTC | ✓ | – | ✗ | ✓ | HTTPS, SSH, obfs4 | ✓ | ✓ | Allowed (BitTorrent/P2P explicitly permitted) | ✓ | TrackerSmacker (opt-in DNS ad/tracker blocker) | Limited (Netflix reachable but slow) | Slow to average | None: anonymous access token (no email required for crypto payment) | Anonymous account number | ✓ | 1-6 (varies by plan) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$3.92/mo (2-yr, $94); lifetime $500 |
 CyberGhost | Romania; no mandatory data-retention law (struck down by its Constitutional Court in 2009 and 2014). Owned by Kape Technologies, which also owns ExpressVPN, PIA and several VPN review sites; Kape was taken private by Teddy Sagi's Unikmind in 2023 | ✓ | ✓ | ✗ | – | No-logs; states it does not store source IP, assigned VPN IP, browsing history, DNS queries, timestamps, session data, or bandwidth | Yes: Deloitte Romania, 2025 (3rd audit, ISAE 3000; prior audits 2022 and 2024) | – | WireGuard, OpenVPN, IKEv2/IPsec | AES-256 (OpenVPN/IKEv2); ChaCha20-Poly1305 (WireGuard) | Curve25519 (WireGuard); RSA-4096 (OpenVPN) | ✗ | ✓ | Mixed (NoSpy servers owned in Romania; rest rented; portion virtual) | ~9,900 (as of 2026) | ~100 | System-level | DNS and IPv6 leak protection | ✓ | – | – | ✗ | ✗ | ✓ | ✗ | Yes; dedicated P2P/torrent-optimized servers | ✓ | Yes; Content Blocker (DNS-based, on/off only) | Yes; dedicated streaming-optimized servers | – | Email address required at signup | Email-tied account | ✓ | 7 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~$2.03 to $2.19/month on 2-year plan (as of 2026) |
 ExpressVPN | British Virgin Islands; no mandatory data-retention or compelled-logging laws for VPN providers. Owned by Kape Technologies, which also owns CyberGhost, PIA and several VPN review sites; Kape was taken private by Teddy Sagi's Unikmind in 2023 | ✓ | ✓ | ✗ | 2017 Turkey: server seized in Andrey Karlov assassination probe; no logs recovered, confirming no-logs design | No activity or connection logs; no IP address, browsing history, traffic destination, or DNS queries stored | Yes: KPMG, 2025 (prior audits 2023, 2022) | Yes: Cure53, 2024 (Lightway Rust rewrite); many audits 2018 to 2026 | Lightway, OpenVPN, IKEv2 | AES-256-GCM / ChaCha20-Poly1305 | RSA-4096 (OpenVPN); TLS 1.3 via wolfSSL (Lightway) | ✗ | ✓ | Rented | 3,000+ (exact count undisclosed) | ~105 | App-level (Network Lock) | DNS, IPv6, and WebRTC leak protection | ✓ | – | – | ✗ | Yes: automatic obfuscation built into Lightway/protocols | ✓ | ✗ | Yes: all servers | ✓ | Yes: Threat Manager / Ad Blocker (device-side DNS-based) | ✓ | Fast | Email address required | Email-tied account | ✓ | 10 (Basic); up to 14 (Pro) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | From ~$2.49/mo on 2-year Basic plan (as of 2026) |
 FastestVPN | Cayman Islands: outside 5/9/14 Eyes, no mandatory data-retention law | ✓ | ✗ | ✗ | – | Claims no browsing logs; retains email, payment info, connection duration and bandwidth usage | Yes: Altius IT, 2023 | ✗ | WireGuard, OpenVPN, IKEv2/IPSec | AES-256 / ChaCha20 | – | ✗ | ✗ | – | ~800 | ~48 | App-level | DNS / WebRTC; Windows DNS and IPv6 leaks reported in testing | ✓ | – | ✗ | Limited: a few Double VPN servers | ✗ | ✓ | – | ✓ | ✓ | ✓ | ✓ | – | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$0.83/mo (2-yr plan); lifetime ~US$40 one-time | |
 hide.me | Malaysia: no mandatory VPN/data-retention law | ✓ | ✓ | – | ✗ | No activity or connection logs (no originating IP, timestamps, assigned server IP, DNS queries or browsing history) | Yes: Securitum, 2024 | Yes: DefenseCode (2015); App Defense Alliance MASA | WireGuard, OpenVPN, IKEv2, proprietary/other | AES-256 / ChaCha20 | RSA-4096 / Curve25519 | ✗ | ✓ | – | ~2,600 | ~91 | System-level | DNS / IPv6 / WebRTC | ✓ | – | – | ✓ | ✓ | ✓ | Dynamic only (UPnP/NAT-PMP) | Allowed on all servers | ✓ | Yes (SmartGuard) | ✓ | Fast | Email (removable after registration) | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$2.69/mo (2-yr) |
 HideMyAss | United Kingdom (5 Eyes); owned by Gen Digital via its Avast subsidiary; subject to UK Investigatory Powers Act data-retention regime | ✗ | ✗ | ✓ | 2011: under a UK court order HMA handed over connection logs that helped identify LulzSec member Cody Kretsinger over the Sony Pictures hack; he was arrested and later convicted | No-log policy since May 2020: states it does not log originating IP, DNS queries, browsing activity, bandwidth used, or VPN connection timestamps; limited aggregate diagnostic data may be retained | Yes: VerSprite, 2020 | – | WireGuard, OpenVPN, IKEv2, Mimic | AES-256-GCM; ChaCha20 (WireGuard) | RSA-4096; SHA-256 | ✗ | ✗ | – | ~3,400 | ~65 countries; ~100 locations | System-level and app-level | DNS / IPv6 / WebRTC | – | – | – | ✗ | Mimic | ✓ | ✗ | Dedicated servers | – | ✗ | ✓ | – | Email-tied account | ✗ | 5 (10 on Family plan) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | $2.99/mo | |
 Hola VPN | Israel (Hola VPN Ltd.); outside the 14 Eyes but a known intelligence-sharing partner; retains logs up to 12 months and shares with law enforcement and affiliates | ✓ | – | – | – | Not a no-logs service; logs IP address, browsing history, access times and dates, OS, browser type, and installed apps; retained up to 12 months (longer if required); discloses to law enforcement on subpoena/court order and to affiliated companies | ✗ | ✗ | IKEv2/IPSec, PPTP, L2TP | AES-256 on Windows IKEv2 (128/192/256 options); PPTP fallback on mobile/macOS provides no real encryption; core service is a peer-to-peer proxy routing traffic through other users' devices, not dedicated servers | – | ✗ | – | – | – | – | App-level (Windows only; absent on macOS and iOS) | – | – | – | – | ✗ | ✗ | ✓ | – | Core architecture; free users' devices act as exit nodes and traffic routes through other users' connections | ✓ | ✗ | ✓ | – | – | Email-tied account | ✗ | 10 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | $2.99/month (3-year plan) |
 Hotspot Shield | United States: Five Eyes member; no mandatory VPN data-retention law but subject to subpoenas and National Security Letters | ✗ | ✗ | ✗ | 2017 CDT complaint to the FTC alleged the free app engaged in undisclosed data sharing, traffic interception and redirection to advertising partners, and JavaScript/ad injection, contradicting its privacy claims; no known FTC enforcement action or settlement resulted | States no browsing-activity logs; acknowledges collecting connection timestamps, bandwidth used, device identifiers and anonymized domains for service operation; retains account email and payment info | Yes: Aon, 2023 (no-logs policy review; excluded penetration testing and full security review) | Limited: Hydra protocol tested by AV-TEST; no published independent audit of apps or infrastructure | Catapult Hydra, WireGuard, IKEv2 | AES-256 (Hydra, IKEv2); ChaCha20 (WireGuard) | Curve25519 (WireGuard) | ✗ | ✗ | Mixed | ~1,800 (company also cites 500+; many virtual locations) | 80+ | App-level | DNS / WebRTC | ✓ | – | – | ✗ | Built into Catapult Hydra protocol | ✓ | ✗ | Allowed on premium servers | ✓ | Ad, tracker, cookie and malware blocking via browser extensions | ✓ | – | Email-tied account | ✗ | 10 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$2.99/mo (1-yr plan) | |
 ibVPN | Romania (Amplusnet SRL); no mandatory communications data-retention law: the Constitutional Court struck down the EU Data Retention Directive transposition twice (2009 and 2014) | ✓ | – | – | – | Claims no traffic, connection, or usage logs; retains only account email and password | ✗ | ✗ | OpenVPN (UDP/TCP), IKEv2, L2TP/IPsec, SSTP, PPTP, SoftEther, Shadowsocks, Stealth VPN | AES-256 | RSA-2048 | ✗ | – | – | ~180 (as of 2025) | ~50 | App-level | DNS / WebRTC | – | – | – | Yes (Double VPN) | Stealth VPN (Windows/Android) | ✓ | ✓ | Yes; dedicated P2P servers (Torrent/Ultimate plans) | ✓ | ✗ | ✗ | – | Email-tied account | ✓ | Up to 5 | ✓ | ✓ | ✓ | ✓ | – | ✓ | $3.08/mo (Standard, annual; as of 2026) | |
 IPVanish | United States: Five Eyes member; no mandatory VPN data-retention law but subject to subpoenas, NSLs and gag orders | ✗ | ✓ | – | 2016: under then-owner Highwinds/Mudhook, handed connection logs (source IP, connect/disconnect times) to US Homeland Security in an IRC child-exploitation case despite a no-logs claim; disclosed 2018 via TorrentFreak | Current policy: no traffic, DNS, metadata or connection logs; retains account email + payment info. Past: 2016 incident (pre-StackPath) contradicted the no-logs claim; company says logging systems were removed after 2017 acquisition | Yes: Leviathan, 2022; Schellman, 2025 | – | WireGuard, OpenVPN, IKEv2 | AES-256-GCM / ChaCha20 | Curve25519 (WireGuard); RSA-2048 (OpenVPN) | ✗ | ✗ | Owned | ~3,200+ (as of 2026) | ~110 | App-level | DNS / IPv6 | ✓ | – | – | ✗ | Scramble (OpenVPN XOR over port 443) | ✓ | ✗ | Allowed on all servers | ✓ | Threat Protection (malware & tracker blocking) | ✓ | – | Email-tied account | ✗ | Unlimited | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$2.19/mo (2-yr Essential plan) | |
 IVPN | Gibraltar: no mandatory data-retention / no VPN logging law | ✓ | ✓ | ✓ | ✗ | No activity or connection logs (no IP, no traffic, no timestamps tied to accounts) | Yes: Cure53, 2019 | Yes: Cure53 (annual; 6th audit concluded 2024, 7th in 2025) | WireGuard, OpenVPN, IKEv2 | AES-256-GCM / ChaCha20 | Curve25519 (WireGuard) / RSA-4096 (OpenVPN) | ✓ | ✗ | Rented | ~56 locations | ~40 | System-level | DNS, IPv6 | ✓ | ✓ | ✓ | Yes (all plans) | Yes (V2Ray / VMess over QUIC or TCP) | ✓ | ✗ | Allowed on all servers except US locations | ✓ | Yes (AntiTracker: blocks ads/trackers/malware domains) | ✗ | Fast | None: anonymous account ID generated, no email required | Anonymous account number | ✓ | 5 (Standard/Plus) / 10 (Pro Suite) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~US$5/mo (Standard, annual) |
 Kaspersky VPN | Russia: no VPN-friendly no-retention regime; subject to Russian data-localisation and SORM lawful-intercept regime. Banned in the US: the Commerce Dept (BIS) prohibited Kaspersky from selling products/services or issuing updates to US persons (sales stopped 20 Jul 2024; updates barred from 29/30 Sep 2024), and Kaspersky withdrew from the US market | ✓ | ✗ | ✗ | – | Claims no activity logs, but historically operated under the third-party backend's privacy policy and its own policy collects device data, network info, subscription and account details; states it will disclose data to authorities on terms violations | ✗ | Aon Cyber Solutions 'trust audit' of the legacy Catapult Hydra / Pango backend (announced 2023); SOC 2 (2019). No audit published for the current PureVPN-based infrastructure | WireGuard | ChaCha20 (WireGuard); legacy builds used AES-256 with Catapult Hydra / OpenVPN | Curve25519 (WireGuard) | ✗ | – | Rented | ~2,000 | ~90 (source figures vary 49 to 110 amid backend migration) | App-level | DNS / WebRTC | – | – | – | ✗ | ✗ | ✓ | – | Allowed | ✗ | – | Partial; Netflix inconsistent | – | Email (My Kaspersky account) | Email-tied account | ✗ | 5 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$2.71/mo (2-yr plan); not sold in the US due to the federal ban |
 Le VPN | Hong Kong (VTNV Solutions Limited); founded in France in 2010, HQ moved to Hong Kong in 2012 to sit outside data-retention laws; Hong Kong has no mandatory data-retention law, but Le VPN's own policy retains connection data | ✓ | ✗ | ✗ | – | Reviews find the policy retains the user's real IP address, connection timestamps, assigned VPN server IP, and bandwidth/data usage; claims not to log sites visited; reported retention up to about 5 years; markets itself as 'no-logs' but that claim is contested by reviewers (as of 2026) | ✗ | ✗ | OpenVPN, WireGuard, L2TP/IPsec, PPTP | AES-256 (OpenVPN); ChaCha20 (WireGuard) | – | ✗ | – | Rented | ~700+ (as of 2026) | ~100 | App-level | DNS / IP / WebRTC | ✓ | – | – | ✗ | ✗ | ✗ | – | Yes; dedicated P2P servers | ✓ | ✗ | Partial; Netflix, BBC iPlayer, Prime Video, Max work; Hulu and Disney+ fail (as of 2026) | – | Email-tied account | ✓ | 5 | ✓ | ✓ | – | ✓ | ✗ | ✓ | $2.22/month on 3-year plan (as of 2026) | |
 Librem Tunnel | United States (Purism SPC, San Francisco, California): 5 Eyes member; service runs on Private Internet Access infrastructure | ✗ | – | – | Underlying PIA no-logs policy has held up in US court cases (2016, 2018); Librem Tunnel itself not separately tested | No traffic logging per Purism policy; built on Private Internet Access (PIA) infrastructure, which operates a no-logs policy | – | – | OpenVPN | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | – | Email (Librem One account) | Email-tied account | – | – | – | – | – | ✓ | ✓ | ✗ | ~US$5.99/mo (US$71.91/yr Librem One Complete bundle: Mail, Chat, Social, Tunnel) |
 Malwarebytes VPN | United States: no mandatory data-retention law, but a Five/9/14 Eyes member; can be compelled via subpoena | ✗ | – | ✗ | ✗ | No activity or connection logs: states it does not track, log or store user activity; retains only aggregate bandwidth and account public key | Yes: X41 D-Sec, 2025–2026 white-box audit found no evidence of activity logging (as part of a security audit) | Yes: X41 D-Sec, 2025–2026 (shared AzireVPN/Malwarebytes infrastructure; 2 critical, 8 medium, 4 low findings, remediation ongoing) | WireGuard | ChaCha20-Poly1305 (256-bit) | Curve25519 (WireGuard) | ✗ | ✓ | Owned | ~150+ | ~45 countries (~60 locations) | App-level (Windows & macOS) | DNS, IPv6 (native IPv6 support) | – | – | ✓ | Desktop only (Windows and macOS); not on mobile | ✗ | ✓ | ✗ | Allowed: torrenting works on standard servers | ✗ | ✗ | Partial: Netflix unblocks in some regions (US/UK/CA/AU), inconsistent | Fast (WireGuard, mostly 10G servers) | Email-tied account | ✗ | Up to 20 (plan-dependent; entry plans 1 or 5) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$3.33/mo (1-device annual, $39.99/yr); ~US$5.00/mo for 5 devices ($59.99/yr) | |
 McAfee VPN | USA: McAfee Corp (San Jose, California); Five Eyes member, no mandatory data-retention law | ✗ | ✗ | ✗ | – | Not a strict no-logs VPN; privacy policy permits collecting account details, connection timestamps, IP addresses and telemetry | ✗ | ✗ | WireGuard, OpenVPN | WireGuard: ChaCha20; OpenVPN: AES-256 | – | ✗ | ✗ | – | – | ~48 | App-level (Windows, Android only) | DNS / WebRTC | – | ✗ | – | ✗ | ✗ | ✓ | ✗ | Allowed on all servers | ✗ | ✗ | ✗ | – | Email (McAfee account) | Email-tied account | ✗ | 5 (Unlimited on Premium / Advanced tiers) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$29.99 first year (bundled in McAfee Total Protection) |
 Mozilla VPN | United States (Mozilla Corporation): no mandatory VPN data-retention law | ✗ | ✗ | ✗ | ✗ | No logging of network traffic/activity; collects limited technical/reliability telemetry | No | Yes: Cure53, 2020, 2021 & 2023 | WireGuard | ChaCha20 (WireGuard) | Curve25519 | ✓ | ✓ | Rented | 500+ | 30+ | System-level | DNS, WebRTC | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | Allowed | ✗ | Ads, trackers & malware blocking | ✗ | Fast | Email (Mozilla account) | Email-tied account | ✗ | 5 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$4.99/mo (annual) |
 Mullvad | Sweden: no mandatory data-retention law for VPN providers | ✗ | ✗ | ✗ | April 2023 Swedish police raid on Gothenburg office; police left with no customer data as none existed | No activity, traffic, DNS, IP, bandwidth or connection-timestamp logs | Yes: Cure53 infrastructure/anonymity audit, 2024 (no data-retention issues found) | Yes: X41 D-Sec app pentest (2024) and Assured web-app pentest (2025); prior Cure53/Assured audits | WireGuard | ChaCha20-Poly1305 (WireGuard) | Curve25519 (WireGuard) | ✓ | ✓ | Mix | ~567 | ~50 | System-level | DNS / IPv6 / WebRTC | ✓ | ✓ | ✗ | ✓ | Yes: Shadowsocks and UDP-over-TCP (plus DAITA) | ✓ | ✗ | Allowed on all servers | ✓ | Yes: DNS-level content blocking (ads, trackers, malware, etc.) | Limited: not optimized for streaming | Fast | None: random account number generated | Anonymous account number | ✓ | 5 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | €5/mo (~US$5.50) flat, no long-term discount |
 Namecheap VPN | United States: Five Eyes member; backend runs on the US-operated WLVPN white-label network; no mandatory VPN data-retention law | ✗ | ✗ | ✗ | – | White-label FastVPN on the WLVPN network; claims no activity logs; retains basic connection logs plus device/OS telemetry linked to a user ID | ✗ | ✗ | WireGuard, OpenVPN, IKEv2 | AES-256 | – | ✗ | – | Rented | ~1,000 | ~50 | App-level | DNS / WebRTC | – | – | – | ✗ | ✗ | ✓ | – | ✓ | ✓ | – | Partial: some Netflix regions, Prime Video, Disney+; blocked by Hulu | Moderate | Namecheap account (email) | Email-tied account | ✓ | Unlimited | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$1/mo (1-yr promo) |
 NordVPN | Panama: no mandatory data-retention law | ✓ | ✓ | ✗ | Oct 2024 binding Panamanian prosecutor warrant; provided account/payment data but no traffic or connection logs (says none kept) | No activity or connection logs (RAM-only servers) | Yes: Deloitte, 2025 (6th assurance engagement) | Yes: Cure53, 2025 (apps + infrastructure; earlier VerSprite 2021) | WireGuard, OpenVPN, proprietary/other | AES-256 / ChaCha20 (NordLynx) | Curve25519 (NordLynx) / RSA-4096 (OpenVPN) | ✗ | ✓ | Rented | ~8,400 | ~149 | System-level | DNS, IPv6, WebRTC (browser extension) | ✓ | ✓ | ✓ | Double VPN | ✓ | ✓ | ✗ | Yes: dedicated P2P servers | ✓ | Yes: Threat Protection | ✓ | Fast (NordLynx/WireGuard) | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$3.49/mo (2-yr Basic) | |
 Norton VPN | USA: Gen Digital (Arizona); no mandatory data-retention law, but Five Eyes member and subject to subpoenas / NSLs | ✗ | ✓ | ✗ | – | No-logs policy; no browsing history, DNS requests, IP addresses or connection timestamps; retains minimal operational metadata (device name/type, aggregate bandwidth) | Yes: VerSprite, 2025 (Technical Privacy Impact Assessment) | Yes: VerSprite, 2025 (Mimic protocol) | WireGuard, OpenVPN, IKEv2/IPsec, Mimic | AES-256 / ChaCha20 (WireGuard) | – | ✗ | ✗ | – | ~2,000 | 90+ | App-level (Windows, macOS, Android; not iOS) | DNS | ✓ | ✗ | ✓ | Double VPN (~8 server pairs) | Mimic | ✓ | ✗ | Allowed on P2P-optimized servers | ✗ | Ad Tracker Blocking (in-app) plus Ad Blocker browser extension | ✓ | – | Email, name and payment info | Email-tied account | ✗ | 5 to 10 (by plan) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$39.99/yr first year (Standard, standalone; renews ~$79.99/yr) |
 NymVPN | Switzerland (Nym Technologies SA, Neuchatel): no mandatory VPN data-retention law | ✓ | – | – | ✗ | No logs by architecture: decentralized zero-knowledge mixnet; does not store browsing history, IP addresses, destinations or traffic content | No: no independent no-logs policy audit published (no-logs is claimed by architecture) | Yes: Cure53 (2024); also Oak Security (2023), JP Aumasson (2021), Cryspen (2023-24) | WireGuard, proprietary/other | ChaCha20-Poly1305 (AmneziaWG/WireGuard); Sphinx-layered encryption in mixnet mode | Curve25519 (WireGuard) | ✓ | – | Decentralized: independently operated nodes (not company-owned) | ~600+ nodes | ~70+ | System-level | DNS / IPv6 / WebRTC | – | – | ✗ | Yes: 2-hop Fast Mode and 5-hop mixnet (Anonymous Mode) | Yes: mixnet cover traffic, AmneziaWG, and QUIC 'enhanced connection' mode (Nov 2025) | Yes (Android; desktop being rolled out) | ✗ | Allowed (slower via mixnet) | – | Yes (desktop, added 2026) | Partial: unblocks Netflix and Amazon Prime but inconsistent | Fast Mode fast; 5-hop mixnet significantly slower | None: anonymous 24-word secret passphrase, no email | Anonymous account number | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~US$2.40/mo (2-yr; EUR 2.19/mo on nym.com/pricing); extra discount paying with NYM token or crypto (BTC/ETH/Monero) |
 Obscura VPN | United States (Sovereign Engineering Inc.): no mandatory VPN data-retention law, but design makes activity logging impossible | ✗ | – | – | ✗ | No activity or connection logs; does not store connecting IP ('impossible by design' via two-party relay); only minimal account metadata | No | Yes: Cure53, 2025 (macOS app, network extension, two-party protocol; no high/critical issues) | WireGuard, proprietary/other | ChaCha20-Poly1305 (WireGuard) | Curve25519 (WireGuard) | ✓ | – | Mix (Obscura-run relay/entry hop; Mullvad-run exit hop) | ~34 exit locations | ~25 | Yes: kill switch available (level not documented) | – | – | ✓ | ✗ | Yes: always-on two-party relay (WireGuard-over-QUIC entry hop to Mullvad exit) | Yes: custom QUIC-based obfuscation (blends with HTTP/3) | – | – | – | ✓ | – | – | Average (multi-hop adds some latency) | None: randomized account number, no email or personal data | Anonymous account number | ✓ | 3 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$8/mo (single tier, no long-term discount) |
 OVPN | Sweden (OVPN Integritet AB): no VPN data-retention obligation; acquired by US-based Pango in 2023 (now Point Wild), and services now operate across EU and US | ✗ | ✓ | – | Yes: 2020 Stockholm Patent & Market Court ruled OVPN had no logs to hand over in a Pirate Bay-related case; rightsholders ordered to pay OVPN's costs | No activity or connection logs: no traffic, timestamps, DNS requests, IP addresses, MAC addresses or bandwidth data (WireGuard peer IP held in RAM only during the session) | No: no-logs status proven in a 2020 Swedish court case rather than by an independent audit | No | WireGuard, OpenVPN | AES-256-GCM / ChaCha20 | – | ✗ | ✓ | Owned | ~100 | ~18 | System-level | DNS, WebRTC (WebRTC via browser extension) | ✓ | – | – | ✓ | Limited (TCP 443 / tls-crypt) | ✗ | ✓ | ✓ | ✓ | ✓ | Yes: unblocks Netflix (US/DE/SE), Hulu, Amazon Prime, Disney+ | Fast | Email-tied account | ✓ | 4 (base), +1 per subscription year (up to ~7) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~EUR4.22/mo (36-month) | |
 PIA | United States: no mandatory VPN data-retention law, but a Five/14 Eyes member. Owned by Kape Technologies, which also owns ExpressVPN, CyberGhost and several VPN review sites; Kape was taken private by Teddy Sagi's Unikmind in 2023 | ✗ | ✓ | ✗ | Yes: 2016 (FBI bomb-threat) and 2018 US federal cases; PIA had no logs/usable data to hand over | No activity or connection logs (100% no-logs policy, RAM-only servers) | Yes: Deloitte (Romania), audits in 2022, 2024 and Dec 2025 under ISAE 3000 | – | WireGuard, OpenVPN | AES-256 (OpenVPN) / ChaCha20 (WireGuard) | RSA-4096 / Curve25519 (WireGuard) | ✓ | ✓ | Mix | ~29,650 | ~91 | System-level | DNS / IPv6 / WebRTC | ✓ | ✓ | ✓ | Yes: Multi-Hop via Shadowsocks/SOCKS5 proxy (not two VPN servers) | Yes: Shadowsocks / Multi-Hop obfuscation | ✓ | ✓ | Allowed on all servers | ✓ | Yes: PIA MACE (DNS-level) | Yes: reliably unblocks Netflix, HBO Max and other major services | Fast (WireGuard, 10 Gbps NextGen network) | Email (or fully anonymous when paying by gift card) | Email-tied account | ✓ | Unlimited | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~€1.29/mo (3-year + 3-month plan) |
 Proton VPN | Switzerland: no mandatory VPN data-retention law | ✓ | ✓ | ✓ | Swiss transparency report shows legal requests denied; no VPN user data available to hand over (no-logs) | No activity, connection, or user-identifiable metadata logs | Yes: Securitum, annual no-logs audits since 2022; 5th consecutive completed May 2026 (4th was the onsite audit of Aug 2025) | Yes: Securitum (app security audits); SOC 2 Type II, 2025 | WireGuard, OpenVPN, IKEv2, proprietary/other | AES-256 / ChaCha20 | RSA-4096 / ECDHE (Curve25519) | ✓ | ✗ | Mix (owns Secure Core / some hardware; bulk rented via M247, Datacamp, etc.) | ~20,000+ | ~145 | System-level (advanced/permanent kill switch) | DNS / IPv6 | ✓ | ✗ | ✓ | Yes (Secure Core) | Yes (Stealth protocol) | ✓ | ✓ | Yes: P2P/torrenting allowed on designated servers | ✓ | Yes (NetShield ad/tracker/malware blocker) | Yes: reliably unblocks major services (Plus plan) | Fast (VPN Accelerator, up to 10 Gbps servers) | Email (anonymous signup possible) | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~US$2.99/mo (2-yr) |
 PureVPN | British Virgin Islands (moved from Hong Kong in 2021); no mandatory data-retention law; owner GZ Systems | ✓ | ✓ | ✓ | 2017 FBI case (US v. Ryan Lin cyberstalking): PureVPN supplied connection logs; originating home and work IP addresses plus timestamps despite 'no-logs' marketing, helping identify and convict the suspect | Now claims no activity or connection logs; retains account email and payment info. Historically (pre-2018) logged connection timestamps and originating IPs, which enabled the 2017 FBI disclosure | Yes: Altius IT (2019); KPMG no-logs audits 2021-2024 (4th consecutive, April 2024); 'always-on' unscheduled audit program | Yes: ISO 27001 certified; third-party penetration testing | WireGuard, OpenVPN, IKEv2 | AES-256-GCM / ChaCha20 | Curve25519 (WireGuard) | ✗ | – | Mixed | ~6,000 | ~70 | App-level | DNS / IPv6 / WebRTC | ✓ | – | ✗ | ✗ | Obfuscated servers mode | ✓ | ✓ | Allowed on dedicated P2P servers | ✓ | – | ✓ | – | Email-tied account | ✓ | 10 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$1.99/mo (5-yr plan) | |
 RiseupVPN | United States (Seattle-based Riseup Networks): no mandatory VPN data-retention law, but within 5/14 Eyes | ✗ | ✗ | ✗ | Not the VPN itself: the 2016-17 FBI sealed warrants + gag order targeted Riseup's email service, not the VPN. Riseup complied but states no monitoring hardware was ever installed and servers were never seized. The VPN keeps no logs to hand over. | No IP-address logs, no DNS-query logs, no traffic logs; only minimal encrypted connection counts rotated within ~5 days, containing no PII | No | Yes: Cure53 audited the underlying LEAP/Bitmask code | OpenVPN | AES-256 | – | ✓ | – | – | – | – | App-level | DNS, IPv6 | ✓ | – | ✗ | ✗ | Yes: LEAP bridges (obfs4/Snowflake/QUIC) for censorship circumvention | – | ✗ | – | ✗ | ✗ | ✗ | Average | None | No account required (no registration, no username/password) | ✓ | – | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | Free (donation-funded) |
 Shock VPN | United States (Shock Hosting LLC, Piscataway, New Jersey): 5 Eyes member, no mandatory VPN data-retention law | ✗ | – | – | – | No activity or connection logs; states it does not track connection times or browsing activity while connected | – | – | WireGuard | – | – | – | – | – | 15+ locations | ~11 | – | – | – | – | – | – | – | – | ✓ | – | – | – | – | – | None (randomly generated account code) | Anonymous account code | ✓ | 5 | – | – | – | – | – | – | US$3/mo |
 Speedify | United States: Five Eyes member, but no mandatory VPN data-retention law | ✗ | ✗ | ✗ | – | Channel-bonding speed VPN by Connectify; retains public IP, device ID, connection start time, session duration and data used, auto-deleted after 6 months; no browsing or DNS logs claimed | ✗ | Partial: mobile apps hold MASA certification (App Defense Alliance); no full independent audit | Speedify proprietary channel-bonding protocol (over DTLS 1.2) | AES-256-GCM / ChaCha20 | DTLS 1.2 with ECDHE | ✗ | – | Rented | – | ~35 | System-wide (Internet Kill Switch); premium only | DNS; DNS leak reported in testing | ✓ | ✓ | – | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | Via AdGuard DNS option only | ✓ | Fast | Email-tied account | ✗ | 5 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$4.99/mo (3-yr plan) | |
 StrongVPN | United States: 5 Eyes member; owned by Ziff Davis (formerly J2 Global); no mandatory VPN data-retention law but subject to subpoenas, NSLs and gag orders | ✗ | ✗ | ✗ | – | Claims no traffic, IP, timestamp or activity logs; retains account email + payment info; unaudited | ✗ | ✗ | WireGuard, OpenVPN, IKEv2, SSTP, L2TP/IPsec | AES-256 / ChaCha20 (WireGuard) | Curve25519 (WireGuard); RSA-2048 (OpenVPN) | ✗ | ✗ | Owned | ~950 | ~30 | App-level | DNS / WebRTC (IPv6 on macOS only) | ✓ | – | – | ✗ | Scramble (OpenVPN; Windows/macOS) | ✓ | ✗ | Allowed network-wide; no dedicated P2P servers | ✓ | ✗ | ✓ | – | Email-tied account | ✓ | 12 | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$3.97/mo (12-mo, first year) | |
 Surfshark | Netherlands: 9 Eyes member, but no mandatory VPN data-retention law | ✗ | ✓ | ✗ | April 2026 Amsterdam District Court warrant: only account existence + payment info disclosed; no activity/IP logs available | No activity or connection logs; no browsing history, IP, or session data (retains account email + payment info) | Yes: Deloitte, 2025 (ISAE 3000; also 2023) | Yes: Cure53 (browser extensions/infra); SecuRing, 2025 | WireGuard, OpenVPN, IKEv2 | AES-256-GCM / ChaCha20 | Curve25519 (WireGuard); post-quantum on WireGuard | ✗ | ✓ | Rented | ~4,500 | ~100 | System-level | DNS / IPv6 / WebRTC | ✓ | – | ✓ | ✓ | Camouflage / NoBorders (OpenVPN) | ✓ | ✗ | Allowed on most servers, no bandwidth limits | ✓ | CleanWeb (ad, tracker & malware blocker) | ✓ | Fast | Email-tied account | ✓ | Unlimited | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$2.49/mo (2-yr Starter) | |
 Thunder VPN | Opaque; provider claims 'independent developers from Hong Kong' with a US address used for payment processing only; no verifiable corporate registration found for 'Signal Lab'; contact is a personal Gmail account | – | ✗ | ✗ | – | Claims no-logs, but reviewers found it collects connection timestamps, bandwidth usage, device info, OS version, ISP, app identifier and ad identifier, language, and chosen server location; privacy policy has previously listed IP and email address (provider says IP collection has stopped); connection metadata reportedly retained about one month; no retention or deletion detail; data may be shared with third parties | ✗ | ✗ | SSL | AES-128 | – | ✗ | – | – | – | – | ✗ | Passed IP, DNS, and WebRTC leak tests in reviews; no dedicated leak-protection feature | – | – | ✗ | – | ✗ | ✓ | ✗ | Technically works; not recommended (no kill switch, invasive logging) | ✗ | ✗ | Limited; fails Netflix and most services; some reviews report only Amazon Prime and YouTube US | Slow | No account or signup required for the free version | Anonymous; no account on free tier | ✗ | Unlimited on free tier (no account) | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | Free (ad-supported) |
 TorGuard | United States (Florida; VPNetworks LLC): 5 Eyes member, but no mandatory VPN data-retention law | ✗ | ✗ | ✗ | 2021 to 2022: sued by film studios; settled without disclosing user logs, agreed to block BitTorrent on US servers | No traffic or connection logs; retains account email + payment info. Apache web-server logs purged regularly; marketing site uses Google Analytics | ✗ | ✗ | WireGuard, OpenVPN, IKEv2, OpenConnect (AnyConnect), Shadowsocks, Stunnel | AES-256 / ChaCha20 (WireGuard); AES-128 and Blowfish selectable | Curve25519 (WireGuard) | ✗ | ✗ | – | ~3,000 | ~50 | System-level (plus per-app kill) | DNS / IPv6 / WebRTC | ✓ | – | ✓ | ✗ | Stealth mode (OpenVPN Scramble, Shadowsocks, Stunnel) | ✓ | ✓ | Allowed on non-US servers; blocked on US servers via firewall (2022 settlement) | ✓ | Ad and malware blocker | Requires paid dedicated streaming IP (Pro/Premium plans) | – | Email-tied account | ✓ | 8 (Standard); up to 30 (Premium) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$4.28/mo (3-yr Standard) | |
 Trust.Zone | Seychelles: outside 14 Eyes, no mandatory data-retention law | ✓ | ✗ | ✓ | – | Claims no activity logs; retains anonymous aggregate usage/bandwidth data (used to enforce trial limits); usage not tied to real IP | ✗ | ✗ | WireGuard, OpenVPN, IKEv2, L2TP/IPsec, SSTP, PPTP | AES-256 (OpenVPN, CBC/HMAC-SHA512); ChaCha20 (WireGuard) | RSA-2048; ECDHE | ✗ | ✗ | Mixed | ~190 (advertised) | ~90 advertised (fewer, ~37 to 40, in apps) | App-level | DNS / IPv6 / WebRTC | – | – | – | Double VPN (Android and iOS only) | ✗ | ✗ | ✓ | Allowed on all servers | ✓ | ✗ | Limited (US Netflix via dedicated IP) | – | Email-tied account | ✓ | 3 (5 on 2-yr plan) | ✓ | ✗ | ✗ | ✓ | – | ✓ | ~US$2.33/mo (2-yr plan) | |
 TunnelBear | Canada: Five Eyes member; no mandatory data-retention law for VPNs, but owned by McAfee (US) | ✗ | ✓ | ✗ | 70 government requests received 2021-2023; no browsing data provided (none logged) | No activity or connection logs (no IPs, no DNS queries, no browsing). Retains email, app/OS version, aggregate monthly bandwidth, coarse geolocation | No: annual Cure53 audits are security-focused, not a dedicated no-logs audit | Yes: Cure53, annually since 2017 (8th published 2024; 9th completed 2025) | WireGuard, OpenVPN, IKEv2 | AES-256 | – | ✗ | – | – | ~8,000+ | ~46+ | App-level (VigilantBear) | DNS, IPv6 | ✓ | ✗ | ✓ | ✗ | Yes (GhostBear) | Yes (SplitBear; Android and Windows) | ✗ | Allowed on select servers (CA, US, UK, RO, NL, DE, SE); slow in practice | ✗ | Yes: TunnelBear Blocker (separate open-source browser/app blocker) | Limited: inconsistent; some Netflix US, unreliable elsewhere | Average (fast on nearby US servers, slow long-distance) | Email-tied account | ✗ | Unlimited | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ~US$3.33/mo (3-yr) | |
 Turbo VPN | Singapore; registered to Innovative Connecting Pte Ltd (UEN 201812738K); no mandatory data-retention law, but ownership is China-linked via Cayman shareholder Lemon Seed Technology and Chinese-national directors | ✓ | ✗ | – | – | Policy admits logging connection date, VPN server location, ISP, and bandwidth usage plus account info; policy states the connection date combined with server location and ISP could let a third party isolate an individual connection | ✗ | ✗ | OpenVPN (UDP/TCP), IKEv2, L2TP/IPsec, WireGuard (mobile only), proprietary (V2Ray, SSR, Trojan, iSSR) | AES-256 claimed on site; AES-128 observed in independent testing | – | ✗ | – | – | 21,000+ claimed | 111 claimed; roughly 46 verifiable in testing | App-level | DNS leaks found in independent testing across apps | – | – | – | ✗ | – | ✓ | – | Restricted; banned or unreliable on most servers | ✗ | ✗ | Limited; inconsistent unblocking | – | Email required | Email-tied account | ✓ | 10 (up to 20 on higher tier) | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | $3.33/month |
 VP.net | United States; a core Five Eyes country with no blanket mandatory VPN data-retention law but subject to US legal process, subpoenas, and gag orders | ✗ | – | – | – | Vendor claims logging is cryptographically impossible: user traffic is processed inside Intel SGX secure enclaves and the company states it does not log IP addresses, browsing history, DNS queries, connection timestamps, or bandwidth. The server-side SGX enclave source is published on GitHub under an audit-only license for public inspection; there is no independent third-party audit and the SGX remote-attestation model has documented criticisms (e.g. a load-balancer split between an attested legit enclave and separate compromised hardware). | No independent no-logs audit; relies on Intel SGX enclave self-attestation plus self-published server code (audit-only license), not a third-party firm review | – | WireGuard | ChaCha20-Poly1305 (WireGuard) | Curve25519 (WireGuard) | – | – | – | – | – | – | – | – | – | – | – | Server-side traffic obfuscation described in the enclave code (connection-pool randomization, packet buffering, dummy-traffic generation) | – | – | – | – | – | – | – | – | – | – | 5 | ✓ | ✓ | ✓ | ✓ | – | ✓ | – |
 VPN Unlimited | United States: Five Eyes member, but no mandatory VPN data-retention law | ✗ | ✗ | ✗ | 2021: settled US film-studio piracy suit; agreed to block BitTorrent and pirate sites on US servers | Claims no activity or connection logs; session real IP held in memory only during connection; retains account email and billing data | ✗ | ✗ | WireGuard, OpenVPN, IKEv2, KeepSolid Wise, L2TP/IPSec | AES-256-GCM / ChaCha20 | – | ✗ | – | – | ~500 (self-claims 3000+) | ~50 (self-claims 80+) | System-level | DNS / WebRTC | ✗ | ✓ | ✓ | ✗ | KeepSolid Wise (TCP/UDP) | ✓ | ✗ | Limited: 3 dedicated servers; blocked on US servers | ✓ | Optional via AdGuard custom DNS | ✓ | – | Email-tied account | ✓ | 5 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ~US$4.50/mo (3-yr plan) | |
 VPN.ac | Romania: outside 14 Eyes; Constitutional Court struck down EU data-retention law (2014) | ✓ | ✗ | ✗ | – | Keeps connection logs (source IP, connection start/end time, bandwidth used) while a session is active; erased shortly after disconnection. No browsing, DNS, or activity logs. | ✗ | ✗ | OpenVPN, WireGuard, IKEv2, L2TP/IPsec, PPTP | AES-256 / AES-128; ChaCha20 (WireGuard) | RSA-2048 to RSA-4096; ECC (secp256k1) | ✗ | ✗ | Owned | ~130 | ~25 | App-level | DNS / IPv6 | ✓ | – | – | ✓ | OpenVPN XOR | ✓ | ✗ | ✓ | ✓ | SecureDNS | Partial (Netflix US) | Fast | Email-tied account | ✓ | 12 | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | $3.75/mo (2-year plan) | |
 VyprVPN | USA (Texas); operated by Certida LLC since 2023 (formerly Golden Frog, marketed as Switzerland-based). No mandatory data-retention law, but Five Eyes member and subject to subpoenas and gag orders | ✗ | – | – | No known case of logs being compelled since 2018 audit | No-logs policy: states it does not retain source IP, browsing activity, connection timestamps, or DNS request logs | Yes: Leviathan Security Group, 2018 (not re-audited under US ownership) | – | WireGuard, OpenVPN, IKEv2/IPsec, Chameleon | AES-256 (OpenVPN/Chameleon); ChaCha20 (WireGuard) | Curve25519 (WireGuard) | ✗ | – | Owned | 700+ (as of 2026) | 60+ (as of 2026) | System-level and app-level (configurable; not on iOS) | DNS and WebRTC leak protection; IPv6 blocked | ✓ | – | – | ✗ | Chameleon | ✓ | – | Allowed on all servers | ✓ | ✗ | Yes: Netflix, BBC iPlayer, Disney+, Amazon Prime Video | – | – | Email-tied account | ✗ | 10 (reduced from 30) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | $3/month on 2-year plan (as of 2026) |
 Windscribe | Canada (Toronto): Five Eyes member, but no mandatory VPN data-retention law; proposed 2026 Lawful Access Act (Bill C-22) could change this, prompting Windscribe to threaten leaving | ✗ | ✓ | – | Yes: 2025 Greek court case; company held no user data to hand over, case dismissed | No identifying logs: retains bandwidth used and username of last activity; no source IP, timestamps, or browsing history | No dedicated no-logs audit (court-proven instead, Greece 2025) | Yes: Packetlabs 2024 (FreshScribe server infra); Leviathan Security Group 2021 (desktop) and 2022 (mobile) | WireGuard, OpenVPN, IKEv2, proprietary/other | AES-256-GCM / ChaCha20 | RSA-4096 (OpenVPN) / Curve25519 (WireGuard) | ✓ | ✓ | Mix | – | ~69 | System-level | DNS, IPv6, WebRTC | ✓ | ✓ | ✓ | Double Hop | Stealth (OpenVPN over TLS) and WStunnel | ✓ | Yes (Pro): ephemeral and static, setup is cumbersome | Allowed on all servers | ✓ | R.O.B.E.R.T (ad/tracker/malware/domain blocking) | Yes: Pro reliably unblocks Netflix (32 libraries) and other major services | Fast | Username only; email optional (needed for more free data) | Username account (email optional) | ✓ | Unlimited | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~US$5.75/mo (annual Pro); Build-A-Plan from ~$3/mo |
 X-VPN | Singapore (claimed, PDPA); operating entity Free Connected Ltd is Hong Kong-registered; director Jin Li and sole shareholder Chengdu Zhuozhuo Technology Co are based in Sichuan, China; opaque, reportedly China-linked ownership | ✓ | ✓ | ✓ | – | Claims no logging of originating IP, server IP, browsing activity, DNS queries, or connection timestamps; collects email, encrypted password, order/billing IDs, device information, and aggregated bandwidth/operational data; free tier reported to share telemetry with advertisers (AdMob, InMobi) | ISAE 3000 (Revised) no-logs/privacy assessment by an unnamed Big Four firm, completed Feb 28 2026 | ✗ | Everest (proprietary), OpenVPN, WireGuard | AES-256; ChaCha20 | – | ✗ | ✓ | – | 10,000+ | 95 | App-level | DNS and WebRTC leak protection; IP/DNS leaks reported in some browser tests and on macOS kill switch | – | – | – | – | Yes; TLS-based | ✓ | ✗ | Yes; dedicated P2P/BT-labeled servers | ✓ | Yes (paid) | ✓ | – | Email required (disposable/fake email allowed); no payment info required for free tier | Email-tied account | ✓ | 5 (paid); unlimited (free) | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | $2.99/month (24-month plan) |
Data last reviewed August 2026.
Corrections and suggestions
Spotted something out of date, or run a tool that belongs here? Tell us the tool, the exact claim, and a link that shows it.