There has been a boom in VPN adoption in recent years. While employees have been using VPN to securely tunnel into a corporate network for decades, Edward Snowden’s 2013 NSA leaks made more people jittery about mass surveillance. Russia’s and China’s recent bans on VPNs show how contentious the technology has become for governments. A raft of national security laws, such as the UK’s 2016 Investigatory Powers Bill, also spurred interest in consumer VPNs. If you’re interested yourself, we’ve made a list to help you find the best VPN. Anyone with the know-how can set up their own VPN with a remote virtual machine in the cloud for about $10 a month in one location, but many people want a VPN to access content in different regions, which makes price, speed, locations, and server capacity important. Mainstream consumer VPN services let average computer users create a secure point-to-point encrypted tunnel through which data can travel and can shield metadata, such as a home computer’s IP address. If you’re paying a monthly fee for a VPN, it should work like any utility, humming in the background without noticeably disrupting downloads and uploads. For me, as a tech news reporter based in Europe, I find a VPN useful when I need to check out Google’s US Chromebook and Pixel pricing to see products and prices that are not immediately available in the UK, Europe or Australia. But picking a VPN provider is tricky because consumers need to trust the VPN provider is protecting data as claimed. That’s where third-party audits come into play and may help identify lemons. Nearly all VPN providers claim not to log user data and suggest their location of operation will prevent law enforcement from Five Eyes nations acquiring data. Not all subject their products to a third-party audit. All my VPN speed tests were carried out through Ookla’s SpeedTest.net from a home fibre broadband connection just outside of Stockholm. I generally experience non-VPN download speeds of 70 Mbps and slightly faster upload speeds around 80 Mbps. Latency is normally about 3-5ms without a VPN. ExpressVPN operates from the British Virgin Islands, which has favorable laws for those who want to keep their data private. ExpressVPN has subjected its performance claims to an audit by PwC in 2018 and an audit of privacy and security claims by German security outfit Cure53. However, that only covered its Chrome extension. It is one of the more expensive consumer VPN providers but it also has a solid reputation for providing a reliable service with plenty of options to configure the service. It is investing in its alternative to the widely-used OpenVPN VPN protocol called Lightway. It launched this month and promises much faster connection times, faster speeds and more reliable connections. With the native ExpressVPN app, establishing a connection to a server anywhere takes at most a few seconds. Connections to the US provided reliably fast download/upload speeds but latency was larger due to distance. Many Brits temporarily reside in Australia and may have picked up a few TV shows that are only shown locally. Similarly, connecting to a server in Australia resulted in high latency (ping) with download/upload speeds ranging between 43/46 Mbps to 18/9 Mbps. These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when connected to:
Hong Kong (397, 44/1.61)Melbourne, Australia (508, 19/9)Frankfurt, Germany (64, 44/64)London, UK (60, 66/49)New York, USA (171, 55.7/54)
Pros:
Fast connections, decent speeds to major content markets Simple and non-intrusive user interface Frequent audits and reports are published Broad platform support
Cons:
It is relatively expensive Browser extension only supports Chrome and Firefox
Not all VPN services have a monthly payment option even though prices are quoted on a monthly basis. NordVPN actually has a one month option, which costs £10.61, including VAT. NordVPN is operated by NordSec and its parent company, Tefincom & Co., S.A., is registered in Panama — a jurisdiction that technically doesn’t require it to store user logs and is outside of arrangements with Five Eyes alliance nations. It recently completed a security audit of its VPN apps with VerSprite, the cybersecurity company it’s partnering with for its bug bounty program, which it’s run since 2019, shortly after disclosing a breach at a data center it used in Sweden. NordVPN was co-founded by Lithuanian entrepreneur Tom Okman, who ZDNet covered in a recent in-depth profile. Notably, NordVPN relies on WireGuard rather than OpenVPN. The former has a much smaller codebase, reducing the likelihood of security vulnerabilities lurking. It’s also developed NordLynx, NordSec’s WireGuard-based next-gen tunneling solution. NordSec tests indicated it would double the performance over OpenVPN and IKEv2 protocols. NordVPN always performs well in speed tests and has been at the forefront of the auditing trend for VPNs. In 2020, it re-engaged PricewaterhouseCoopers (PwC) Switzerland to probe its no-log policy claims for one week. It first engaged PwC in 2018 to assess its no-log policy. These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when connected to a server in:
Sweden (15, 48/76)Australia (547, 56/6)Hong Kong (411, 36/9)New York (188, 42/67)Los Angeles (295, 61/12) London: (58, 45/60)Netherlands: (55, 71/75)Germany: (54, 62/79)
It doesn’t appear in most top US-focussed consumer VPN lists, but is worthy of consideration in the UK because of its location and record on privacy. It uses known VPN protocols such as IKEv2/IPSec and OpenVPN. Network traffic is encrypted with AES-256, while key exchange is done with 4096-bit RSA. ProtonVPN has commissioned audits for all its full-release software from SEC Consult, a reputable Austrian security consultancy. Being Swiss-based, Proton claims it can’t be coerced by Five Eye alliance nations to hand over user logs. ProtonVPN applications offer a built-in Kill Switch feature or the Always-on VPN feature. There’s a decent free version with three locations and “medium” speeds, while the “Basic” costs €4 (£3.41) a month charged at €48 per year (£40.93). It includes 350 servers in 49 countries and allows for two VPN connections on a “high speed” connection. There is also support for blocked content, P2P/BitTorrent support, and NetShield-based adblockers. The €8 (£6.82) a month VPN package is likely to be the best option for people willing to spend on a decent VPN. It includes 1,200 servers in 55 countries and offers up to 10 VPN connections with speeds up to 10 Gbps. ProtonVPN delivered respectable performance when connected to a server in New York (92 ms latency, 37/59 Mbps download/upload speeds). On an un-congested LA-based connection, it had a latency of 166 ms, and download/upload speeds of 64/73 Mbps. ProtonVPN is a solid VPN and it just announced a major speed boost with its “VPN Accelerator” technology for paid accounts with the ProtonVPN app. The VPN Accelerator speed boost works with multiple VPN protocols, including OpenVPN TCP, OpenVPN UDP, Wireguard, or IKEv2 VPN protocols. It could be a game-changer for high latency servers. There’s a handy “quick connect” option and connecting to ProtonVPN takes just a few seconds. The UI is helpful too, putting the Kill Switch — if you want to block the internet if your VPN connection drops out — up front, along with the adblocker controls, and its Secure Core option to route data through the privacy-friendly countries. These features are for the paid subscriptions. The version offers three locations. The instance I tested included servers in Japan, Netherlands and the US. In my SpeedTest broadband tests of ProtonVPN’s free service, download and upload speeds were about 10 Mbps slower when connected to a server in the Netherlands, which is plenty for streaming HD video. Connecting via Proton’s US servers was a much slower experience on the free option, with download/upload speeds of 10/23 Mbps, and latency of 252ms. These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when using Proton’s €8 (£6.82) a month VPN connected to:
Hong Kong (30, 48/51)Australia (30, 35/25)Germany (30, 50/13)London, UK (29, 40/28 Mbps)USA (29, 40/28 Mbps)
Note: Proton’s maps indicated that all connections outside of Europe, by default, went through a server in Iceland as a first hop, which is likely why its latency appears lower than other VPNs. Pros:
It supports a decent free tier VPN serviceSupports more devices than most on a single subscriptionHas undergone publicly available audits and values transparency Interface offers shortcuts to key security and privacy configurations
Cons:
It is more expensive It’s a young VPN service It’s server infrastructure is smaller than the well-established brands
It has fairly broad country coverage and is upfront about which VPN servers it rents and owns. Its ‘owned’ servers are located solely in Europe and the UK and support speeds up to 10 Gbps. Generally Mullvard uses 31173 Services AB to host its owned servers. These are faster; however its rented servers are all dedicated. The service supports OpenVPN and Wireguard tunneling protocols. Users can configure it to work either exclusively on one protocol or have the Mullvard app select the protocol automatically. Mullvard stands out for its transparency about its server infrastructure and any server issues it’s facing. It also has a clearly and thoroughly explained document outlining its no-logging policy and what payment information it collects — basically nothing that could identify the user. It doesn’t require a username, password or email address to establish an account and instead generates a random account number for each new account. The only details for each account it stores are the account number and the time remaining on that account. Mullvad accepts cash, Bitcoin, Bitcoin Cash, bank wire, credit card, PayPal, and Swish (the Swedish peer to peer payment system co-funded by major banks). Mullvad has undergone three major security audits, making it a leader in VPN transparency. In 2018, Mullvad contracted German consultancy Cure53 and Assured to vet it for security vulnerabilities in its app. In mid-2020 Cure53 audited its apps for Windows, Linux and macOS as well as iOS and Android and disclosed all bugs found. In December 2020, Cure53 audited Mullvad’s infrastructure to look for security issues and privacy leaks. Once again, Mullvad disclosed all issues found. Mullvad VPN AB is owned by Swedish parent company, Amagicom AB. Mullvad VPN AB Amagicom AB are 100% owned by founders Fredrik Strömberg and Daniel Berntsson who are actively involved in the company and are keen on researching cybersecurity issues. Additionally, Mozilla selected Mullvad’s VPN infrastructure to run its own Mozilla-branded VPN. Though Mozilla doesn’t state it uses Mullvad on its website, the link to its “full list of servers” redirects to Mullvad’s. Hopping between countries was simple. The app chooses the optimal location within each country. I experienced no dropouts when switching countries. Speeds were fastest within Europe, but slow on the US west coast and Australia. The desktop app is lightweight and has a simple interface that doesn’t take up too much screen space. Latency and speeds connected to Mullvard servers in different locations (ping in ms, download/upload in Mbps):
London (45, 51.18/60.3)San Jose, USA (324, 25.99/49.49)Switzerland (77, 61.31/61.22) Sydney, Australia (603, 6.06/60)Brazil (458, 18/52) Frankfurt, Germany (52, 50/65) Paris, France (63, 53/72) Hong Kong (412, 11/1.24)
Pros:
Easy pricing that doesn’t encourage multi-year subscriptionsDecent speeds and great infrastructure across EuropeA focus on privacy and security with investments to prove itProvides extremely clear information about user information it collects
Cons:
Compared to multi-year subscriptions, it is more expensiveIt is a smaller VPN than it’s larger rivals with fewer serversFocussed more on VPN services across Europe
Simultaneous Connections: Up to 7Kill Switch: YesPlatforms: Windows, macOS, iOS, Android, Linux, Android TV, Chrome, Firefox, games consolesLogging: Has a no log policy Countries: 90Servers: 6,900Trial/MBG: 45 day
CyberGhost has a few friendly features and offers that make it appealing to general users. The company offers a free one day trial of its VPN service and a longer than usual 45-day money back guarantee, plus it’s relatively cheap. It claims to have 38 million users and says it does not collect or store user IP addresses, DNS queries or browsing history. Its headquarters are in Bucharest, Romania. A few years ago, it didn’t offer a connection to servers in Russia but now it has one in Moscow. The company does produce a transparency report but it hasn’t been audited by a third-party for several years. Compared to rival VPN services, CyberGhost is cheap. Its three year plan costs just £1.99 a month billed £77.61 a year. The two year plan costs £ 2.89 a month and is billed at £69.36 a year, while the one year plan costs £3.45 a month and is billed at £41.40 a year. During tests, the VPN offered decent speeds and fast connection times. Pros
Abundance of servers Cheaper than most VPN providers
Cons
No recent audits
I tested each VPN’s connection performance in multiple locations over a week during work hours. All of them offered similar speeds and, naturally, these were all slower than without a VPN enabled. As expected, more distant locations resulted in higher latency but some VPN services offered slightly better speeds. I also checked whether the provider had undergone a recent audit as this is an important signal of transparency. Alternatively, when you’re abroad and need to access content that’s only available to IP addresses in your home country, a VPN can be useful. Other situations include when visiting a doctor’s office and you don’t want to be associated with the location you’re accessing the internet from for obvious privacy reasons. In this respect, it’s worth considering both the price and the terms of the contract. It might, for example, be worth paying a little bit more for a VPN that offers the service on a month-by-month basis rather than comparing the monthly cost that must be paid on an annual basis. That is, you might only need it for a few days or a few times a year.
