VPN providers and self-hosted tunnels, judged on how you pay, what they keep and who runs the servers, plus what a VPN cannot hide.
Last reviewed · 9 entries
A VPN does not remove the need for trust; it moves it. Your Wi-Fi operator and internet provider stop seeing which services you connect to, and the VPN provider starts seeing it instead. Websites see the VPN server's IP address rather than yours.
That makes the choice of provider the most important decision. This guide favours providers that let you sign up without an email address, pay in cash or Monero, publish independent audits and show who runs their servers. It also explains where a VPN stops helping. If you need anonymity rather than a different IP address, use Tor Browser (see the browser guide).
A VPN (virtual private network) builds an encrypted tunnel from your device to a server run by the provider. All your traffic goes through that server, which talks to the internet on your behalf. In practice the VPN server becomes a second router: it handles everything you send and receive, and the sites you visit see its address instead of yours.
Observer
Without a VPN
With a VPN
Local network and internet provider
Your IP address, which servers you connect to and when, and usually the site names
That you connect to a VPN server, when, and how much data you move
VPN provider
Nothing
Your real IP address, which servers you connect to, and any traffic that is not separately encrypted
Websites and apps
Your real IP address and its approximate location
The VPN server address; your logins, cookies and browser fingerprint still identify you
Payment provider
Nothing
That you bought a VPN, under your name, unless you pay in cash or Monero
Who can see what
What a VPN does not do
It does not make you anonymous. The provider can see what your internet provider used to see. A no-logs policy is a promise, and an audit only checks it at one point in time.
It does not hide you from accounts you use. If you sign in to Google or a social network, they know it is you, whatever IP address you arrive from.
It does not stop tracking in the browser. Cookies, fingerprinting and trackers work the same over a VPN. Pair it with a hardened browser from the browser guide.
It does not protect against malware or phishing. A malicious app on your device sees your data before it enters the tunnel.
It does not guarantee that all traffic stays in the tunnel. Researchers have shown leaks on hostile local networks (TunnelCrack, 2023; TunnelVision, 2024), and in 2026 Mullvad disclosed two Android flaws that let a malicious app send traffic outside the VPN (see tips).
It does not hide that you use a VPN. Common VPN protocols are easy to recognise, and some networks and countries block them (see censored networks).
Swedish VPN that issues a random account number instead of asking for an email address, accepts cash by post and Monero, and charges one flat price. Many users share each exit address, so you blend in with a crowd.
OpenVPN support ended on 15 January 2026. The apps and servers are now WireGuard-only, so routers or third-party apps still set up for OpenVPN no longer connect.
Long-running privacy VPN with account-ID sign-up, cash and Monero payments, open-source apps and yearly Cure53 audits. Rated with caution because every server is rented, most of them from two large hosting companies.
In August 2026 an exploited BTCPay Server flaw let an attacker take 0.62 BTC from IVPN's Lightning node. IVPN says the customer database runs on separate infrastructure and no customer data was accessed.
Two-hop VPN: Obscura's relay sees your IP address but not your traffic, and a Mullvad exit server sees your traffic but not your IP. The design aims to stop either company from linking you to your activity on its own.
VPN built on the Mysterium Network, where home users and hobbyists run exit nodes and are paid in the MYST token. You get residential IP addresses, but your traffic leaves through a stranger's connection.
Advantages
+Residential IP addresses rather than data-centre ranges
+Exit node can be chosen by city
+Open-source network software
+No single company runs all the exit servers
Drawbacks
-Exit node operators are unvetted members of the public and can see unencrypted traffic
-Node quality and speed vary widely
-A malicious node is hard to spot before you use it
-Node discovery is still run centrally, by NetSys Inc.
Swiss VPN from Proton AG, the company behind Proton Mail, with a free plan, open-source apps and yearly no-logs audits. It is listed here because Proton AG has several times given Swiss authorities data that helped identify Proton Mail users.
A draft Swiss surveillance ordinance (VÜPF) would make services with over 5,000 users retain data such as IP addresses. In February 2026 the government ordered an impact assessment and said it would not proceed as written. In 2025 Proton began moving most of its servers out of Switzerland.
App-store charts, advertising and many review sites are dominated by a few corporate groups and by free apps whose owners are hard to identify. The problems below are documented. None of these services is a good fit for the priorities of this guide.
Free VPN apps
Running VPN servers costs money. A free app has to cover that some other way: advertising, data sharing, or reselling your connection. Documented cases:
Hidden Chinese ownership. In April 2025 the Tech Transparency Project found that 20 of the top 100 free VPN apps in Apple's US App Store were owned from mainland China or Hong Kong without clear disclosure. They include X-VPN and Turbo VPN, VPN Proxy Master, Thunder VPN and Snap VPN. The last four are published by Singapore-registered Innovative Connecting, which TTP links to Qihoo 360, a company the US Defense Department lists as a Chinese military company.
Your connection resold. Free users of Hola agree that their device's resources are shared, including "for business use by Bright Data", a commercial proxy network (Hola FAQ).
Botnets. The MaskVPN and DewVPN apps worked as advertised while quietly routing other people's traffic through users' computers for the 911 S5 proxy botnet, whose operators the US Treasury sanctioned in May 2024 (KrebsOnSecurity).
Undisclosed data sharing. In 2017 the Center for Democracy and Technology asked the US Federal Trade Commission to investigate undisclosed data sharing and traffic redirection in the free version of Hotspot Shield (background).
Heavily advertised brands
Many well-known brands belong to a handful of companies. Ownership matters: one parent sets the policies of several "competing" services, and some parents also own the review sites that rank them. Several of these brands have since passed no-logs audits, which shows how they work today but does not undo their record.
Owner
Brands
Documented record
Kape Technologies, formerly Crossrider; private since 2023 under Teddy Sagi's Unikmind
ExpressVPN, Private Internet Access, CyberGhost (ZenMate was folded into CyberGhost)
Crossrider's platform was abused to spread adware; Kape also bought the review sites vpnMentor and Wizcase. ExpressVPN for Windows leaked some DNS requests with split tunnelling on (2022 to 2024).
Under an earlier owner, Highwinds, IPVanish gave US Homeland Security a user's name, real IP address and connection times in 2016 while advertising no logs.
Subject of the 2017 complaint to the FTC about its free app (see above).
Who owns the big brands
Built-in and big-tech options
Cloudflare WARP replaces your IP address with a Cloudflare one, but all your traffic then passes through Cloudflare (WARP FAQ). Treat it as an encrypted connection, not an anonymity tool.
iCloud Private Relay (part of Apple's paid iCloud+) covers Safari through two relays: Apple's sees your IP address, a partner's sees the site. It is tied to your Apple account and not available in every country (Apple). It is not a full VPN.
Opera's built-in VPN covers browsing inside Opera, not your other apps (Opera help). Opera is majority-owned by China's Kunlun Tech (Wikipedia).
Psiphon is built to get around censorship, not to protect privacy. Its policy says it never logs IP addresses, but the free app shows Google AdMob ads, and it shares aggregated usage statistics with sponsors and researchers (privacy policy).
Running your own VPN server means no VPN company sees your traffic, and you can use any protocol and configuration you like. The hosting company can still see traffic entering and leaving the server, and it knows how you paid. The server hosting guide covers providers that accept anonymous payment.
Pros: no VPN provider in the middle; full control over configuration and logging; any protocol, including ones designed to resist blocking.
Cons: one location (your server); no crowd to blend into; bandwidth can be expensive; reliability depends on your host; you must keep the server patched.
Free, open-source app that installs a VPN on a server you rent and connects your devices to it. Its AmneziaWG protocol is a modified WireGuard built to be harder to detect and block, which makes it useful in censored countries.
Open-source, self-hosted replacement for Tailscale's coordination server. Your devices keep using the Tailscale apps, but the server that knows your devices and keys is yours.
Platform Support
Command lineOpen sourceSelf-hostable
Advantages
+Works without a Tailscale account or company-run server
+BSD-3-Clause licence, actively developed
+Encrypted mesh connections between your own devices
Drawbacks
-Built for one network: personal use or a small organisation
-Independent of Tailscale Inc., though one maintainer works there
-Hides your browsing only if you route it through an exit node you run
Mesh VPN that links your own devices over WireGuard, with a free personal plan. Useful for reaching devices at home or routing traffic through a device you own, but it is not a privacy service.
Platform Support
WindowsmacOSLinuxAndroidiOSEnd-to-end encrypted
Advantages
+Easy setup; free personal plan for up to 6 users
+Relay servers forward traffic they cannot decrypt
+Exit node feature routes all traffic through a device you own
Drawbacks
-Creating a network requires a third-party sign-in such as Google, Apple or GitHub
-Company-run coordination server knows your devices, keys and network addresses
-Coordination server and some GUI clients are closed source
Where VPNs are blocked, the network usually recognises the protocol itself, and plain WireGuard and OpenVPN are easy to fingerprint. Options, roughly from simplest to strongest:
Turn on your provider's obfuscation. Mullvad offers QUIC and LWO (Lightweight WireGuard Obfuscation) in its apps (2025 review); IVPN offers obfs4 and V2Ray.
Run your own Amnezia server outside the country with AmneziaWG or XRay Reality. A server only you use is less likely to be on a blocklist than a commercial VPN.
Since 2025, laws that make websites check users' ages have turned VPNs into a political target, because a VPN lets people appear to be somewhere the law does not apply. The situation as of October 2026:
United Kingdom. When Online Safety Act age checks began on 25 July 2025, Proton reported a 1,400% jump in UK sign-ups and Proton VPN became the most downloaded free app on the UK App Store (TNW). After a 2026 consultation, the government said in July 2026 "We will not ban or age-gate VPNs", while asking Ofcom to study circumvention and keeping the question under review (GOV.UK).
UK legal powers. Section 70 of the Children's Wellbeing and Schools Act 2026 lets ministers require providers of specified internet services to restrict children's access by regulation. It does not name VPNs (legislation.gov.uk).
Utah. SB 73, in force since 6 May 2026, treats anyone physically in Utah as a Utah user even behind a VPN, and bars adult sites from telling users how to bypass age checks with one. In September 2026 Utah agreed not to enforce it against Aylo, Pornhub's parent company, until a court ruling or final compliance rules (EFF).
Other US states. Wisconsin removed a requirement for sites to block VPN users from its age-verification bill in February 2026 (EFF). A Michigan proposal that would have made internet providers block VPNs did not advance (EFF).
European Union. A 2026 European Parliament research paper examined VPNs as a way around age checks (see further reading), and in May 2026 Commission Executive Vice-President Henna Virkkunen said VPNs must not be allowed to circumvent the EU age-verification system (Brussels Signal).
Switzerland. A draft revision of the surveillance ordinance (VÜPF) would require services with more than 5,000 users to retain data such as IP addresses and hand it to authorities on request. After strong opposition the Federal Council ordered an impact assessment in February 2026 and will consult again (CIVICUS Monitor). This matters for Swiss providers such as Proton.
Pay without your name. Use cash by post or Monero where offered (see the crypto guide). Payment records can identify you even when a service keeps no activity logs: in 2026, payment data linked to a Proton Mail account reached the FBI through Swiss authorities.
Sign up without an email address. Mullvad, IVPN and Obscura issue account numbers instead.
Check who runs the servers. Mullvad's server list shows which servers it owns; filter to those if you want fewer third parties with physical access. The 2018 NordVPN breach came through a hosting company's remote-management system on a rented server.
Turn on the kill switch. Use the app setting that blocks traffic when the tunnel drops, and on Android also enable "Always-on VPN" and "Block connections without VPN".
Know the Android gaps. In 2026 Mullvad disclosed two Android flaws that let a malicious app send traffic outside any VPN even with those settings on (May, September). Install only apps you trust; GrapheneOS has patched the first (see the OS guide).
Keep DNS inside the tunnel. Use the VPN's DNS servers rather than your internet provider's; the DNS guide explains why it matters.
Keep identities apart. Logging in to personal accounts over the same connection or browser as anonymous activity links the two. Use separate browser profiles or Tor Browser, and see the alting guide.
Rotate when it matters. If activity on different servers must not be linkable, log out and back in to get a new key and tunnel address. Mullvad advised this after the May 2026 exit-IP issue; its fix covered 96% of servers by October 2026.
Be careful on hostile Wi-Fi. Attacks such as TunnelVision let a hostile local network push traffic outside the tunnel; for sensitive work, a phone hotspot is safer than public Wi-Fi.
Read reviews critically. Some popular VPN review sites belong to VPN companies; Kape owns vpnMentor and Wizcase.