\n<\/p>\n
Surfshark<\/strong><\/a>: I’ve used Surfshark personally for a few years, and I’d still be using it if Proton didn’t impress me so much. Surfshark is dead simple to use. It pops up and connects before swiftly getting out of my way so I can get on with my day. If you spring for a two-year plan, it’s cheap. You can score over two years for around $54 with the Starter plan.<\/p>\n If you want to dig in deeper, you can. Surfshark is one of the most feature-rich VPNs I’ve used, sporting the basics like a double-hop connection and split tunneling, as well as an ad blocker and email masking. Like Proton, Surfshark offers other security tools like antivirus and dark web monitoring if you pick up a more expensive plan. Surfshark loses out just a bit when it comes to privacy, however. It has a no-logs policy, and it maintains a transparency report<\/a> and a warrant canary<\/a>, so it\u2019s not bad in this regard. However, it doesn’t have open-source applications, so you\u2019ll need a bit more faith in Surfshark\u2019s app security than with some other VPN services.<\/p>\n EventVPN<\/strong><\/a>: This is a free, ad-supported VPN from ExpressVPN. Ads and VPNs don’t really mix, but EventVPN says it’s able to offer a free service via Apple’s App Tracking Transparency (ATT) and Identifier for Advertisers (IDFA), basically allowing it to serve ads without harvesting your personal data. The problem is the pervasiveness of ads. A banner lives at the top of the app at all times, and you’ll need to sit through a 30-second ad each time you connect or disconnect; a big problem when some servers post unreasonably slow speeds. I’ll admit EventVPN is a unique concept, but I see nothing better than ProtonVPN or Windscribe for a free VPN service. And when it comes to the inconvenience of sitting through ads, it’s straight-up worse.<\/p>\n IVPN<\/strong><\/a>: This privacy-focused VPN provider is similar to Mullvad. It does not ask you to create an account with a username, password, and email, but instead generates a random ID, which you use to log in. That helps preserve your anonymity, since that information can\u2019t be tied to your usage even if IVPN suffered a security incident. IVPN also accepts cryptocurrency payments (Bitcoin and Monero). Unlike Mullvad, IVPN offers one-year, two-year, and three-year plan options, as well as an unusual weekly option, which might be nice if you want a VPN while on vacation (IVPN standard is $2 per week). These can be more affordable than Mullvad\u2019s monthly fee. However, IVPN lacks some privacy features you will find with Mullvad, such as RAM-less servers. IVPN scheduled a security audit for 2025, but as of January 2026, the results have not been posted. IVPN also has a tight two-device limit on the Standard plan. The Pro plan raises that to seven, but the Pro plan\u2019s price is $10 per month, so it\u2019s more expensive than Mullvad, which has a five-device limit. That remains true even if you go with a multi-year IVPN plan. Still, IVPN is a fine alternative if you want annual plan options. And while most VPN apps serve their purpose, I do think IVPN\u2019s app is both more attractive and easier to use than Mullvad\u2019s. \u2014Matthew S. Smith<\/em><\/p>\n Private Internet Access (PIA)<\/strong><\/a>: With its long history in the VPN space, PIA has maintained a track record of defending user privacy\u2014even in the face of actual criminal activity. In 2016, a criminal complaint was filed in Florida against Preston Alexander McWaters for threats made online. McWaters was eventually convicted and sentenced to 42 months in prison<\/a>. Investigators traced the online threats back to PIA’s servers and subpoenaed the company. As the complaint reads<\/a>, \u201cA subpoena was sent to [Private Internet Access], and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States.\u201d According to the complaint, McWaters engaged in several other identifying activities, but PIA wasn’t among them. Despite such a clear view of a VPN provider upholding its no-logging policy, PIA didn’t impress me during my tests. It delivered the worst speeds out of any VPN I tested, with more than a 50 percent drop on the closest US server. (Windscribe, for context, only dropped 15.6 percent of my speed.)<\/p>\n MysteriumVPN<\/strong><\/a>: This is the go-to dVPN, or decentralized VPN, as far as I can tell. The concept of a decentralized VPN has existed for a while, but it’s really gained traction over the last couple of years. The idea is to have a network of residential IP addresses that make up the network, routing your traffic through normal IP addresses to get around the increasingly common block lists for VPN servers. Mysterium accomplishes this network with MystNodes. It’s a crypto node. People buy the node to earn crypto, and they’re put into the Mysterium network. It’s not inherently bad, but routing your traffic through a single residential IP is a little worrisome. Even without the decentralized kick, Mysterium was slow, and it doesn’t maintain any sort of privacy materials, be it a third-party audit, warranty canary, or transparency report.<\/p>\n PrivadoVPN<\/strong><\/a>: A popular option to recommend as a free VPN, offering a decent free service, with a handful of full-speed servers and 10 GB of data per month. You’ll have to suffer through four\u2014yes, four\u2014redirects begging you to pay for a subscription before signing up, but the free plan works. The problem is how new PrivadoVPN is. There’s no transparency report or audit available, and although the speeds are decent, they aren’t as good as Proton, Windscribe, or Surfshark. PrivadoVPN isn’t bad, but it’s hard to recommend when Proton and Windscribe exist with free plans that are equally as good.<\/p>\n You’ll find dozens of free VPNs all claiming to protect your privacy. Most of them don’t. There are plenty of VPNs I don\u2019t recommend, but these are a few I’ve tested that are worth mentioning.<\/p>\n Hola<\/strong><\/a> is an infamous name in the VPN industry, but it’s been close to a decade since its very public debacle. Hola is free, and it’s able to stay free because it uses a peer-to-peer network. Hola also owns Bright Data (formerly Luminati), which is a data collection company. In 2015, Hola sold access to the network of its free users (via Luminati), which was used in a distributed denial-of-service attack on 8chan. It’s been a decade since that incident, but Hola still operates in a similar way. If you don’t pay, you could be used as an exit node in Bright Data’s network, and the privacy policy makes it clear that Hola logs data about your usage, including your IP address, the pages you visit, and timestamps.<\/p>\n X-VPN<\/strong><\/a> is available on desktop, but it primarily shows up in results on the Apple App Store and Google Play, targeting mobile users with a free offering. X-VPN hasn’t done anything explicitly wrong like Hola, but it has way too many inconsistencies to recommend. For starters, it uses a proprietary VPN protocol, which it obfuscates within the app. Proprietary protocols like NordVPN’s NordLynx and ExpressVPN’s Lightway are based on existing, open-source protocols. Further, X-VPN was highlighted in a Tech Transparency Project report<\/a> about free VPNs with links to the Chinese government; X-VPN is based in Hong Kong. There’s no smoking gun with X-VPN, but there doesn’t need to be. The speeds aren’t the best, the app lacks basic features like split tunneling, and the pricing for a paid plan is in line with top providers.<\/p>\n Functionally, a VPN should do two things: keep your internet speed reasonably fast, and actually protect your browsing data. That’s where I focused my testing. Extra features, a comfy UI, and customization settings are great, but they don’t matter if the core service is broken.<\/p>\n Speed testing requires spot-checking, as the time of day, the network you’re connected to, and the specific VPN server you’re using can all influence speeds. Because of that, I always set a baseline speed on my unprotected connection directly before recording results, and I ran the test three times across both US and UK servers. With those baseline drops, I spot-checked at different times of the day over the course of a week to see if the speed decrease was similar.<\/p>\n Security is a bit more involved. For starters, I checked for DNS, WebRTC, and IP leaks every time I connected to a server using Browser Leaks. I also ran brief tests sniffing my connection with Wireshark<\/a> to ensure all of the packets being sent were secured with the VPN protocol in use.<\/p>\n On the privacy front, the top-recommended services included on this list have been independently audited, and they all maintain some sort of transparency report. In most cases, there’s a proper report, but in others, such as Windscribe, that transparency is exposed through legal proceedings.<\/p>\n Power up with unlimited access to<\/em> WIRED<\/a>.<\/em><\/strong> Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today<\/a>.<\/em><\/p>\n<\/div>\nVPNs to Avoid<\/h2>\n
How We Test VPNs<\/h2>\n