We tested 12 VPNs against the same benchmarks — leak tests, audit history, speed on three continents, and the fine print that actually matters.
We picked the 12 VPNs with more than 1M verified users or a published independent audit, bought paid accounts with our own cards, and ran each through an identical test rig over three weeks.
IPv4, IPv6, DNS, WebRTC, and kill-switch failure tests on macOS, Windows, and Linux. Any leak = disqualified for the top three.
100 dnsleaktest queries with IPv6 forced on and off; no public resolver may appear in the results.
browserleaks.com/webrtc in Firefox + Chrome + Safari; only the VPN exit IP may be visible.
Disconnect VPN mid-download; packet capture must show zero clearnet traffic before reconnect.
Independent third-party audit within the last 24 months, published in full, covering server infrastructure and not just the app.
Full report published within the last 24 months. Older audits score proportionally lower.
Must cover backend + infrastructure, not just the desktop/mobile app layer.
Full report linked publicly, not a summary blog post or press release.
Median download over 30 iperf3 runs from three locations (Frankfurt, Ashburn, Singapore), measured against the same 1 Gbps baseline.
P50 download over 30 iperf3 runs per region against the 1 Gbps baseline.
Slowest of the three regions — penalises VPNs that are only fast in one continent.
P95 − P5 spread across the same runs. High variance means unstable routing.
Corporate parent, registered office, and any known data-sharing obligations. We disqualify VPNs whose ownership is not verifiable.
Renewal price, refund window, and whether the advertised price requires a 2-year commitment.
Netflix, Disney+, BBC iPlayer, and DAZN on at least three regions, tested weekly for four weeks.
Subger's editorial team tests subscription services end-to-end. We buy every account we test and never accept payment for coverage.
The closest thing to a 'just works' VPN if you don't need streaming.
Most reliable streaming unblocker we tested, with the caveat of aggressive renewal pricing.
The best free tier by a wide margin and a serious paid product.
Historically strong, but ownership changes mean we're waiting for the 2026 audit.
Good for large households, but merged with NordVPN's parent — effectively one company now.
Re-ran the full speed and leak suite against all 12 contenders. Mullvad, NordVPN, and Proton all held their rank. ExpressVPN dropped from 'recommended' to 'watch' pending a post-acquisition audit.
Sports streaming is now part of the unblocking score. NordVPN and Proton pass on EU servers; Mullvad and Surfshark do not.
CyberGhost shares a parent with ExpressVPN under Kape. We're keeping them off the shortlist until the 2026 transparency report lands.
| Service | We use renewal price, not the teaser rate. Many VPNs advertise a 2-year intro price that nearly doubles on renewal. | We only count third-party audits where the full report is published. Internal 'security reviews' don't count. | Where the company is legally registered. This matters for data-retention law but isn't the only privacy signal. | Median download over 30 iperf3 runs across Frankfurt, Ashburn, and Singapore against a 1 Gbps baseline. | Tested weekly for 4 weeks against Netflix, Disney+, BBC iPlayer, and DAZN. 'Full' = all four, 'Partial' = at least two. | Kill switchHard kill switch present and passing our failure test | Open sourceClient code published under an OSI-approved license |
|---|---|---|---|---|---|---|---|
Mullvad | 5 | 2025 | Sweden | 820 | Partial | Yes | Yes |
NordVPN | 8.29 | 2025 | Panama | 880 | Full | Yes | No |
Proton VPN | 4.99 | 2025 | Switzerland | 760 | Full | Yes | Yes |
ExpressVPN | 8.32 | 2024 | BVI | 810 | Full | Yes | No |
Surfshark | 2.49 | 2023 | Netherlands | 720 | Partial | Yes | No |
Prices are the lowest available monthly equivalent after any introductory discount has ended. Audit year is the year of the most recent full third-party report published by the vendor. Full methodology above.
NordVPN's NordLynx protocol had the highest median download (880 Mbps) in our test, narrowly ahead of Mullvad (820 Mbps). The top four are all within 15% of each other, so real-world difference is small unless you're on a gigabit connection.
Proton VPN Free is the only free tier we'd recommend. It's supported by paid Proton Mail revenue and has the same privacy policy as the paid plan. Every other 'free' VPN we tested either logged traffic, injected ads, or capped speeds below usability.
Only if you're trying to watch content licensed to a country you're not in. Most streaming services explicitly prohibit VPN use in their terms; account bans are rare but do happen. NordVPN and Proton unblocked every service we tried in this round.
A real no-logs claim is backed by (a) a published third-party audit that inspects server infrastructure, not just the app, and (b) a court case where the VPN was compelled to hand over data and could not. Mullvad and Proton both meet this bar.
Full benchmarks run quarterly. Between runs we re-check streaming unblocking weekly and update the table whenever a VPN publishes a new audit or changes ownership.
Total cost of ownership on each VPN's best public offer. Assumes you pay monthly after any promotional period expires and that the advertised renewal rate holds.
| Service | Total over 1 yr | Effective $/mo |
|---|---|---|
Surfshark 2-year intro at $2.49/mo, renews at $6.99/mo | $29.88 cheapest | $2.49 |
NordVPN 2-year intro at $3.09/mo, renews at $8.29/mo | $37.08 | $3.09 |
Proton VPN Same rate on renewal — no teaser pricing | $59.88 | $4.99 |
Mullvad Flat €5/mo, no intro discount to expire | $60.00 | $5.00 |
ExpressVPN 15-month intro then $12.95/mo | $80.04 | $6.67 |
Assumes list renewal pricing after any promotional period. Does not include taxes or currency conversion. Regional pricing may apply at checkout.
Minimum gates are pass/fail. A VPN that fails any gate is pushed below every VPN that passes all four, regardless of its raw speed score.
| Service | Audited ≤ 24 mo | No leaks in test | Ownership disclosed | Kill-switch recovery | Best-case /10 |
|---|---|---|---|---|---|
Mullvad Two audits in the past 24 months; anonymous account model by design. | 9.1 | ||||
Proton VPN | 8.6 | ||||
NordVPN | 8.2 | ||||
Surfshark Does not meet baseline Parent ownership clear since the Nord merger; last infra audit is older than 24 mo. | 7.0 | ||||
ExpressVPN Does not meet baseline Kape Technologies ownership was not disclosed in the original app store listings. | 6.4 |
Minimum gates are pass/fail. Services that fail any gate are not disqualified, but they are pushed below every service that passes all of them regardless of their best-case score.
Answer four quick questions and we'll point you at the VPN that best fits how you'll actually use it — not just the one that markets hardest.
Cheaper-and-faster is up and to the left. Surfshark wins on price but trails on throughput; NordVPN tops speed but pays for it on renewal price. Mullvad and Proton cluster in the practical sweet spot.
Long-form explainers on the concepts behind this pillar.
Every VPN claims to be no-logs. Almost none of them can prove it. Here's the three-part test we use to separate real privacy from marketing copy.
Read articleA kill switch is the difference between a dropped packet and a leaked IP. But not every implementation actually kills the connection when the tunnel dies.
Read articleNetflix, Disney+ and BBC iPlayer cat-and-mouse with VPN IPs weekly. Here's what our rolling 4-week test actually shows.
Read articleKPMG's 2024 audit covered only the desktop clients and the `lightway` protocol, not the full server infrastructure that Cure53 reviewed in 2022. Still a public audit, but the 'fully audited' marketing claim now outruns the actual scope.
Older Linux CLI versions (pre-3.17) could leak DNS to the system resolver when the kill switch was toggled mid-session. Fixed in 3.18 via systemd-resolved hook; users on the old package should update manually.
ExpressVPN, CyberGhost, Private Internet Access, and ZenMate are all owned by Kape Technologies, whose previous incarnation (Crossrider) was linked to adware. Kape has been transparent since the acquisition, but users picking 'multiple' VPNs from the top results often end up with one parent company. Not a bug in the product — a disclosure gap in how the category is usually presented.
The consumer VPN market consolidated hard between 2021 and 2024 — Kape Technologies rolled up ExpressVPN, CyberGhost, PIA, and ZenMate, while Nord Security absorbed Surfshark. The independent audited layer is now just Mullvad, Proton, IVPN, and Windscribe. That's the real shape of the market, and it's the shape our methodology is built to surface.
Subger has not been served with a National Security Letter, a FISA court order, or any gag order that would prevent us from saying so. We do not and have never hosted VPN infrastructure on behalf of any covered provider.
Every correction is logged publicly. Response within 10 business days.