How we test VPNs

VPN customers have an unbelievable quantity of selection out there, however plenty of these selections are dangerous. Upwards of 180 digital non-public networks can be found for business customers alone. For the informal person who simply desires a VPN to guard themselves on-line or change their digital location, the chance of research paralysis may be very actual.

It does not assist that VPN suppliers like to make deceptive claims about their very own product. Learn a number of of their homepages and you will begin to see some phrases repeat. “Lightning-fast.” “Financial institution-grade encryption.” “Zero-logs coverage.” It is designed to sound good with out that means a lot, and sadly, even the perfect suppliers love to speak like this.

Our group at Engadget began digging into the VPN world that can assist you reduce by all this litter and decide the supplier you really need and wish. We have developed a rigorous testing course of that mixes investigative journalism, goal testing and qualitative assessment. This text explains how we analysis and check a VPN.

Replace, Could 28, 2025: This story has been fully overhauled to mirror the up to date 2025 Engadget VPN testing methodology.

Desk of contents

Our course of at a look

Verify the desk for a fast illustration of our VPN testing course of.

VPN testing: Our 11 steps

A fast observe earlier than we begin — every time we are saying “VPN” on this article, we’re referring to a business VPN, the sort any particular person can obtain and use. Company VPNs like Cisco Safe Consumer and Perimeter81 require a special testing course of.

1. Set up and configure the VPN on a number of platforms

Probably the most work you will possible must do with a VPN comes once you obtain and set up it. We run by that course of on as many alternative platforms as attainable. Once we cannot hit all of them, we attempt to get a minimum of one in every class — desktop, cellular, good TV and browser — plus the “massive 4” of Home windows, Mac, iOS and Android.

We take cautious notes on the entire course of, making an attempt to suppose from the angle of somebody who has by no means used a VPN earlier than. How straightforward is it to seek out the set up file? How do you log out and in? Are there quality-of-life options, like a programmable auto-connect to avoid wasting work the following time you open the VPN app?

After putting in every VPN, we run by the essential duties of connecting, disconnecting and altering server areas. If these go easily, 90 p.c of customers will face only a few issues with the interface. However, any hiccups on the essential connection course of bode poorly for the operability of the VPN’s extra superior options.

2. Take a look at speeds

We take it without any consideration {that a} VPN will scale back your looking speeds. Besides in sure uncommon circumstances the place your ISP has severely misconfigured your native pathways, it isn’t attainable for a VPN to offer you quicker speeds than your regular web service. Meaning the “quickest VPN” is the one which drags down your regular speeds as little as attainable.

We use Ookla’s velocity testing software program to verify every VPN’s servers in three classes. Obtain velocity describes how a lot information can transfer from an internet server to your system in a single second; this determines how shortly net pages load and when streaming movies must buffer. Add velocity is identical in reverse, and issues most for torrenting, social media sharing and outbound communication out of your laptop.

The third metric is latency, measured by the size of a “ping” — the time in milliseconds {that a} single information packet takes to journey between your system and the net. Latency, which is extremely depending on distance, is necessary for something that occurs on-line in actual time, like gaming or video chat.

All three velocity stats can fluctuate as particular person server masses change. To get a transparent image of efficiency throughout the whole community, we decide six server areas for every VPN, together with the one the app designates because the quickest. We then check every location thrice throughout two days, averaging every consequence to get a closing rating.

3. Take a look at safety

A VPN’s most necessary job is to maintain your actual IP tackle hidden. If it may well’t try this, we will not suggest it. The best method we check a VPN’s safety is by checking our IP tackle whereas related. If the VPN server is hermetic, any IP lookup software ought to present the server’s tackle, not our dwelling community.

IP leaks — by which your private home IP tackle is seen even whilst you’re related by a VPN — are most frequently attributable to VPNs utilizing public DNS servers that make your requests seen to your web supplier. The perpetrator may also be a misconfiguration in real-time communication protocols (WebRTC) or a failure to correctly incorporate IPv6 visitors.

We additionally verify for weak, outdated VPN protocols like PPTP, or untested proprietary protocols with no accessible supply code. We end this step by testing the VPN’s encryption by analyzing a number of information packets utilizing Wireshark.

4. Have a look at pricing and offers

Subsequent, we see how a lot the VPN prices. We learn the fantastic print on multi-year offers to see if marketed financial savings cease after the primary billing interval; when VPNs supply “bonus months” for brand new sign-ups, it is common for costs to go up later. We additionally consider any free plans, momentary free trials or money-back ensures — paying particular consideration to the refunds, as VPNs sometimes refuse to honor their said insurance policies.

We shut out by seeing if there are any particular pricing reductions or coupons which will make the VPN extra inexpensive. In the end, we attempt to make a name about whether or not the VPN offers the person sufficient worth to justify its worth.

5. Try pricing bundles

Lots of the prime VPNs are increasing their choices into bigger bundles, like NordVPN Full, Surfshark One, or ExpressVPN‘s Identification Guard suite. This may additionally occur from the opposite course, as firms like Norton and Proton add VPNs to their current product strains.

VPN bundles virtually at all times come at an extra subscription value, which they often earn with added worth — and typically do not. At any time when we assessment a VPN, we take a look at the merchandise related to it and advise you on whether or not or to not heed the VPN’s inevitable calls to improve.

6. Shut-read the privateness coverage

The following step is to sit down down with the VPN’s privateness coverage and skim it like a lawyer would. A VPN privateness coverage is technically legally binding, in that the supplier could be sued for false promoting in the event that they violate it. As an alternative of mendacity outright, the less-trustworthy VPNs reduce their danger by hiding controversial practices behind obscure language and loopholes.

For example, a VPN may declare on its homepage to have a “zero-logs coverage,” but it surely’s unimaginable to offer VPN service with out protecting a minimum of some logs. The sincere suppliers lay out precisely what information they preserve, how they anonymize it and what they do with it. Crimson flags embody saving your information for longer than crucial, logging exercise for non-security functions like advertising, or claiming that the privateness coverage doesn’t apply to companions or mother or father firms.

7. Verify the VPN’s capacity to vary geolocation

When a VPN modifications your digital location, it wants to take action in a method vacation spot servers cannot see by. The websites you’d need to change your location for, like Netflix, YouTube and sports activities streams, block content material in areas the place they do not have a licensing settlement to stream it (that is why Netflix libraries change in each nation). These websites know VPNs can circumvent their blocks, in order that they ban VPN entry every time they detect it.

The perfect VPNs struggle again by updating their server IP addresses shortly sufficient that streaming platforms cannot block them. We check a VPN’s unblocking capacity by connecting to a number of streaming web sites — every in a number of totally different international locations — and in search of proxy errors. We verify to see if content material is accessible and whether or not speeds stay quick sufficient to view it.

8. Examine the server community

A VPN’s “server community” is the choice of IP addresses it lets customers hook up with. Giant server networks are a typical promoting level for VPNs, which argue that extra servers means higher efficiency and extra areas means extra choices to avoid blocks.

Whereas it is true {that a} bigger community is an effective signal, it is simple to artificially inflate the numbers. For one factor, a VPN supplier can arrange digital servers with IPs from areas the place it is not bodily current. That is useful for getting areas in international locations like China and India that ban most VPNs, however means you possibly can’t at all times belief {that a} server which seems to be near you really is.

It is also frequent for suppliers to hire server house from third-party information facilities to get extra areas out sooner. Whereas handy, this provides extra potential failure factors, for the reason that information middle operators might not comply with the VPN’s safety requirements (that is how NordVPN was briefly compromised in 2018).

When reviewing a VPN, we examine not simply the amount of its server community, but in addition its high quality. If it does not disclose which servers are digital and/or rented, we verify the IP addresses of suspicious areas and analysis whether or not the VPN has labored with information middle suppliers.

Most VPNs embody options past the core capacity to connect with a server. These extras vary from important safety measures like kill switches (which reduce you off from the web in the event you aren’t related to a VPN server) to tangential nice-to-haves like advert and malware blockers (which frequently work properly however cannot exchange a chosen antivirus).

We check two issues: whether or not these options work and whether or not they’re straightforward for learners to make use of. The previous relies on the characteristic — for instance, for an ad-blocker, we’ll see if it blocks various kinds of adverts. The latter is qualitative and relies on the place the characteristic is discovered within the VPN app, how properly it explains itself and what customization choices exist.

10. Use the customer support choices

No VPN consumer is so properly designed that you’re going to by no means need assistance. Good buyer assist begins with an up-to-date information base written in clear English by a human writer, with logical group and loads of screenshots. An energetic person neighborhood is a bonus, whether or not hosted on the VPN web site or some place else (usually Reddit).

Most VPNs produce other tech assist choices, usually dwell chat and/or e-mail tickets. We check each by submitting a easy query. With dwell chat, we decide whether or not it is attainable to speak with a human and the way lengthy it takes to succeed in that time. With e-mail, we measure how lengthy it takes to get a reply from the consultants and the way helpful it’s for fixing the issue.

11. Examine the VPN’s background

Step one is to seek out out precisely who we’re coping with. We comb by the VPN’s historical past since its launch, in search of any safety breaches, violations of its personal privateness coverage or any makes an attempt to drag the wool over the shoppers’ eyes. Information archives are the perfect supply, however we additionally incorporate educational analysis by safety investigators and printed third-party audits of the VPNs themselves.

Once we discover black marks on a VPN’s report, we attempt to place them in context. A previous safety breach does not essentially disqualify a VPN from our suggestion — many of the finest choices have slipped up a minimum of as soon as. The perfect proof comes from how the supplier responded to the incident. Did they modify something or double down? Did their restoration produce lasting enhancements, or did the identical downside occur once more a 12 months later?

Privateness violations are rather more severe. A VPN that breaks its settlement to not log data on its customers can’t be trusted to maintain its phrase sooner or later with out proof of drastic inside change. One other main purple flag is an absence of transparency, like when it is unclear the place a VPN is predicated or who owns it.

Get began with our VPN opinions

Reviewing a VPN is a matter of affected person investigation, rigorous testing and an unwillingness to take something at face worth. We’re continually refining our course of, so we’ll make certain to replace this web page every time we alter any of the steps above.

Now that you just perceive our course of, you are able to dive into our protection of the best VPN services (quickly to get an intensive replace), or head straight to our in-depth ExpressVPN review to see the method in motion.