However, while a VPN will keep you safe at your local coffee shop, it comes with a cost. Using a VPN means your VPN provider will know everything about your browsing habits. This makes VPN providers a target for hackers. Be sure you even need one before you read on. Picking the right VPN service is serious business. Most VPN providers say they keep no logs of their users’ activity, but this is rarely verified. You’re stuck taking companies at their word. For this reason, we’ve limited our testing to VPN providers that have been independently audited by security firms and have published the results. To help you sort out when and why you might want a VPN, as well as why you might not, be sure to read through our complete guide to VPNs below. If you’re sure you want to use a VPN, here are our top picks among commercial VPN providers. Updated February 2023: We’ve included some updated speed test results, added some thoughts on Google’s new VPN, and noted that Surfshark’s no-logs policy has been independently verified. Special offer for Gear readers: Get a 1-year subscription to WIRED for $5 ($25 off). This includes unlimited access to WIRED.com and our print magazine (if you’d like). Subscriptions help fund the work we do every day. Surfshark wouldn’t be my top pick if my life depended on my VPN, but for most of us that’s not the case. If you just want a way to get around some geographical restrictions on content (aka access Netflix) and protect your traffic while using an open Wi-Fi hot spot, Surfshark is a good choice. It’s secure, and it provides a great value for the money if you pay for two years up front. Surfshark offers a kill switch that automatically stops your traffic if your VPN connection fails, and it supports multihop VPN connects, which means your traffic goes from your machine to a VPN server to another VPN server, and then to the destination server. This provides an extra layer of protection should the VPN itself be compromised, though there is a corresponding speed hit when using a multihop connection. The company also recently added support for manual Wireguard configuration. Most people will be fine sticking with Surfshark’s apps, but if you’re trying to connect your entire network to Surfshark directly through a router, the manual configuration will be welcome news. Surfshark is based in the British Virgin Islands, which, although technically a territory of Great Britain, is generally considered a safe haven and has no data-retention laws. What I don’t like is that Surfshark is legally untested. The company has a zero-log policy, and you can (and should) opt out of the diagnostic crash reports in the app. The company’s browser extensions have undergone an independent security audit that didn’t turn up any significant problems, and in January 2023, the auditing firm Deloitte verified Surfshark’s no-logs statement. Surfshark recently merged with NordVPN. So far we have not noticed any changes for its customers, but we will be keeping an eye on it going forward. Surfshark costs $2.50 per month if you buy two years up front and $4 per month if you buy one year up front. Mullvad is based in Sweden and first came to my attention because of its early support for WireGuard, a faster protocol for tunneling VPN traffic. Another thing I like is Mullvad’s system for accepting cash payments. If you prefer to remain totally anonymous, you can generate a random account number, write that number down on a slip of paper, and mail it, along with cash, to Sweden. In theory, no one will be able to connect you to that account. (The truly paranoid will don a tinfoil hat, wear gloves, print from a public printer, and mail from a remote mailbox.) I have not tested the cash option, but I did recently extend my Mullvad subscription using bitcoin and it worked without a hitch. Part of what I like about Mullvad is its down-to-earth approach that doesn’t overhype with its marketing and helps users take additional steps to protect their privacy. For example, the company has an entire page showing you how to disable WebRTC in your web browser. As long as WebRTC is enabled (and it is by default in most browsers), websites can view your actual IP address even when you use a VPN. Mullvad offers apps for every major platform, as well as routers. The applications are all open source, and you can check the code yourself on GitHub. The service has been independently audited as well. Advanced users can download configuration files and use them directly with OpenVPN or Wireguard. In my testing, speeds were very good. I never encountered a situation where I couldn’t get a fast connection. Over the years Mullvad has become the VPN I rely on day-to-day. Mullvad VPN costs 5 euros (around $6) per month, cash or charge. Choosing a VPN can be overwhelming. If you’re tired of security mumbo jumbo and lock icons, TunnelBear might be the VPN for you. Its cute bear animations help demystify what VPNs do, how they work, and what they can offer you. Sometimes the easiest way to make technology more approachable is to put a friendly face on it. Don’t worry though, TunnelBear isn’t all cute bear animations. It has the same security features as other VPN providers, like a no-logging policy and a clear privacy policy, and it’s been independently audited. TunnelBear costs $3.33 per month if you buy one year up front. NordVPN is one of the most popular VPNs around, thanks to a wide selection of servers and reasonable prices. It’s also one of the most reliable ways I’ve found to circumvent location-based restrictions. I used it extensively while living in Mexico to get around Netflix’s geographic restrictions. That said, this is a cat-and-mouse game; Netflix is always updating its server ban list, so NordVPN might not work in the future. NordVPN is based out of Panama, which is not part of the Five Eyes, Nine Eyes, or 14 Eyes jurisdictions. That doesn’t mean your government can’t spy on you, but it does at least mean it will have to put in some extra legwork to do it (yes, that’s about where we are these days). NordVPN has been audited a number of times, most recently by Deloitte (like Surfshark) which found nothing amiss. As noted above, NordVPN and Surfshark recently announced a merger. Both will continue to operate as separate entities, but they are now a single company. NordVPN also recently added a new service dubbed Threat Protection, which will block web-based trackers, phishing attempts, some ads, and malicious websites. I have not tested it extensively, and I personally rely on browser-based plug-ins to block threats like this. But if you’re looking for an all-in-one solution, this might work. It may block some things, so if you’re having trouble connecting, disable it. I’ve never had an issue with speed using NordVPN, and the user interface of its apps is dead simple. Just click the country you want to use and the app will take care of connecting and configuring everything for you. If you want manual control, you can connect by using NordVPN’s configuration files. NordVPN costs $5 per month if you buy one year up front. It also has frequent sales on a two-year deal that works out to about $3 a month. If you’re in a situation where personal security is of the utmost importance, do not rely on a VPN. Use Tor (ideally through Tails) instead. Using the Tor network accomplishes some of the same things as a VPN, but it’s a little bit different. Tor provides anonymity, meaning no one can figure out who you are, but not necessarily privacy. People still might be able to see what you’re doing, they just won’t know it’s you doing it. (VPNs provide privacy because no one can see what you’re doing while you’re going out of a VPN tunnel, but you don’t have anonymity because the VPN provider knows who you are.) WIRED Readers have repeatedly asked about Google’s VPN, which is now a standard part of Google One. Basically, as long as you aren’t put in danger by whatever you’re doing over a VPN, then Google One is probably fine. It’s a traditional VPN, and judging from the white paper Google released about it, it isn’t tied to your Google Account. In other words, it’s better than browsing in the clear over the coffee shop network. That said, let us not forget that Google has repeatedly been caught collecting data it said it wasn’t, and that it took a massive antitrust lawsuit by the US government just to get Chrome to block third-party cookies (among others). That’s not to say Google’s VPN is logging your data, just that we don’t know for sure, you don’t know for sure, and Google’s track record isn’t the best. When it comes to speed, my limited experience with Google VPN has been that it’s just above average, on par with those of NordVPN and Mullvad but generally behind Surfshark’s. All of that is to say, I do not recommend VPN by Google One. If your VPN needs are minimal, you’ll probably be fine, but most people will be better served by using a dedicated VPN from one of the providers recommended above. VPN providers like to claim they keep no logs, which means they know nothing about what you do using their services. There are a variety of reasons to be skeptical about this claim, namely because they have to have a user ID of some kind tied to a payment method, which means the potential exists to link your credit card number (and thus your identity) to your browsing activity. For that reason, I mainly limited my testing to providers that have been subpoenaed for user data in the US or Europe and failed to produce the logs or have at least undergone a third-party security audit. While these criteria can’t guarantee the providers aren’t saving log data, this method of selection gives us a starting point for filtering through the hundreds of VPN providers. Unfortunately, other factors also come into play. VPNs that once made our list—Like ExpressVPN—are sometimes sold to less reputable companies. In cases like ExpressVPN, I chose to remove it mainly because I have no way to know if it remains trustworthy or not. It’s important to understand not just what a VPN can do, but also what it can’t do. As noted above, VPNs act like a protective tunnel. A VPN shields you from people trying to snoop on your traffic while it’s in transit between your computer and the website you’re browsing or the service you’re using. Public networks that anyone can join—even if they have to use a password to connect—are easy hunting grounds for attackers who want to see your network data. If your data is being sent unencrypted—like if the website you’re connecting to doesn’t use the secure HTTPS method—the amount of information an attacker can gather from you can be disastrous. Web browsers make it easy to tell when your connection is secure. Just look for a green lock icon at the top of your screen next to the web address. These days, most websites connect using HTTPS, so you’re probably fine. But if that green lock icon isn’t there, as it sometimes isn’t on school, library, and small business websites, anyone can view whatever data you’re sending. Unless you’re using a VPN, which hides all of your activity, even on unencrypted websites. Just connecting to a VPN isn’t enough. Be sure to check out our guide to using a VPN to make sure you have everything set up correctly. A VPN also changes your IP address, which adds an additional layer of protection. By giving you a different IP address, a VPN can make it appear as though you’re in a different physical location. So even if you’re sitting in California, the website you’re accessing will think you’re in Canada, Hungary, Uruguay, or Thailand. Unfortunately, this method of obscuring your location is not airtight. Technology built into web browsers that’s known as WebRTC can leak your true IP address even when you’re using a VPN. If this is a concern, disable WebRTC in your browser before connecting to a VPN. Mullvad has instructions on how to disable WebRTC in most browsers. It’s debatable how much masking your IP address really helps protect your privacy in the first place. Your IP address is only one of many, many bits of data websites collect about you. If privacy is your concern, you’re better off using web browsers (and extensions) that offer additional tools to protect your privacy. Mozilla Firefox has several of these tools available. Or if you want to get serious about it, use the ultra-private Tor browser as noted above. To add to the confusion around VPNs, providers—even some I’ve recommended here, unfortunately—often engage in misleading marketing. Nearly every VPN service website I visited had some kind of red banner claiming I was “not protected,” even when I was using a VPN at the time. The problem is that I wasn’t using their VPN. More honest VPN providers, like Mullvad, tell you what’s actually happening: “You’re not protected by Mullvad.” Kudos to Mullvad for not using fear to sell subscriptions. Either way, the important thing to remember is that using a VPN does not make you anonymous. While VPNs may not be able to do much to protect your privacy, they are an essential tool when it comes to protecting you from snoops trying to gather your unencrypted data sent over insecure networks.
