VPN

Category overview · ProPrivacyTime

A virtual private network does one structural thing: it routes your internet traffic through an encrypted tunnel to a server run by someone else, then out to the open web. The immediate effect is that the sites you visit see the VPN server's address instead of yours, and the network you are physically on — your home broadband, a hotel Wi-Fi, a campus — sees only scrambled traffic heading to that server.

The part that matters for a buying decision is not the encryption. It is the trust trade. A VPN does not make the internet stop knowing things about you; it moves the question of "who can see my traffic" from your local network and internet provider to the VPN operator. You are trading one party you already have a relationship with for a party you are about to pay. That trade can be worth making — but only if you have read what the new party actually says it does and does not keep.

This is why we read documents rather than run tests. Marketing copy tells you what a vendor wants the product to feel like; the logging policy, audit report, terms of service, and renewal fine print tell you what the product is. We treat the second set as the only reliable evidence, and we avoid first-person "we tested" claims because they turn opinion into false authority. For a working list of what to read and in what order, start with the guide below.

How we evaluate VPNs

Our coverage rests on four document-based criteria. None require running the software; all require reading what the vendor publishes.

• Logging policy specifics. We read the policy text, not the homepage badge. The useful distinction is between connection logs (timestamps, server used, data volume) and activity logs (what you did). A provider that says "no logs" while quietly retaining connection records is not lying in the letter but is misleading in the spirit — and the gap is visible only in the document.
• Audit scope. Third-party audits are real, but a seal on a landing page proves less than the audit's actual scope page does. We look at what systems were examined, on what dates, and whether the regions a customer would use were covered.
• Jurisdiction. Where a company is incorporated sets the outer boundary of what a court can compel. It is genuine and regularly oversold; we read it alongside the logging policy, since the policy is the stronger constraint on what data exists to hand over.
• Renewal and pricing fine print. The headline monthly price is almost always the first-term rate on the longest plan. We read the checkout terms for the renewal rate, the refund window, and its conditions, because the second year is where the real cost lives.

Common misconceptions

• "A VPN makes you anonymous." It does not. The operator sees your real address and can tie activity to your account. At best you are pseudonymous to the sites you visit, not unknown to the service you pay.
• "Military-grade encryption." The ciphers in use across the industry are public standards. The adjective is decoration, and it is a reliable marker of a marketing-first operation rather than a substantive claim.
• "Lifetime deals are a bargain." Infrastructure costs recur every month. A lifetime subscription is a bet on the company surviving, and the track record of such offers is poor. Read it as a continuity risk, not a discount.
• "Speed rankings are fact." Throughput varies by location, time of day, and protocol. Any ranking is a snapshot, not a property of the product. Use a provider's own refund window as your test instead of trusting a league table.

Where to start