VPN privacy ratings

Virtual private network services.

19 VPN providers are rated against 13 public criteria, and 19 have enough evidence for a letter grade. Our pick is Mullvad VPN. Of the 19 with a known jurisdiction, 9 are based in a Five Eyes country, and 12 in the wider Fourteen Eyes.

Criteria for this category · Suggest an addition · Markdown

VPN providers privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Transparency report	Tells users about requests	Audited no-logs policy	Anonymous payment	Open-source apps	Modern protocols	TLS configuration	Security headers	Modern web standards
Mullvad VPN Our pick Flat-priced VPN from Sweden. Accounts are a random number with no email, and payment in cash or Monero is accepted.	Grade B	79	100%	Sweden Fourteen Eyes	Partial	Yes	Yes	Yes	Partial	No	Partial	Yes	Yes	Yes	Yes	Yes	Not tested yet
Proton VPN VPN service from Proton in Switzerland with open-source apps on every platform and a free plan without ads.	Grade B	83	100%	Switzerland Outside Eyes	Partial	Partial	Yes	Yes	Yes	Partial	Yes	Yes	Yes	Yes	Yes	Partial	Not tested yet
Windscribe VPN service from Canada with a limited free plan, open-source apps and browser extensions, and WireGuard, IKEv2 and OpenVPN support.	Grade B	81	100%	Canada Five Eyes	Partial	Partial	Yes	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	Partial	Not tested yet
NymVPN VPN from Nym Technologies SA in Switzerland that runs on a decentralized network of independent nodes. It offers a fast two-hop WireGuard mode and an anonymous mode routed through the Nym mixnet.	Grade B	77	100%	Switzerland Outside Eyes	Yes	Partial	Yes	Yes	Partial	No	Partial	Yes	Yes	Yes	Yes	Partial	Not tested yet
IVPN VPN service from Gibraltar with random account IDs, no email at sign-up, cash and Monero payment, and open-source apps.	Grade B	75	100%	Gibraltar Outside Eyes	Partial	Partial	Yes	Yes	Yes	Yes	Partial	Yes	Yes	Yes	Partial	Partial	Not tested yet
Private Internet Access Commercial VPN service from Private Internet Access, Inc. in the United States, a subsidiary of Kape Technologies. The apps are open source and support WireGuard and OpenVPN.	Grade C	71	100%	United States Five Eyes	Partial	No	Yes	Yes	Yes	Partial	Yes	Partial	Yes	Yes	Yes	No	Not tested yet
RiseupVPN Free, donation-funded VPN run by the Riseup collective in the United States. It needs no account and uses the open-source LEAP VPN client with OpenVPN.	Grade C	70	100%	United States Five Eyes	Yes	Yes	Yes	No	Partial	No	Partial	Not applicable	Yes	Partial	Yes	Partial	Not tested yet
hide.me VPN service from eVenture Ltd. in Malaysia with a free plan that needs no sign-up and paid plans. Apps support WireGuard, OpenVPN, IKEv2 and SoftEther.	Grade C	67	100%	Malaysia Outside Eyes	Partial	No	Yes	Yes	Yes	No	Yes	Partial	Partial	Yes	Yes	Partial	Not tested yet
AirVPN VPN service run by Air di Paolo Brini in Italy. Accounts need no email address, and the open-source Eddie client supports WireGuard and OpenVPN.	Grade C	65	100%	Italy Fourteen Eyes	Partial	Yes	Yes	No	No	No	Partial	Yes	Yes	Yes	Yes	Partial	Not tested yet
Obscura VPN from Sovereign Engineering Inc. in the United States that sends WireGuard traffic over QUIC through its own relay to Mullvad exit servers, so neither party sees both the user and the traffic. Accounts are a random number.	Grade C	63	100%	United States Five Eyes	Partial	Yes	Yes	No	No	No	Partial	Yes	Yes	Yes	Yes	No	Not tested yet
Party VPN Pay-as-you-go VPN paid for only in cryptocurrency, including Monero. Supports WireGuard and AmneziaWG, and offers a REST API.	Grade C	63	100%	United States Five Eyes	No	Yes	Yes	No	Partial	Yes	Partial	Partial	Yes	Yes	Yes	Partial	Not tested yet
ExpressVPN Commercial VPN service run by Express Technologies Ltd. in the British Virgin Islands, a subsidiary of Kape Technologies. It uses its own open-source Lightway protocol.	Grade D	56	100%	British Virgin Islands Outside Eyes	No	No	Yes	Yes	Yes	No	Yes	Partial	No	Yes	Yes	Partial	Not tested yet
Mozilla VPN VPN service from Mozilla that runs on Mullvad's WireGuard server network. The apps are open source under MPL-2.0 and require a Mozilla account.	Grade D	56	100%	United States Five Eyes	Partial	No	Yes	Partial	Yes	Yes	Partial	No	Yes	Yes	Partial	Partial	Not tested yet
NordVPN Commercial VPN service from Nord Security, operated by a company in Panama. Apps use the WireGuard-based NordLynx protocol, OpenVPN or the NordWhisper protocol.	Grade D	56	100%	Panama Outside Eyes	Partial	No	Yes	Partial	Yes	No	Partial	Partial	Partial	Yes	Yes	Partial	Not tested yet
CyberGhost VPN Commercial VPN service from CyberGhost S.R.L. in Romania, a subsidiary of Kape Technologies. Apps support WireGuard, OpenVPN and IKEv2.	Grade D	50	100%	Romania Outside Eyes	No	No	Yes	Yes	Yes	No	Yes	Partial	No	Yes	Partial	No	Not tested yet
Azire WireGuard VPN service founded in Stockholm and owned by Malwarebytes, running on servers it owns and operates.	Grade D	48	100%	United States Five Eyes	No	No	Yes	Yes	Yes	No	Yes	No	No	Yes	Partial	Partial	Not tested yet
Surfshark Commercial VPN service from Surfshark B.V. in the Netherlands. Apps support WireGuard, OpenVPN and IKEv2.	Grade D	48	100%	Netherlands Nine Eyes	No	No	Yes	Yes	Yes	No	Partial	Partial	No	Yes	Yes	No	Not tested yet
OVPN VPN service founded in Sweden, now run by OVPN Inc., with WireGuard and OpenVPN on diskless servers, optional ad blocking, and monthly transparency reports.	Grade D	42	100%	United States Five Eyes	No	No	Yes	No	Yes	No	Partial	Partial	No	Yes	Yes	Partial	Not tested yet
TunnelBear VPN service from TunnelBear, based in Canada, with a free plan limited by data and paid unlimited plans. Apps support WireGuard, OpenVPN and IKEv2.	Grade D	42	100%	Canada Five Eyes	No	No	Yes	Yes	Partial	No	Partial	No	No	Yes	Yes	Partial	Not tested yet

Questions

What is the most private option among VPN providers?

Our pick is Mullvad VPN. No email, no name and no card needed. A stable, flat price, WireGuard on every platform, fully open-source apps, and repeated public audits of both the apps and the server infrastructure.

How are VPN providers rated?

Each entry answers 13 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers, modern web standards, audited no-logs policy, anonymous payment, open-source apps and modern protocols. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.