How to choose a VPN: the six checks that matter

Every VPN homepage promises the same three things: strong encryption, a strict no-logs policy, and fast servers everywhere. None of that helps you choose, because no vendor admits to weak encryption or loose logging. The differences that matter sit in the fine print — renewal schedules, audit reports, refund terms — and each takes about two minutes to check.

Run these six checks, in order:

1. Renewal price. Find what the plan costs after the intro term, not on the banner.
2. Audit evidence. A named auditor, a recent date, and a scope that covers the no-logs claim.
3. Jurisdiction. Where the company answers legal demands — and why storage habits matter more.
4. Protocol. WireGuard or a modern equivalent, plus a kill switch and leak protection.
5. Device cap. Count your household’s screens; limits run from 5 to unlimited.
6. Refund terms. The window and its exclusions — your only honest test bench.

The first two disqualify more VPNs than any spec sheet. Once you have a shortlist, our full VPN rankings show how the eight providers we track come out on all six.

Check the renewal price, not the advertised one

The $2-a-month figure on the banner is an intro rate. Nearly every mainstream VPN bills a discounted lump sum for the first term, then renews far higher. NordVPN’s Basic 2-year deal shows the pattern: advertised at $3.49 a month, billed $94.23 for the first 27 months, then renewed at $139.08 a year — about $11.59 a month, more than triple the sticker price.

Advertised intro price vs the renewal bill (vendor pricing pages, 23 Jul 2026)

Provider	Advertised	First bill	Renews at
NordVPN	$3.49/mo (2-yr Basic)	$94.23 for 27 months	$139.08/yr (about $11.59/mo)
ExpressVPN	$3.19/mo (2-yr Basic)	$89.32 for 28 months	$99.95/yr
Surfshark	$2.49/mo (24-mo Starter)	$67.23 for 27 months	$79.00/yr
Proton VPN	$2.99/mo (2-yr Plus)	$71.76 for 24 months	$83.88/yr (about $6.99/mo)
CyberGhost	$2.19/mo (2-yr + 2 mo)	$56.94 for 26 months	$56.94/yr (about $4.75/mo)
Private Internet Access	$2.03/mo (3-yr + 3 mo)	about $79 for 39 months	$79 every 3 years
Windscribe	$5.75/mo (yearly)	$69 for 12 months	$69/yr — same as sign-up
Mullvad VPN	€5/mo flat (about $5.71)	same at any term length	€5/mo — unchanged since 2009

Two providers skip the game. Mullvad has charged a flat €5 a month at every term length since 2009. Windscribe advertises that the price you sign up at is the price you renew at. Surfshark earns a separate flag: its terms reserve the right to test different renewal prices on different customers, so the renewal figure you see is not guaranteed to be the one your neighbor sees. If price decides it for you, start with the best cheap VPNs.

Ask who audited the no-logs claim — and when

A no-logs policy is a marketing sentence until someone outside the company verifies it. All eight providers we track have commissioned independent audits, but the engagements differ in kind, and the kind matters.

Most recent independent audit per provider (vendor announcements, as of 23 Jul 2026)

Provider	Latest audit	What it covered
NordVPN	Deloitte, 2025	Sixth no-logs assurance engagement (ISAE 3000)
ExpressVPN	KPMG, 2025	Third no-logs assurance over TrustedServer and the privacy policy
Surfshark	Deloitte, 2025	Second no-logs policy assurance (ISAE 3000)
Proton VPN	Securitum, 2026	Fifth consecutive annual no-logs infrastructure audit
Mullvad VPN	Cure53, Jun 2024	Fourth infrastructure audit — a security review, not a no-logs attestation
CyberGhost	Deloitte Audit Romania, 2025	Third no-logs audit (ISAE 3000)
Private Internet Access	Deloitte Audit Romania, 2025	Third no-logs assurance review (ISAE 3000)
Windscribe	Packetlabs, Jun 2024	Privacy and security pen test of the server stack — no formal no-logs attestation

Require three things. A named auditor — “independently audited” with no name attached is worth nothing. A recent date — the older the audit, the less it says about today’s network. And the right scope: an ISAE 3000 assurance engagement tests the no-logs claim itself, while a penetration test probes the servers for weaknesses. Both are useful; they are not the same statement. Mullvad and Windscribe are respected services whose most recent engagements are the second kind — no-log VPN audits explained covers what each type proves. Check whether you can read the result, too: Proton VPN publishes its reports in full and CyberGhost offers its report for download, while NordVPN and Surfshark show theirs only to logged-in customers and ExpressVPN gates its KPMG report behind the auditor’s download terms.

Does jurisdiction matter as much as vendors say?

Less than the marketing suggests, but it is not nothing. NordVPN operates from Panama, which it says has no data-retention laws that apply to VPN providers. ExpressVPN is registered in the British Virgin Islands, which it calls a jurisdiction with strong privacy laws. Proton VPN is Swiss. Mullvad is Swedish, and its legal page states Sweden’s data-retention rules do not cover VPN providers. CyberGhost is Romanian — outside the 5, 9, and 14 Eyes intelligence alliances, per its no-logs page. On the other side, Private Internet Access is a US company under Colorado law and Windscribe is registered in Ontario, Canada — both countries are Five Eyes members.

The honest complication: what a provider stores matters more than where it sits. PIA, despite the US address, has had its no-logs policy audited three times (2022, 2024, 2025) and states that subpoenas have produced no user data. Proton VPN says its policy has held across more than 400 legal cases. A service that keeps nothing has nothing to hand over in any courtroom. One more reason to read the terms: Surfshark is a Dutch company whose terms of service are governed by British Virgin Islands law — the corporate address alone tells you little.

Require a modern protocol — then check your hardware

WireGuard is the current standard: small, fast, open source, and adopted across most of the market. NordVPN builds its NordLynx protocol on WireGuard and added post-quantum encryption in 2025. ExpressVPN defaults to Lightway, its own open-source protocol with post-quantum protection, and offers a customized WireGuard beside it. The trade-offs against the older OpenVPN are in WireGuard vs OpenVPN.

The hardware check comes first, though. Mullvad removed OpenVPN entirely on 15 Jan 2026, so router and third-party setups that depend on it no longer connect there. If you run a VPN on a router, confirm protocol support before paying. Whatever you pick, turn on the kill switch and DNS leak protection — the features that keep a dropped tunnel from exposing your real address.

Count your devices before you compare

Connection caps vary more than prices do. Mullvad allows 5 simultaneous devices and CyberGhost 7. NordVPN and Proton VPN allow 10, and ExpressVPN 10 to 14 depending on tier. Surfshark, Private Internet Access, and Windscribe set no limit at all. A household with two laptops, four phones, a tablet, and a smart TV exhausts a 5-device cap in one evening; a solo traveler never will. Count first, then shortlist.

Treat the refund window as your test bench

No published benchmark replaces trying a VPN on your own connection, your own ISP, and the servers you will actually use. That is what the money-back window is for — and the windows differ more than the ads imply.

CyberGhost runs the longest: 45 days on plans of six months or more, but only 14 days on the monthly plan. NordVPN, Surfshark, Proton VPN, and Private Internet Access give 30 days. ExpressVPN normally gives 30 days as well, but purchases made during its 11 Jul – 11 Aug 2026 sweepstakes promotion are excluded from the guarantee. Mullvad gives 14 days, and only on some payment methods — cash and cryptocurrency payments are not refundable. Windscribe is the strictest: 7 business days, less than 10 GB used, first payment only.

Two providers let you test without paying at all. Proton VPN’s free plan covers one device with no data cap on servers in 10 countries, and Windscribe’s free tier gives 10 GB a month with a confirmed email address. Neither asks for a card. Both sit alongside the other no-cost options in the best free VPNs.

Check the reviewer, not just the VPN

Peer-reviewed research presented at the ConPro workshop in 2022 (Ramesh et al.) found that VPN recommendation sites often use inconsistent criteria, carry affiliate incentives, and sometimes rank providers they are tied to. This site earns affiliate commissions too. The defense against that incentive — here or anywhere — is checkable sourcing: numbers that trace to a vendor’s own published page, like the sources listed below. A review site that will not show where its numbers come from has told you something useful about them.

Frequently asked questions

Frequently asked questions

What should I look for when choosing a VPN?

Six things, in order: the renewal price rather than the intro rate, an independent audit with a named auditor and a recent date, the legal jurisdiction, WireGuard or a comparable modern protocol, a device cap that covers your household, and refund terms generous enough to test the service yourself.

Should I use a free VPN?

Carefully. Servers cost money, and a free provider has to cover that somehow — often through its users. Two free tiers with honest published limits exist among the providers we track: Proton VPN covers one device with no data cap, and Windscribe gives 10 GB a month with a confirmed email. Neither requires a card.

Does a VPN slow down your internet?

Usually somewhat. A VPN encrypts your traffic and routes it through an extra server, and the overhead varies with the provider, the protocol, the distance to the server, and its load. The only measurement that matters is on your own connection — run a speed test during the refund window.

How many devices can I use with one VPN account?

It depends on the provider: Mullvad allows 5 simultaneous devices, CyberGhost 7, NordVPN and Proton VPN 10, and ExpressVPN 10 to 14 depending on plan. Surfshark, Private Internet Access, and Windscribe place no limit on simultaneous connections.

What encryption or protocol should a VPN use?

Look for the modern open standards: WireGuard, OpenVPN, or IKEv2/IPsec. In-house protocols built on or alongside them count too — NordVPN's NordLynx is WireGuard-based and ExpressVPN's Lightway is open source. Treat a proprietary, unpublished protocol with suspicion.

Can a VPN unblock streaming services?

Some can, none guarantees it, and results change over time. If streaming is the main job, confirm the exact service you need works during the money-back window rather than trusting a claim on a homepage.