A virtual private network (VPN) service is a proxy server marketed to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against user profiling or MitM attacks on hostile networks.
A wide variety of entities provide VPN services for several purposes. Depending on the provider and the application, they do not always create a true private network. Instead, many providers simply provide an Internet proxy that uses VPN technologies such as OpenVPN or WireGuard. Commercial VPN services are often used by those wishing to disguise or obfuscate their physical location or IP address, typically as a means to evade Internet censorship or geo-blocking.
Providers often market VPN services as privacy-enhancing, citing security features, such as encryption, from the underlying VPN technology. However, when the transmitted content is not encrypted before entering the proxy, that content is visible at the receiving endpoint regardless of whether the VPN tunnel itself is encrypted for the inter-node transport. On the client side, configurations intended to use VPN services as proxies are not conventional VPN configurations. However, they do typically utilize the operating system's VPN interfaces to capture the user's data to send to the proxy. This includes virtual network adapters on computer OSes and specialized "VPN" interfaces on mobile operating systems. A less common alternative is to provide a SOCKS proxy interface.
In 2025, 1.75 billion people use VPNs. By 2027, this market is projected to grow to $76 billion. [1] Recommendation websites for VPNs tend to be affiliated with or even owned by VPN service providers, and VPN service providers often make misleading claims on their products. [2]
VPNs allow users to bypass regional restrictions by hiding their IP address from the destination server and simulating a connection from another country.
Where public Wi-Fi networks do not provide isolated encryption for each connected device, VPN services can provide a certain level of protection. When in use, potential eavesdroppers on the network can only observe that a connection to the VPN server is made by a user's device. [3] As of June 2025, however, approximately 98% of human-generated internet traffic was encrypted using TLS through the HTTPS protocol; [4] when TLS is used, network eavesdropping can only point out the IP addresses or hostnames a user is connecting to. Interception of network requests by a bad actor in the form of a Man-in-the-middle attack will most likely result in a certificate warning in being displayed in the user's browser. [5]
SSL stripping, the practice of downgrading a connection to unencrypted HTTP, [6] [7] doesn't always result in a browser warning,[ citation needed ] although this has been partly mitigated by the implementation of HTTP Strict Transport Security. [8] [9]
Activists and journalists working in restrictive or authoritarian regions often use VPNs to maintain anonymity and protect sensitive communications. VPNs mask IP addresses and encrypt data, ensuring safe access to information and secure communication channels.
Users are commonly exposed to misinformation on the VPN services market, which makes it difficult for them to discern fact from false claims in advertisements. [10] According to Consumer Reports, VPN service providers have poor privacy and security practices and also make hyperbolic claims. [11] The New York Times has advised users to reconsider whether a VPN service is worth their money. [12] VPN services are not sufficient for protection against browser fingerprinting. [13]
A VPN service is not in itself a means for good Internet privacy. The burden of trust is simply transferred from the ISP to the VPN service provider. [14] [15] The provider may log the user's traffic, although this depends on the individual company. Users can still be tracked through tracking cookies and device fingerprinting, even if the user's IP address is hidden.
In March 2018, the use of unapproved VPN services was banned in China, as they can be used to circumvent the Great Firewall. [16] Operators received prison sentences and were penalized with fines. [17] [18] [19] [20] Russia banned various VPN service providers in 2021. [21]
PC Magazine recommends that users consider choosing a provider based in a country with no data retention laws because that makes it easier for the service to keep a promise of no logging. [22] PC Magazine and TechRadar also suggest that users read the provider's logging policy before signing up for the service, [23] because some providers collect information about their customers' VPN usage. [24] [25]
Service | Leak Protection | Protocols | Obfuscation / Censorship Avoidance | Network Neutrality | Server | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
First-party DNS servers | IPv6 supported / blocked | Offers kill switch | Offers OpenVPN | Offers WireGuard | Supports multihop | Supports TCP port 443 | Supports Obfsproxy | Offers SOCKS | Linux support | Supports SSL tunnel | Supports SSH tunnel | Blocks SMTP (authent.) | Blocks P2P | Dedicated or virtual | Diskless | |
Avast SecureLine | Yes | Yes | Yes | Yes | No | No | No | No | Some [26] | Dedicated [27] | No | |||||
ExpressVPN | Yes [28] | Yes | Yes | Yes [28] | No | No | Yes [28] | Yes [29] | No [30] | Both [31] [32] | Yes | |||||
Hotspot Shield | No | No | Yes | No | No | No | No | ? | ||||||||
IPVanish | Yes [33] | Yes [34] | Yes | Yes [35] | Yes [36] | No | Yes [37] | Yes [38] | Yes [35] | Yes [39] | No | No | No [35] | No [35] | Dedicated | No |
IVPN | Yes [40] | No [41] | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes [42] | Yes [43] | No [44] | No [45] | Dedicated [46] | No | |
Mullvad | Yes [47] | Yes [47] | Yes | Yes [47] | Yes [48] | Yes; WireGuard [49] and SOCKS5 | Yes [47] | No [50] | Yes [51] [47] | Yes [52] | Yes | Yes [47] | No [47] | Yes [53] | Dedicated [54] | Yes [55] |
NordVPN | Yes [56] | No [57] | Yes | Yes [58] | Yes; NordLynx based on WireGuard [59] | Yes; OpenVPN [60] and SOCKS5 | Yes [61] | Yes [62] | Yes [63] | Yes | No [64] | Dedicated | Yes | |||
Private Internet Access | Yes [65] | Yes [66] | Yes | Yes [67] | Yes [68] | Yes [69] | Yes [70] | No | Yes [71] | Yes [72] | Some [a] | No [74] | Dedicated [75] | Yes [76] | ||
PrivadoVPN | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | ||||||||
ProtonVPN | Yes | No | Yes | Yes | Yes [77] | Yes | Yes | No | No | Yes [78] | Yes | Yes | Some [b] | Dedicated | ||
PureVPN | Yes | Yes | Yes | Yes [80] | No | No | Only through SSTP [81] | No | No | Yes [82] | No | Some [83] | Both [84] [32] | No | ||
Surfshark | Yes | No | Yes | Yes | Yes | Yes (WG, OVPN, IKEv2) | Yes | No | No | Yes | Some | No | Both | Yes | ||
TunnelBear | Yes [85] | Yes | Yes | Yes [86] [87] | No | No | No | Yes [88] [89] | Yes | Yes | No [90] | Some [91] | ||||
Windscribe | Yes | Yes | Yes | Yes | Yes [92] | Yes | Yes | No | No [93] | Yes (via Stealth protocol) | No | No | No | Dedicated [c] | Yes [95] | Yes |
Notes
Service | Data encryption | Handshake encryption | Data authentication | |||
---|---|---|---|---|---|---|
Default provided | Strongest provided | Weakest provided | Strongest provided | Weakest provided | Strongest provided | |
Avast SecureLine | AES-256 | |||||
ExpressVPN | AES-256 | CA-4096 | ||||
Hotspot Shield | AES-128 [96] | TLS 1.2 ECDHE PFS [96] | HMAC [97] | |||
IPVanish | AES-256 [98] | RSA-2048 [98] | SHA-256 [98] | |||
IVPN | AES-256 [40] | RSA-4096 [40] | ||||
Mullvad | AES-256 (GCM) [47] | ML-KEM [99] | RSA-4096 [47] | SHA-512 [47] | ||
NordVPN | AES-256 [100] | AES-256 (CBC) [100] | 2048-bit Diffie-Hellman [100] | |||
Private Internet Access | AES-128 (CBC) [101] | AES-256 [101] | ECC-256k1 [101] | RSA-4096 [101] | SHA-1 [101] | SHA-256 [101] |
PrivadoVPN | AES-256 | |||||
ProtonVPN | AES-256 | RSA-4096 | HMAC with SHA-384 | |||
PureVPN | AES-256 | |||||
SaferVPN | AES-256 [102] | 2048bit SSL/TLS [102] | SHA-256 [102] | |||
TunnelBear | AES-128 (CBC) [a] | AES-256 (CBC) [86] | 1548 bit Diffie–Hellman [b] | 4096 bit Diffie–Hellman [86] | SHA-1 [c] | SHA-256 [86] |
Surfshark | AES-256 | AES-256 (CBC) | 2048-bit Diffie–Hellman | |||
Windscribe | AES-256 [103] | RSA-4096 [103] | SHA-512 |
Notes
The following definitions clarify the meaning of some of the column headers in the comparison tables above.
We were looking for features, value, and clear and honest pricing. Free ways to learn more about a service - free plans, trial periods, refund periods - were important, and we also looked for companies which maintained your privacy when you signed up (no email address required, trials available without credit cards, Bitcoin available as a payment option).
We support peer-2-peer (P2P) networking in some of our server locations.
All of our VPN gateways run on dedicated hardware servers.
Our network is SSL-secured
Similar to PureVPN, ExpressVPN says it uses virtual servers in certain locations due to infrastructure issues.
No, but we are planning to add the support of IPv6 in 2018.
For OpenVPN TCP connections - port 443.
Yes, we do support Socks5 proxies as well as HTTP proxies (1 HTTP and Socks5 proxy at each of our VPN server destinations).
We use our own private DNS servers for your DNS queries while on the VPN.
IPv6 leak protection disables IPv6 traffic while on the VPN. This includes 6to4 and Teredo tunneled IPv6 traffic.
This is used in conjunction with the OpenVPN protocol [...]
Although quite different from a VPN, we provide a SOCKS5 Proxy with all accounts in the event users require this feature.
Any VPN provider that does not retain logs must block outgoing SMTP traffic due to rampant spam associated with usage of VPN services. With that said, we can whitelist (allow) any outgoing email server that a) require authentication, and b) is correctly setup so as not to be an open relay.
In addition, any blocked software by your ISP including P2P and other various software applications will be unblocked and unrestricted on our systems.
10 Multi-Logins per Household
Furthermore, we have blocked P2P on some of our servers as per changing Global Web Policy. We don't allow p2p/filesharing where it's illegal by law named United Kingdom (UK), United States (US), Canada, Australia etc.
PureVPN has never denied using virtual servers. To make matters simpler, an update on our Server Location page will state which servers are virtual and which are physical.
Every time you connect to TunnelBear, your DNS requests are directed to TunnelBear DNS servers, so your ISP can no longer see what websites you're visiting. And because we don't keep any records of your DNS, you're the only one that knows your browsing history.
When you turn GhostBear on, it changes your VPN traffic signature to look like a different kind of traffic. To do this, GhostBear uses a technology called Obfsproxy.
TunnelBear does not block SMTP on our network.
Turning Hotspot Shield on encrypts all of the traffic between your device and our servers using TLS 1.2 with perfect forward secrecy (ECDHE), 128-bit AES data encryption.
We encrypt all of the traffic between your device and our servers using TLS 1.2 with perfect forward secrecy (ECDHE), 128-bit AES data encryption, and HMAC message authentication.