How we test

We look at what an app does to your computer, not just what it promises. Scripts log every result, so each review can be repeated and checked.

The results for every app we have tested are side by side on VPN test results compared.

Before testing

• We buy a regular subscription at the public price. If a company offers us a free account, we say so in the review.
• We record the app version, operating system and test location. All of them appear in the test sheet at the top of each review.

What the app does to your computer

Most reviews check whether a VPN hides your traffic. We also check what the app itself does on your machine. Every product is installed on a fresh Windows 11 virtual machine, restored from the same clean snapshot, and scripts compare the system before installing, after installing and after uninstalling.

What it installs

Every service, driver, network adapter, scheduled task, startup entry and firewall rule the app adds, plus any root certificate it puts into Windows' trust store. A new root certificate lets software vouch for any website, so we always call it out.

What it costs while idle

Memory and CPU use with the app open and connected, and with it closed but still running in the background.

Who it talks to

For 15 minutes of idle time we log every outside server the app connects to and who owns it. We flag analytics, advertising and tracking services, and anything that is not the vendor's own infrastructure.

What it writes about you on your own disk

"No logs" usually refers to the provider's servers. We also search the app's own log and settings files on your computer for your real IP address, the servers you used, connection times and your account email, and check whether other users of the same computer can read them.

Does "don't share data" actually stop it

If the app has a setting to turn off analytics or crash reports, we log its network traffic with the setting on and again with it off, and report whether anything changed.

What it opens on your computer

Which network ports the app's service listens on, which Windows account it runs under, and whether your computer can still be seen on the local network (by ping or file sharing) while the VPN is connected.

What it leaves behind

After a normal uninstall we list every service, driver, adapter, file and setting that is still there.

Does it protect you

We record our connection without a VPN first and compare every result against it.

Leaks

With the VPN on, we check whether the real IP address, DNS requests or WebRTC traffic escape the tunnel, on at least three servers. A single leak is a fail.

Kill switch

We break the tunnel three ways: cutting the network, force-closing the VPN service, and forcing a reconnect. A script counts every request that reaches the internet outside the tunnel while it is down.

Everyday events

Lab-style failures are not the only risk. We also check what reaches the internet outside the tunnel when the computer restarts and you log in, when it wakes from sleep, when you switch Wi-Fi networks, and when you join a hotel-style Wi-Fi that asks you to sign in first.

Ad and malware blocking

If the app claims to block ads or malicious sites, we resolve a fixed list of known ad, tracker and malware domains and report how many are blocked.

Server locations

Many VPNs offer "virtual" locations: a server labelled with one country that sits in another. Ordinary IP databases often repeat whatever country the provider claims, so we don't rely on them. We cite independent measurements where they exist, such as IPinfo's 2026 study of 20 VPNs, and run a rough latency check of our own that catches obvious mismatches.

Why we don't publish speed tests

Speed depends mostly on the tester's own connection and location, so a single site's numbers say little about what you will get. We focus on things that behave the same on every computer.

Every product

• We count the third-party trackers on the provider's own pricing and checkout pages, and note what sign-up asks for: email, phone number, payment methods.
• Daily use for at least two weeks on the platforms the product supports.
• Privacy policy read in full, plus any independent audit, with the auditor and date named.
• Support contacted at least once with a real question.
• Where a money-back guarantee is offered, we request the refund and report whether and how fast it arrived.

Updates

We rerun the core tests when a product changes significantly, and at least once a year. The date of the last run is shown on every review.

What we don't do

• Publish a review before the tests are done.
• Let a company read or approve a review before it goes live.
• Rank products by commission. Some products we recommend have no affiliate program at all.