Reviews / VPN
VPN test results compared: kill switch failures, idle traffic and what apps leave behind
Our own measurements of every app we have tested, side by side: kill switch failures, leaks, idle traffic, and what stays on your PC after uninstall.
Tested and written by Alex. 4 apps tested · last run · Download the data (CSV)
What we found
- 3 of 3 VPN apps install with the kill switch turned off.
- 2 of 3 let our real IP address out when the VPN service crashed, in at least one kill switch mode.
- 1 of 2 tested so far leaked for several seconds after a Windows restart, with the kill switch on.
- 3 of 3 had no IP, DNS or WebRTC leak while connected. The failures happen when something breaks, not in normal use.
- 2 of 4 apps left something that matters after a normal uninstall, such as firewall rules or a private key.
The tables below are built from the test sheet of each review, so they change whenever we publish or rerun a test. Follow the app's name for the full review, the charts and the reasoning behind each result.
Kill switch: what happens when things break
We break the tunnel in several ways while a script asks "what is my IP?" a few times a second, and count every answer that shows our real address.
| App | Default after install | Network drops | VPN service crashes | App window killed | Windows restarts (kill switch on) |
|---|---|---|---|---|---|
| Proton VPN5.1.8 (free plan) | Watch outOff | PassedNo leak | Watch outStandard: Leaked ~9 s, twice. Advanced: No leak | PassedNo leak | Not tested yet |
| NordVPN8.14.4.0 (paid plan) | Watch outOff | PassedNo leak | PassedNo leak | PassedNo leak | PassedNo leak |
| Surfshark6.21 (Surfshark One, 1 month) | Watch outOff | PassedNo leak | Watch outOff: leaked ~5 s. On: no leak | PassedNo leak | Watch outLeaked ~8 s |
- Proton VPN · VPN service crashes: Standard: 19 and 17 requests left with our real IP before the app reconnected. Advanced: Internet stayed blocked; no automatic reconnect within 100 s. Full test
- Surfshark · VPN service crashes: Off: 10 requests with our real IP before the service restarted itself. On: blocked ~10 s, then reconnected. Full test
- Surfshark · Windows restarts (kill switch on): 14 of 368 requests returned our real IP before the tunnel came up; Windows services and Edge also got out. Full test
Leaks while connected
| App | IP | DNS | WebRTC (STUN) | Server locations |
|---|---|---|---|---|
| Proton VPN | PassedNone | PassedNone | PassedNone | PassedMatch the app |
| NordVPN | PassedNone | PassedNone | PassedNone | PassedMatch Nord's own list |
| Surfshark | PassedNone | PassedNone | PassedNone | PassedMatch the app |
While idle: memory and who the app talks to
Measured over 15 minutes with the app running and nothing else happening. Connections are logged with Windows firewall auditing.
| App | Memory | Outside connections in 15 min | Analytics and consent |
|---|---|---|---|
| Proton VPNVPN | ~550 MB RAM; 11 s CPU in 15 min | 1 call, to Proton AG (Switzerland)Logged with Windows firewall auditing. No third-party analytics or trackers. | No separate result; see the review |
| ZeroTier OneNetworking | ~40 MB RAM; 4 s CPU in 15 min | 101, all to ZeroTier infrastructureRoot servers in Los Angeles, Miami, Tokyo and Zürich plus one ZeroTier HTTPS service; no network joined | PassedNone |
| NordVPNVPN | ~990 MB RAM | 74, all to Nord or DNSNord API via CDN77, DNS-over-HTTPS to Cloudflare 1.1.1.1, Nord's DNS, 3 calls to applytics.nordvpn.com. No third-party trackers. | Watch outNo difference at idle74 connections and 3 calls to applytics.nordvpn.com in both 15-minute runs. Nord lists an always-on 'Essential' data category. |
| SurfsharkVPN | ~580 MB RAM | 10, all to Surfshark or DNSSurfshark's servers via CDN77 and DNS-over-HTTPS to Cloudflare; the VPN service made none. No trackers. | Watch outNever asked; crash reports onSettings → App settings → Send crash reports is on by default. The app bundles the Sentry error-reporting SDK. |
What each app installs, and what stays after uninstall
We snapshot the system before installing, after installing and after a normal uninstall through Windows Settings, and compare the three.
| App | Installs | Left behind after uninstall |
|---|---|---|
| Proton VPNVPN | 1 service, 1 firewall driver, 1 tunnel adapter, VC++ runtimeProtonVPN Service (manual start), ProtonVPNCallout driver, ProTUN adapter on connect. No startup tasks, no root certificates. | Wintun driver, empty folder and registry keyPlus the shared Visual C++ runtime |
| ZeroTier OneNetworking | 1 service, 1 virtual network driver, 5 firewall rulesService runs as SYSTEM and starts with Windows. Adapter and driver appear only when you join a network. No startup tasks or root certificates. | Watch outPrivate key, network config, driver, 2 allow-all firewall rulesPlus a copy of the API key in the user profile |
| NordVPNVPN | 3 services, 3 drivers, 2 network adapters, .NET 8 + VC++ runtimesnordvpn-service, Threat Protection service and NordUpdater, all running as SYSTEM from boot. NDivert packet driver, WireGuard, OpenVPN DCO. No startup tasks or root certificates. | WireGuard and OpenVPN DCO driversPlus the shared .NET 8 and Visual C++ runtimes. All Nord folders, settings, services and firewall rules removed. |
| SurfsharkVPN | 1 service, 2 drivers, 1 network adapterSurfshark Service (SYSTEM, starts with Windows), SharkDivert and OpenVPN DCO drivers, autostart entry for the app. A WireGuard service and adapter appear when you connect. No root certificates. | Watch outIPv6 block rules, dead startup entry, WireGuard driverThe antivirus, its drivers and the root certificate were removed. Internet came back within about a minute of the uninstaller finishing. |
How these numbers were produced
- Each app is installed on the same clean Windows 11 Pro virtual machine, restored from one snapshot, on an EU internet connection.
- Scripts log every result. "Watch out" marks a weak spot we would want to know about before buying; it is not a verdict on the whole product.
- Apps change. Each row shows the version we ran, and the review shows the date of the last run.
The full method is on How we test.
| App | Version tested | Last run |
|---|---|---|
| Proton VPN | 5.1.8 (free plan) | |
| ZeroTier One | 1.16.2 (free Personal plan) | |
| NordVPN | 8.14.4.0 (paid plan) | |
| Surfshark | 6.21 (Surfshark One, 1 month) |
Using this data
You may quote these figures and reuse the tables, in articles, videos or research, as long as you name software4pro and link to this page as the source. The complete results are in one CSV file.
Found a result that looks wrong, or work for one of these companies and want to respond? Write to hello@software4pro.com. We publish corrections and vendor replies in the review.