How we score VPNs starts with evidence you can inspect. We use separate published formulas for commercial VPNs and for mesh and self-hosted tools, because they serve different needs. We assess documented capabilities, audit evidence, ownership and cost against the relevant criteria. Code calculates the scores without access to commission data. We explain the evidence behind each assessment and show when we checked it, so you can judge its relevance to your needs.
| Criterion | What it measures | Weight |
|---|---|---|
| Logging evidence | Newest audit: kind, age, public or gated | 25% |
| Ownership & transparency | Owner disclosed, review sites, transparency, incidents | 15% |
| Security engineering | WireGuard, RAM-only, open-source apps, post-quantum | 15% |
| True price | 3-year cost with renewal; undisclosed renewal costs points | 15% |
| Technical features | Kill switch, split tunnelling, port forwarding, config export | 15% |
| Network | Countries and owned servers (provider-reported) | 10% |
| Account & payment privacy | No-email sign-up, cash, Monero | 5% |
We assess the most recent independent audit relevant to logging. An assurance engagement specifically examining no-logs claims carries the most weight, followed by an infrastructure audit, then an app audit. Recent evidence receives full credit, which fades to nothing as it ages. Public reports score better than gated reports; no audit earns no credit.
We assess whether the parent company and leadership are named, whether the group also owns VPN review sites, and whether it publishes transparency reports. Review-site ownership carries a penalty. We also consider how long past incidents took to disclose, because accountability depends on knowing who runs a service and how openly they respond.
We score documented security engineering: WireGuard support, RAM-only servers, open-source apps, a post-quantum option, a recent security audit and an independently audited proprietary protocol. Full-disk encryption earns slightly less credit than RAM-only servers. These measures show how a provider protects its systems and exposes its engineering to outside scrutiny.
We compare the cheapest total cost across a shared comparison period, using the actual commitment required to obtain the advertised price. We apply introductory pricing only for its eligible term, then account for renewal pricing. An unstated renewal price costs points because it prevents readers from assessing the ongoing expense.
We score practical capabilities: a kill switch, split tunnelling, multi-hop, port forwarding, support for the current Internet Protocol, WireGuard configuration export, a SOCKS proxy, custom DNS, a Linux app and command line, and a dedicated IP option. These features affect connection control, compatibility and how easily a service fits your setup.
We assess how many countries a provider reports covering, whether it owns its servers and whether it identifies virtual locations. These details help explain the network's reach and who controls its infrastructure. Coverage and server counts are provider-reported; we do not test or independently verify them.
We assess whether you can register without email, log in with an account number and pay using cash, Monero or Bitcoin. These options affect how much identifying information you need to provide when opening and funding an account. They do not establish anonymity or prove anything about connection logging.
| Criterion | What it measures | Weight |
|---|---|---|
| Openness & self-hosting | Open control server, open licence, self-hosting | 20% |
| Security model | SSO, access rules, key rotation, audit | 20% |
| NAT traversal & relays | Direct connections behind routers, relays | 15% |
| True cost | Free self-hosting or the per-user price | 15% |
| Platform coverage | Linux, desktop, mobile, containers, routers | 10% |
| Exit nodes & privacy VPN | Exit nodes and a privacy VPN add-on | 5% |
| Project health | Recent code changes and adoption | 15% |
For mesh tools, we assess whether the control server is open source, whether the client uses an open-source licence and whether you can host the system yourself. These choices affect your ability to inspect the software, operate it independently and keep control of the infrastructure connecting your machines.
For mesh tools, we assess support for signing in through a shared identity provider, access rules, key rotation and a published security audit. These controls help determine who can join your network, which resources they can reach and how credentials are maintained. An audit adds outside scrutiny to the documented design.
For mesh tools, we assess whether devices can establish direct connections across home routers and carrier networks, and whether relays are available when direct connections fail. This matters because machines often sit behind networks you cannot configure. Relay support provides another connection path when those restrictions prevent direct contact.
For mesh tools, free self-hosting or a usable free tier earns full credit. Otherwise, we score the monthly price per user against a fixed scale. This makes the pricing assessment consistent and helps you compare the access cost as more people need to use the network.
For mesh tools, we assess support for Linux, Windows, macOS, iOS, Android, containers and routers. Platform coverage matters when your network includes laptops, phones, servers and other equipment. We use documented support to show where the tool can fit, so you can check coverage against the machines you need to connect.
For mesh tools, we assess whether they support exit nodes and offer a privacy VPN add-on. Exit nodes let a device route internet traffic through another machine on the mesh. These options matter when you need internet routing as well as access to your own machines.
For mesh tools, we assess how recently the code changed and how widely the project is used, using evidence from its public repository. These signals help indicate ongoing maintenance and community adoption. They provide context for choosing software you may depend on, without guaranteeing future support or code quality.
We show which companies own VPN brands and which also own VPN review sites. Those relationships can give apparently separate recommendations a shared commercial interest. Our ownership map makes that connection visible when you compare services. Shared ownership does not establish wrongdoing, but ownership of review sites carries a scoring penalty because it creates a conflict readers should be able to see.
| Job | Kind | Weights |
|---|---|---|
| self-hosted VPN | Mesh & self-hosted | Openness & self-hosting 30%, True cost 20%, Security model 15%, NAT traversal & relays 15%, Platform coverage 10%, Project health 10% |
| Tailscale alternatives | Mesh & self-hosted | Openness & self-hosting 20%, Security model 20%, NAT traversal & relays 20%, True cost 15%, Platform coverage 10%, Project health 15% |
| port forwarding | Commercial VPN | Logging evidence 25%, Technical features 25%, True price 20%, Security engineering 15%, Ownership & transparency 15% |
| developers | Commercial VPN | Technical features 35%, Security engineering 20%, Logging evidence 15%, True price 15%, Ownership & transparency 10%, Network 5% |
| open-source VPN clients | Commercial VPN | Security engineering 30%, Logging evidence 25%, Ownership & transparency 20%, Technical features 15%, True price 10% |
We report evidence about logging practices, including what an audit examined and what readers can inspect. We do not declare any service log-free. We publish no performance figures, content-access results or leak tests. Server and country counts come from providers and are labelled accordingly; they are not measurements we have independently verified.
We re-check prices regularly, including renewal terms, and review supporting facts as documentation changes. Every page shows when its information was checked. Those dates help you judge how current the evidence is, especially when pricing, ownership or available features may have changed.
Most providers we list pay us nothing. Links may become affiliate links, which could earn us a commission when you buy through them. Our scoring code never receives commission data, so payments cannot change the calculated score. The published formulas explain how evidence earns points, and we apply those criteria regardless of whether a provider pays us.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.