How we test VPNs

VPN users have an unbelievable amount of choice in the market, but lots of those choices are bad. Upwards of 180 virtual private networks are available for commercial users alone. For the casual user who just wants a VPN to protect themselves online or change their virtual location, the risk of analysis paralysis is very real.

It doesn’t help that VPN providers love to make misleading claims about their own product. Read a few of their homepages and you’ll start to see some phrases repeat. “Lightning-fast.” “Bank-grade encryption.” “Zero-logs policy.” It’s designed to sound good without meaning much, and unfortunately, even the best providers love to talk like this.

Our team at Engadget started digging into the VPN world to help you cut through all this clutter and pick the provider you actually want and need. We’ve developed a rigorous testing process that combines investigative journalism, objective testing and qualitative review. This article explains how we research and test a VPN.

Update, May 28, 2025: This story has been completely overhauled to reflect the updated 2025 Engadget VPN testing methodology.

Table of contents

Our process at a glance

Check the table for a quick illustration of our VPN testing process.

VPN testing: Our 11 steps

A quick note before we start — whenever we say “VPN” in this article, we’re referring to a commercial VPN, the kind any individual can download and use. Corporate VPNs like Cisco Secure Client and Perimeter81 require a different testing process.

1. Install and configure the VPN on multiple platforms

The most work you’ll likely have to do with a VPN comes when you download and install it. We run through that process on as many different platforms as possible. When we can’t hit them all, we try to get at least one in each category — desktop, mobile, smart TV and browser — plus the “big four” of Windows, Mac, iOS and Android.

We take careful notes on the whole process, trying to think from the perspective of someone who has never used a VPN before. How easy is it to find the installation file? How do you log in and out? Are there quality-of-life features, like a programmable auto-connect to save work the next time you open the VPN app?

After installing each VPN, we run through the basic tasks of connecting, disconnecting and changing server locations. If these go smoothly, 90 percent of users will face very few problems with the interface. On the other hand, any hiccups on the basic connection process bode poorly for the operability of the VPN’s more advanced features.

2. Test speeds

We take it for granted that a VPN will reduce your browsing speeds. Except in certain rare cases where your ISP has severely misconfigured your local pathways, it’s not possible for a VPN to give you faster speeds than your normal internet service. That means the “fastest VPN” is the one that drags down your normal speeds as little as possible.

We use Ookla’s speed testing software to check each VPN’s servers in three categories. Download speed describes how much data can move from a web server to your device in one second; this determines how quickly web pages load and when streaming videos need to buffer. Upload speed is the same in reverse, and matters most for torrenting, social media sharing and outbound communication from your computer.

The third metric is latency, measured by the length of a “ping” — the time in milliseconds that a single data packet takes to travel between your device and the web. Latency, which is highly dependent on distance, is important for anything that happens online in real time, like gaming or video chat.

All three speed stats can fluctuate as individual server loads change. To get a clear picture of performance across the entire network, we pick six server locations for each VPN, including the one the app designates as the fastest. We then test each location three times across two days, averaging each result to get a final score.

3. Test security

A VPN’s most important job is to keep your real IP address hidden. If it can’t do that, we can’t recommend it. The simplest way we test a VPN’s security is by checking our IP address while connected. If the VPN server is airtight, any IP lookup tool should show the server’s address, not our home network.

IP leaks — in which your home IP address is visible even while you’re connected through a VPN — are most often caused by VPNs using public DNS servers that make your requests visible to your internet provider. The culprit can also be a misconfiguration in real-time communication protocols (WebRTC) or a failure to properly incorporate IPv6 traffic.

We also check for weak, outdated VPN protocols like PPTP, or untested proprietary protocols with no available source code. We finish this step by testing the VPN’s encryption by analyzing a few data packets using Wireshark.

4. Look at pricing and deals

Next, we see how much the VPN costs. We read the fine print on multi-year deals to see if advertised savings stop after the first billing period; when VPNs offer “bonus months” for new sign-ups, it’s common for prices to go up later. We also evaluate any free plans, temporary free trials or money-back guarantees — paying special attention to the refunds, as VPNs occasionally refuse to honor their stated policies.

We close out by seeing if there are any special pricing discounts or coupons that may make the VPN more affordable. Ultimately, we try to make a call about whether the VPN gives the user enough value to justify its price.

5. Check out pricing bundles

Many of the top VPNs are expanding their offerings into larger bundles, like NordVPN Complete, Surfshark One, or ExpressVPN’s Identity Guard suite. This can also happen from the other direction, as companies like Norton and Proton add VPNs to their existing product lines.

VPN bundles almost always come at an additional subscription cost, which they sometimes earn with added value — and sometimes don’t. Whenever we review a VPN, we check out the products associated with it and advise you on whether or not to heed the VPN’s inevitable calls to upgrade.

6. Close-read the privacy policy

The next step is to sit down with the VPN’s privacy policy and read it like a lawyer would. A VPN privacy policy is technically legally binding, in that the provider can be sued for false advertising if they violate it. Instead of lying outright, the less-trustworthy VPNs minimize their risk by hiding controversial practices behind vague language and loopholes.

As an example, a VPN might claim on its homepage to have a “zero-logs policy,” but it’s impossible to provide VPN service without keeping at least some logs. The honest providers lay out exactly what data they keep, how they anonymize it and what they do with it. Red flags include saving your data for longer than necessary, logging activity for non-security purposes like marketing, or claiming that the privacy policy does not apply to partners or parent companies.

7. Check the VPN’s ability to change geolocation

When a VPN changes your virtual location, it needs to do so in a way destination servers can’t see through. The sites you’d want to change your location for, like Netflix, YouTube and sports streams, block content in regions where they don’t have a licensing agreement to stream it (that’s why Netflix libraries change in every country). These sites know VPNs can circumvent their blocks, so they ban VPN access whenever they detect it.

The best VPNs fight back by updating their server IP addresses quickly enough that streaming platforms can’t block them. We test a VPN’s unblocking ability by connecting to multiple streaming websites — each in several different countries — and looking for proxy errors. We check to see if content is accessible and whether speeds remain fast enough to view it.

8. Investigate the server network

A VPN’s “server network” is the selection of IP addresses it lets users connect to. Large server networks are a common selling point for VPNs, which argue that more servers means better performance and more locations means more options to circumvent blocks.

While it’s true that a larger network is a good sign, it’s easy to artificially inflate the numbers. For one thing, a VPN provider can set up virtual servers with IPs from locations where it isn’t physically present. This is helpful for getting locations in countries like China and India that ban most VPNs, but means you can’t always trust that a server which looks close to you actually is.

It’s also common for providers to rent server space from third-party data centers to get more locations out faster. While convenient, this adds more potential failure points, since the data center operators may not follow the VPN’s security standards (this is how NordVPN was briefly compromised in 2018).

When reviewing a VPN, we investigate not just the quantity of its server network, but also its quality. If it doesn’t disclose which servers are virtual and/or rented, we check the IP addresses of suspicious locations and research whether the VPN has worked with data center providers.

Most VPNs include features beyond the core ability to connect to a server. These extras range from vital security measures like kill switches (which cut you off from the internet if you aren’t connected to a VPN server) to tangential nice-to-haves like ad and malware blockers (which often work well but can’t replace a designated antivirus).

We test two things: whether these features work and whether they’re easy for beginners to use. The former depends on the feature — for example, for an ad-blocker, we’ll see if it blocks different types of ads. The latter is qualitative and depends on where the feature is found in the VPN app, how well it explains itself and what customization options exist.

10. Use the customer service options

No VPN client is so well designed that you’ll never need help. Good customer support starts with an up-to-date knowledge base written in clear English by a human author, with logical organization and plenty of screenshots. An active user community is a bonus, whether hosted on the VPN site or somewhere else (often Reddit).

Most VPNs have other tech support options, generally live chat and/or email tickets. We test both by submitting a simple question. With live chat, we determine whether it’s possible to talk with a human and how long it takes to reach that point. With email, we measure how long it takes to get a reply from the experts and how useful it is for solving the problem.

11. Investigate the VPN’s background

The first step is to find out exactly who we’re dealing with. We comb through the VPN’s history since its launch, looking for any security breaches, violations of its own privacy policy or any attempts to pull the wool over the customers’ eyes. News archives are the best source, but we also incorporate academic research by security investigators and published third-party audits of the VPNs themselves.

When we find black marks on a VPN’s record, we try to place them in context. A past security breach doesn’t necessarily disqualify a VPN from our recommendation — most of the best options have slipped up at least once. The best evidence comes from how the provider responded to the incident. Did they change anything or double down? Did their recovery produce lasting improvements, or did the same problem happen again a year later?

Privacy violations are much more serious. A VPN that breaks its agreement to not log information on its users cannot be trusted to keep its word in the future without evidence of drastic internal change. Another major red flag is a lack of transparency, like when it’s unclear where a VPN is based or who owns it.

Get started with our VPN reviews

Reviewing a VPN is a matter of patient investigation, rigorous testing and an unwillingness to take anything at face value. We’re constantly refining our process, so we’ll make sure to update this page whenever we change any of the steps above.

Now that you understand our process, you’re ready to dive into our coverage of the best VPN services (soon to get an extensive update), or head straight to our in-depth ExpressVPN review to see the process in action.