The cheapest VPNs

The device coverage is genuinely broad for the money. Applications are published for Windows, Mac, Linux, iOS and Android, plus Fire TV and browser extensions, with ten simultaneous logins and unlimited bandwidth. A month costs $5, two years costs $19.95, and a lifetime plan costs $40 paid once.

That lifetime plan is the thing to think hardest about. It converts a subscription into a single payment, which sounds like a saving and is really a transfer of risk: you are betting $40 that the company keeps operating, keeps the servers running and keeps honouring a plan it no longer earns revenue from. Providers that sell lifetime access have a structural reason to under-invest in the customers who bought it.

The catch is that there is no company to assess. No legal entity, registered address or country appears on the home page, and the terms and about pages return navigation links and nothing else. Nothing outside the business has examined the no-logs claim either. The result is a cheap, capable-looking product asking for a permanent commitment while declining to say who is on the other end of it, and those two facts sit badly together.

The most useful thing about this service is how little it asks you to commit. The free plan carries a monthly data allowance rather than a countdown to a card prompt, so you can find out whether it suits you without paying, and the paid plan puts no ceiling on simultaneous devices — an unusual pairing, and the reason its subscription costs so little per month on a long term. Its own privacy policy goes as far as recommending cryptocurrency to keep payment data to a minimum.

The mechanism behind the marketing is worth reading closely. The service is sold on Swiss privacy law, and the controller named in its privacy policy is a company organised under the laws of Iceland. The Swiss entity, and an American one, appear in that same document as payment processors acting on the Icelandic company's instructions.

The cost is what you cannot check. Nobody outside the company has examined the no-logs claim, so the specific commitments in the policy stand on the company's word. Speed falls off substantially at distance, losing most of a fast connection on the furthest servers tested. And a product sold on privacy uses mobile advertising identifiers to attribute its own marketing, which is common and still worth knowing.

The pricing is the product. A month costs $12.95, which is at the upper end of ordinary; commit two years and three extra months and it falls to $2.14 a month billed $53.75; commit five years and it falls to $1.69 a month billed $101.55. Every discount is a function of how far ahead you are willing to pay, and the applications cover desktop and mobile in the usual way.

Two things about that ladder deserve reading closely. The billed figures are described as covering "the first" two or five years, and no renewal rate is published beside them, so what happens at the end of a five-year term is unstated. And a five-year prepayment is an unusually long bet on a consumer VPN brand remaining in business and remaining the same product.

The cost is that the thing you research and the thing you buy have come apart. Ivacy merged into a larger provider in 2024 and its clients were carried across with subscriptions honoured, which is the gentle version of that outcome. But Ivacy's own pages still name no legal entity or country, while the service behind them belongs to a company that publishes both — named in the jurisdiction note here. Paying five years ahead now buys a brand rather than an operator.

The commitment here is written unusually specifically. Rather than promising no logs and leaving the term undefined, the policy enumerates what is not recorded: browsing history, traffic destination, connection timestamps, DNS queries, the IP address you were allocated and the one you connected from, content and bandwidth. Naming the allocated and the connecting address separately is the detail that stands out, because those are the two records that identify a session after the fact.

Specificity of that kind is worth something on its own. A general promise can be quietly reinterpreted; a list this particular would have to be contradicted outright, and the company that wrote it is small enough that it is the same people answering for it.

The cost is that nobody has ever checked. No outside firm has examined the claim, so the wording is the whole of the evidence. Independent testing also measured the tunnel taking roughly two thirds of the connection in every region tried, which is consistent but heavy, and Sweden shares intelligence with thirteen other governments — a fact about the jurisdiction that no amount of careful drafting can answer.

Private Internet Access does the thing almost nobody else does: it publishes the source code for every app it ships, on every platform. You do not have to believe the no-logs claim on the strength of a marketing page, because you can read what the software actually does — and an outside firm has separately inspected the servers and their configuration to check that the infrastructure matches.

It is also generous in the ways that cost money. There is no limit on simultaneous devices. Port forwarding works, which matters if you torrent. There is a proxy included alongside the tunnel, apps for televisions, and a three-year plan that renews at exactly what you paid rather than stepping up.

The thing to weigh is where it lives. This is a Colorado company operating under US law, inside the five-country intelligence agreement, and no amount of open source changes which courts can issue an order. The company's answer is that it has been asked and had nothing to give, which it publishes. The kill switch is also the weak point: under testing it allowed traffic past the tunnel after a restart, which is worse than not having one.

PureVPN sells a very cheap long term from a British Virgin Islands company, with the group itself run from Karachi. What the subscription covers is broad: ten devices, first-party apps across nine platform families down to Apple TV and Fire TV, servers picked out for individual streaming services, and an ad and tracker blocker on every tier.

The reason to read the entry is a 2017 federal case. An FBI affidavit records that the company supplied records tying one customer account to two originating IP addresses — a home connection and an employer's — precisely the category a no-logs policy is understood to exclude. Its answer at the time was that it had not broken its policy because it kept no browsing history, which was a defence about a question nobody had asked.

The tradeoff is that the reassurance has aged and the price has a second half. The last independent assessment ran in February 2023; the company describes an always-on arrangement letting an auditor arrive unannounced, but a standing permission is not an assessment that happened, and its own pages no longer name the firm that did the last one. The long plan charges once for twenty-seven months and then renews yearly, and port forwarding and a dedicated address are extra.

The offer is straightforward and cheap. Three days to try without handing over a card, 188 locations, unlimited data on every paid plan, a warrant canary the company maintains, and SOCKS5 access alongside the ordinary tunnel for people who want it. A year runs to $39.99 against a list price of $119.88, and two years to $55.99, with a dedicated IP and port forwarding sold as separate extras.

What sits underneath that is a company nobody outside it can identify. No legal entity, no registered address and no country appears on the home page, the pricing page or the legal pages — the terms and privacy pages return too little content to read at all. A customer testimonial describes it as "offshore", which is marketing rather than an address.

The catch is that this makes half of the privacy question unanswerable rather than merely unfavourable. A VPN in a bad jurisdiction can at least be reasoned about: you know which courts apply and what they can compel. An unpublished one cannot be reasoned about at all, and a warrant canary is only as meaningful as the legal system it is supposed to signal about. Cheap, functional, and asking for a kind of trust it gives you no way to calibrate.

IPVanish sells one subscription with no limit on simultaneous connections, and means it: an independent lab ran eleven at once without hitting a ceiling. The apps are first-party on seven platform families including Apple TV, Android TV and Fire TV, which is broader television coverage than most of the market manages. Threat Protection filters ads and trackers at DNS level on every plan.

What makes the entry worth reading is older than that. In 2016, under previous ownership, the company answered a Homeland Security administrative summons with a subscriber's name, email address, home IP address and the times they connected and disconnected — after first replying that it kept no usage information, then suggesting the agency come back with a more detailed demand. It has changed hands twice since, and Schellman Compliance examined the no-logs claim in February 2025.

The thing to weigh is whether that audit answers the history. The fleet is still, by the company's own account, a mixture of disk-based and RAM-only machines and will not be fully diskless until 2027, so there is more to examine than at services built to retain nothing. A lab found the kill switch leaks after a reboot, a crash and a dropped connection. And the first year costs $46.68 while the second costs $99.99.

CyberGhost runs a very large server network from a Romanian company, and the part that matters most is invisible: the fleet runs from RAM, so nothing is written to disk and everything held is lost the moment a machine reboots. Deloitte examined those no-logging safeguards as they stood on 31 October 2025 and issued a formal assurance report, a stronger artefact than the attestations most of this market publishes.

What you buy is breadth: servers sold for streaming and a Smart DNS for devices that cannot run an app, a content blocker that refuses ad and tracker domains at the server rather than in the app, first-party apps down to Fire TV, and forty-five days to change your mind rather than the usual thirty.

The catch is the pricing structure and a piece of ownership the site never mentions. The advertised rate buys twenty-six months in one charge; the renewal buys twelve for the same money, so the monthly figure roughly doubles two years after you decided anything. The company is a wholly owned subsidiary of Kape Technologies, which has traded under that name only since 2018 and owns two other services in this market — a fact that appears nowhere on its site. There is no port forwarding and no multi-hop.

Surfshark is built for a household rather than a person. One subscription covers unlimited devices, which is the difference between protecting your own laptop and protecting everyone's phones, televisions and tablets without counting. The apps are good, there are proper television builds, and it will route you through two servers or block ads before they load.

The evidence behind it is stronger than its reputation suggests. The whole fleet runs from memory with nothing written to disk, Deloitte produced a reasonable-assurance report on the no-logs claim in 2025 after assessing the servers themselves, and a separate firm penetration-tested the network infrastructure later that year.

The cost is at renewal, and it is what holds the value score down. The rate on the advertisement covers twenty-seven months in one charge, after which it renews annually at roughly double the effective monthly figure. The Netherlands is also inside the fourteen-country intelligence agreement, which is easy to miss when a service is described as a privacy-friendly European option. The apps are closed source, and IPv6 is not supported at all — the guidance is to switch it off on your network.

hide.me is run by a Malaysian company, and the free plan is the part worth knowing first: no account, no email address, no card, no data cap and no expiry. You download it and you are protected. That is a different proposition from a free tier with a countdown attached, and the company treats it as a product rather than a funnel.

The paid plan is unusually complete for the price. Ten devices, first-party apps across nine platform families including Apple TV and Fire TV, split tunnelling in both directions, and a multi-hop mode where you pick both the entry and the exit server rather than choosing from fixed pairs. IPv6 is carried inside the tunnel on every location rather than blocked, which is the harder of the two ways to solve that problem.

The downside is what the audit covers and how much sits behind the paid tier. Securitum examined the no-logging claim properly — interviews, configuration, a server image — but dated its report 7 June 2024, past the two-year line this directory draws. Whether the servers run without disks cannot be settled from published sources. And the ad blocker, the proxy, the streaming servers and port forwarding are all for paying subscribers only.

AirVPN is what a VPN looks like when it is run by engineers with no marketing department. Every piece of software is open source. The plans go from three days to three years with no tier system, because every plan includes everything. You can open an account without giving an email address and pay in cryptocurrency with no processor in between. The service has been operating on these terms since 2010.

Its transparency is unusual in kind rather than degree. There is a public monitor showing the load and bandwidth of every server, updated continuously, so the claims about capacity are checkable by anyone at any time rather than being taken on trust. Port forwarding is included, obfuscation works on every server, and the Tor integration is built into the client.

It is not the easy option, and the gaps are real. There is no iPhone or iPad app at all, which rules it out for a lot of people immediately. Nobody outside the company has ever audited anything, so the no-logs claim rests entirely on the source code and your willingness to read it. Italy is inside the fourteen-country intelligence agreement, and Italian residents are barred from using the service altogether.

Longevity is worth something in a market where brands appear and vanish, and this is one of the older consumer VPNs still on sale. It is run from New York by a company that also sells a handful of other productivity and security tools, and it has kept a wide platform spread — desktop, mobile, Linux and browser extensions — along with its own protocol built for networks that block ordinary VPN traffic.

The pricing is where it differs from its neighbours. A month costs about what everyone charges, a year is priced sensibly, and three years costs a hundred dollars in total, which works out below almost anything else here on a per-month basis. Split tunnelling is included, so the applications that need the tunnel get it and the ones that break inside it do not.

What you give up is the same thing several entries in this directory ask you to give up, and it is not small. The company is American, so it sits inside the five-country arrangement, and nothing outside the company has ever examined the no-logs promise. The lowest rate also requires paying three years in advance, which is a bet on the company still trading at the end of the term.

Most of the large antivirus companies are American or British. This one is Romanian, and it says so deliberately: its own page argues that its jurisdiction sits outside the five, nine and fourteen-country intelligence arrangements. For a reader choosing on where the courts are, that is a real distinction from the other suite VPNs here, and it is the main reason to consider it.

What it is not is a network of its own. The service runs on the Hydra protocol, which the company licenses rather than wrote, and the servers behind it belong to a separate company that sells the same infrastructure under its own brand. Two products, one network. Neither vendor's site makes that easy to discover, which is precisely why it is stated here.

The trade-off is that nothing outside the company has ever tested the no-logs promise, so a strong jurisdiction is being asked to carry weight that an audit would normally carry. The price doubles at renewal, from $34.99 for the first year to $69.99, and the ad blocker is the only extra of substance. It is a reasonable second line of defence for somebody already inside this company's ecosystem, and a thin argument for anybody who is not.

ExpressVPN is the one that gets out of the way. You install it, press the button, and it connects quickly to something sensible without asking you to pick a protocol or a server. On networks that interfere with VPN traffic it works around them automatically rather than making you find the obfuscation setting. If a VPN is infrastructure you would rather not think about, this is the one that asks least of your attention.

Behind that, the servers hold nothing on disk and rebuild themselves from a known state on every restart, which is a genuinely good architecture and has been reviewed by an outside firm. There are apps for everything, including televisions, and a browser extension that works on its own.

The cost is money and it is substantial. The introductory rate covers a little over two years, after which it renews annually at roughly three times what you were quoted. The evidence is also thinner than the marketing implies: the most recent review checked the controls as they stood on a single day rather than over a period, the apps have not been examined since 2024, and the code for them is closed. Router firmware, long a selling point, has been discontinued.