Can I let you in on a little secret?
When it comes to protecting your privacy, most VPNs fail.
Many popular, highly-rated VPN services will leak your IP address or DNS requests, thereby exposing your data to third parties. But there are even bigger problems. Some VPNs will infect your computer with malware, install hidden tracking libraries on your devices, steal your private information, leave your data exposed to third parties, and even steal your bandwidth.
As you will see below, many of the popular VPNs are not safe to use – especially if you are using a VPN to protect your privacy online.
VPNs can look perfect on the surface, yet still be an absolute privacy and security disaster when you take a closer look.
To combat the growing confusion and deception in the VPN market, we created the VPN Warning List (which is a work in progress). This warning list contains information that I personally find to be troubling with various VPNs and the overall VPN market.
Disclaimer: This list does not necessarily reflect the latest information on every VPN service and/or app. VPNs are constantly updating their software, however, a history of bad practices may be a sign of trouble. You can decide for yourself. Everything on this list is based on information that is well-sourced and freely available online.
VPN Warning List
VPNs located in 5 Eyes countries
Always consider the legal jurisdiction of your VPN provider. The following five countries are working together in an alliance to collect, share, and analyze mass surveillance data: the United States, United Kingdom, Australia, Canada, and New Zealand.
Betternet
In reviewing and testing Betternet, I found a number of alarming items, such as Betternet giving third parties access to your data that are collected through their VPN. An academic research paper listed Betternet as #4 on the Top 10 most malware-infected Android VPN apps. They were also busted for embedding 14 different third-party tracking libraries into their Android VPN app while promising users “privacy and security”. We have all the details in our Betternet review.
Fake VPNs
With the growing interest in VPNs, there are even fake VPN services popping up. When I say “fake” what I mean is that there are no servers, no software, and no VPN – instead, it’s just someone trying to steal your money while pretending to be a VPN. One example of this was MySafeVPN, which was sending out scam emails and defrauding customers who paid money, expecting there to be an actual VPN service.
Free VPN Apps for Android and iOS
In general, you should be cautious when downloading any VPN app on your mobile device. A study of Android VPN apps found that 84% will leak your IP address, 82% will attempt to access your sensitive data, 75% utilize third-party tracking, 38% contain malware, and 18% don’t even encrypt your data (leaving you completely exposed). But this is no surprise. Over the years all kinds of apps have proven to be a security and privacy nightmare, for both Android and iOS. We also have a guide on how to secure your Android device.
Free VPNs in general
Free VPN services have proven to be a privacy and security disaster. Free VPNs make money by recording and selling your data, hitting you with ads, and/or redirecting your browser to e-commerce and third-party websites. Many of the most popular free VPNs in the Google and Apple stores are loaded with malware. As the saying goes, “If something is free, then you are the product.” (See the Free VPNs guide for a discussion on the dangers and risks of free VPNs.)
Many free VPNs have also been found to be sending data logs to China. (This is not to be confused with using a VPN for China to get around the Great Firewall.)
Hide My Ass (HMA VPN)
Hide My Ass (HMA VPN) is based in the United Kingdom – which is a bad location for privacy due to mandatory data retention and mass surveillance. Making matters worse, HMA has a troubling history of turning over customer data to law enforcement agencies around the world. (We cover this more in the HideMyAss HMA VPN review.)
Hola VPN
Hola VPN was caught stealing user bandwidth and fraudulently reselling it through their sister company Luminati. Hola users act as endpoints for the entire network. This means other people are using your bandwidth and IP address when you use Hola, and you can be busted for their activities. (This is also discussed in the Free VPNs guide.)
Hotspot Shield VPN
Hotspot Shield VPN was directly identified in an academic paper for “actively injecting JavaScript codes using iframes for advertising and tracking purposes” with their Android VPN app. Furthermore, analysis of Hotspot Shield VPN’s source code revealed they “actively use more than 5 different third-party tracking libraries.” They were also found to be redirecting user traffic to e-commerce domains, such as alibaba.com and eBay.com through partner networks – see the details here.
Additionally, Hotspot Shield has also been in the news because their VPN was found to leave users vulnerable to having their location exposed. Hotspot said they are working on a fix. See our Hotspot Shield VPN review for more info.
Ivacy VPN
Ivacy is a Hong Kong VPN provider that has some troubling issues. Their refund policy previously limited you to 500 MB of bandwidth and 30 sessions. Some bloggers have also accused Ivacy of falsifying their VPN server locations, meaning that you’re not getting the locations you paid for. Many people believe that Ivacy and PureVPN are under the same company and use the same network infrastructure.
Opera “Free VPN”
Opera’s browser now includes what it calls a “free VPN” which they say is “better for online privacy” (see here). First, this is not a VPN at all. Security experts have shown that this is just a web proxy, which uses API requests. Second, Opera’s privacy policies include statements about data collection (including usage data) and how this is shared with third parties (see here). Check out our Opera VPN review for more info.
PureVPN
Our PureVPN review uncovered many problems. In previous testing, we have identified IPv6 leaks, IPv4 leaks, and DNS leaks with their VPN applications. PureVPN was also caught handing over customer data to the FBI (US authorities) despite claiming to have a “zero log policy”.
VPN Master
There are many free VPNs offered in the Google Play or Apple stores using variations of the “VPN Master” name. Through testing, I have found that these VPN Master apps are full of dangerous malware, despite having high ratings and millions of users. I even found that one of these free VPN apps called “VPN Master Free unlimed proxy” (sic) is owned and operated by a Chinese data collection company called TalkingData.
VPNSecure
VPNSecure is based in Australia – a 5 eyes country that is not good for privacy. VPNSecure was also identified in an academic paper for leaking IPv6 and DNS requests, which leaves its users exposed to “surveillance and malicious agents.” The same paper also noted that VPNSecure has a number of egress points in residential ISPs. This suggests that users are unknowingly being used as endpoints in a P2P-like bandwidth network – i.e. user bandwidth is being stolen (although the paper could not confirm this). (See here for more info.)
Windscribe
Windscribe is a new addition to this list. It was found to be leaving overseas servers completely unencrypted, which is a very foolish practice that leaves Windscribe users exposed. In July 2021, news broke that Ukrainian authorities seized Windscribe servers, which were left unencrypted. This gave the police Windscribe’s private key, which could potentially allow them to decrypt VPN traffic.
Windscribe admitted that it was not following “industry best practices” and vowed to correct the situation and properly secure their servers. But the damage has been done. See our article on the Windscribe security incident for details. Adding to their woes, our last round of speed testing showed Windscribe to be extremely slow, as demonstrated in our comparison of NordVPN vs Windscribe.
Conclusion: Use a safe and reliable VPN service
This list illustrates one fact that’s often repeated on this site: using no VPN is better than using a bad VPN.
Even if you didn’t find your VPN on this Warning List, be careful. Many popular and highly-rated VPNs have problems, such as IP leaks and non-working features. That’s why we recommend testing your VPN regularly for any leaks or problems. In fact, we have a VPN test guide to help you do just that.
It’s also worth noting that some VPNs may not work in certain areas. For example, in both China and the United Arab Emirates, the internet is heavily restricted and censored, while most VPNs are also blocked. There are certain VPNs that can get around these blocks, however, by using obfuscation techniques. We discuss this more in our guide on the best VPNs for UAE and Dubai.
The best VPN services
We also have a guide on the best VPN services here.
These are the VPNs that performed well in all of our tests and are located in safe jurisdictions (outside of the 5 Eyes). Below is a table that includes our top picks.
Note: The top two recommended VPNs in the table below (NordVPN and Surfshark) also offer VPN ad-blocking features. This will allow you to easily block advertisements and trackers directly in the VPN app. They were also among the fastest VPN services we tested this year. Check out the link to the website or read our VPN reviews linked below for additional info and test results.
Stay safe and secure online.
This article was last updated on January 12, 2024.
Any comments on Planet VPN, seems to be based in Russia!?
You should add Panda VPN among the most unsafe VPNs:
I lived in China where VPN is a must. In 2022, I purchased PANDA VPN subscription for 6 months and paid 47 dollars. It did not work, so I deleted the account, emailed Panda VPN and requested refund. Not only I did not get any refund but Panda VPN kept charging me for 2 years. I lost about USD200 already. I wrote Panda VPN several times but they ignored my request for refund.
I’m using kaspersky vpn, I’ve discovered recently that this VPN has Google trackers inside the Kaspersky VPN Android app.
Do all VPN Android apps have trackers?
Windscribe for Android also has trackers and if you disable Google Play services, Windscribe doesn’t work
According to Kaspersky itself in their forum it’s tracing that you can enable to debug the app
https://forum.kaspersky.com/topic/vpn-tracking-is-enabled-35231/
I found a German report claiming tracking in the Windows App that You can disable
What’s up with all the updates to your VPN articles on Aug 24? They also remain largely hidden unless you enter VPN in the search bar. YourGodSven has some fixing up to do and prioritization.
you want privacy you use tor
tor is the best for privacy
in my country they wont do privacy
you get no
the tor is rescue here in the case
sode g
today I just went through dozens of up-to-date reviews on the best vpns you have the three but they’re not in the correct order compared to everything else that I’ve read today. and I get that it might be subject to some opinion or varying degree. people can start by getting rid of using Google for everything. the Duck Duck Go privacy browser and search engine all in one now has a very effective app tracking capability that box apps from tracking by the thousands. disable Chrome completely you won’t need it. from everything I have been able to find today expressvpn is yes more expensive but it speeds are much greater and everything else tests out very well. between using a better browser like the one I mentioned that is by the way extremely simple to use, I’m going through your apps and making sure that the permissions they have are only the permissions at the actually need and you’ll do pretty well.
ProtonVPN seems to have features but being warned they are blocked often. Mozilla is an option but seems a bit immature as a product and limited features.
any thoughts? I’d like to go with the traditionally Open Source friendly folks.
the Duck Duck Go private search engine and browser all in one is really cool. it means you can get away from Google and still be able to use Google and it has app tracking blocking technology that’s really cool. you can shut Chrome right off. get one of the three vpns mentioned in his article personally I like Express but that’s just my opinion in between the privacy of that browser and search engine and it’s ease of use and speed they all gel together very well.
is avira vpn safe i looked at it on trustpilot and it said it was safe.
is Çyberghost VPN good ? how do you rate it overall ?
It didn’t do well in our review:
https://restoreprivacy.com/vpn/reviews/cyberghost/
I use multiple VPN providers outside the 4 eyes and Tor & Orbot and I deliberately separate my information in this way. Not because I have something to hide, but because the government and Big Tech want to know too much. I believe that Express VPN is on the British Virgin Islands. This is therefore within the 5 eyes of the United Kingdom. There are also critical noises about Nord VPN, I thought located in Panama. Proton VPN ( https://protonvpn.com/ ) is located in Switzerland and should therefore be relatively secure. New in my list is Mullvad from Sweden. ( https://mullvad.net ). This is because I do not need to provide private information such as Google account, email or phone number with this VPN ISP. With a voucher purchased from Amazon.com or with a payment with the still untraceable Monero (XMR) cryptocurrency Mullvad offer a relatively anonymous subscription for half a year or a year.
Thanks! I appreciate your work!!
I have tried both Nord and Surfshark from Iran, last month. It was bad!
Nord vpn isn’t the best imo, it takes too long to connect, that’s if it eventually connects. It’s not really a vpn provider I’ll recommend to someone who has an important reason to use a vpn. Apart from the connectivity issues tho, Nord vpn is miles better than it’s peers in the Vpn market.
Nord may be good and safe, but if you have problems it is difficult to get them resolved. You cannot call them and do not always respond to you at times.
Sven Sir please can you write an article on free VPNs like Thunder VPN which are very very popular but also very dangerous. Millions of people have been using these, specially these days because of increasing internet censorship, not only at national level but also at colleges and universities and schools all over the world.
Sven, thank you for your GREAT work! very useful information!
Please give your opinion about the: urban-vpn (dot) com.
They are describing themselves as the: “The only 100% FREE, 100% fast & 100% anonymous VPN in the world”
They offer: VPN for Windows, Android and iPhone/Mac;
– Urban Free VPN Proxy (chrome web store extension);
– Urban Firefox addon;
– Urban Anti-malware;
– Urban AdBlocker;
Do you have any review of “urban-vpn?
Best regards
No, but I would avoid any “100% free VPN”
THE BEST VPN should be from country which is NOT member of 14 EYES ALLIANCE and there is no censorship running by government! Period. USA IS A MEMBER OF 14 EYES ALLIANCE. Members of this Alliance are archiving logs about their customers and will give them not only to government of their country, BUT ANY GOVERNMENT who is member of that Alliance. So saying that, do not pay for any VPN from country included in 14 EYES ALLIANCE! USA VPN COMPANIES INCLUDED! Period. Do your research about this Alliance, you’ll see…………..
started having RAM issues on my macbook air, causing apps to close down. noticed that PureVPN was using loads of memory, starting with 10GB and going up to 50GB after a few minutes. is that normal for a VPN? how much does ExpressVPN use?
I dont see any mention of Mullvad on your site unless i missed it, would love to see a Nord Vs Mullvad comparison especially now mozilla are rolling out with Mullvad.
We recommend Mullvad in our WireGuard VPN guide, but have not tested it for a full review. But from what we have seen, it’s a good service.
Thanks ;
I think no VPN is safe , Linux system + Tor browser is the best choice.
Any opinion on Cyber Ghost ? Free or paid version.
Not recommended. See the CyberGhost review here.
Thanks for the warning. You confirmed my suspicions.
What’s your guidance on “watchnewslive.tv/vpn”?
What about VPNs that promise to unblock “any site or app” (mostly to get free TV streaming which block other VPNs), like VPN Epple? I was bemoaning my wish that BBC would allow us to pay for legit streaming of iplayer (internationally) and a stranger recommended the above but just the name makes me think it’s a scam app.
Yes you will find that even high-quality paid VPNs can have troubles unblocking some websites. So the claim to unblock “any site or app” is a false promise and you are correct.
I have Nord for my VPN. I feel it is good. Question: Why do I still get hammered with ads on various website? Shouldn’t my VPN stop this???
A VPN is usually a separate tool from an ad blocker. But with NordVPN, they do have a feature called CyberSec that will block ads and trackers. Simply go into the NordVPN settings on your app and click to enable CyberSec.
There is more information on NordVPN and the CyberSec feature on their website.
Does nord vpn work in the uae
Is a AVG’s VPN any good?
Here is the AVG VPN review.
i use PIA (Private Internet Access) VPN and since using it i was recently hacked woke up with apps open all over my desktop and my vpns log file settings open. . now since then ive been getting a lot of *your card was used in store, but declined for your protection* or scam emails from family. even worse stuff.
i never have been hacked in my life since im a network engineer and when it comes to VPN’s they are all on the suspicion list bo matter who they are. you just never know.
Your statement made more sense than any reviews I’ve read. Thank you!
So, what are you using now?
I have a question, do you know if FineVPN is safe?
Is Psiphon is safe?