Consumer VPN services compared: what actually matters for privacy
VPN marketing promises a lot — "military-grade encryption," "total anonymity," "protection from hackers." Most of it overstates what a consumer VPN actually does. Before comparing providers, it's worth being precise about what you're buying: a VPN encrypts your traffic between your device and the provider's server, and hides your IP address from the sites you visit. It does not make you anonymous, it does not stop phishing or malware, and it shifts trust from your ISP to the VPN provider rather than eliminating trust entirely.
What's actually worth paying for
- A no-logs policy backed by independent audits, not just a claim on the marketing page. The provider can see your real traffic while it's connected — the whole product depends on trusting them not to log it.
- A modern protocol — WireGuard or a provider's WireGuard-based implementation is faster and has a smaller, more auditable codebase than older protocols like OpenVPN.
- A jurisdiction and ownership structure you're comfortable with, since that determines what legal requests the provider can be compelled to answer.
- A kill switch that actually blocks traffic if the VPN connection drops, rather than silently falling back to your normal connection.
Mullvad
The strongest privacy posture in the category: accounts are just a randomly generated number, no email required, and cash payment is supported. WireGuard-based, independently audited, and consistently transparent about its infrastructure. The app is plain and utilitarian rather than flashy, and it doesn't chase streaming-unblock use cases — which is arguably a feature, not a gap, for a product whose whole pitch is privacy.
Proton VPN
Backed by the same team as Proton Mail, with a genuinely useful free tier (rare in this category, and not a bandwidth-limited trial) plus a paid tier with a large server network and consistent third-party audits. Slightly more polish and mainstream usability than Mullvad, at a small cost to the account-anonymity model since a Proton account ties back to an email.
The big-name, marketing-driven providers
Several of the most heavily advertised consumer VPNs spend more on sponsorships than on the technical transparency (audits, published infrastructure ownership) that this category actually needs. That doesn't mean they're unsafe, but the marketing spend is a poor proxy for trustworthiness — the audit history and ownership transparency are the things worth checking before the ad reads.
Mullvad for the strongest privacy model and the least trust required. Proton VPN if you want a genuinely usable free tier and slightly more mainstream polish without giving up independent audits. Treat any provider that leads with "military-grade encryption" instead of a published audit as a marketing pitch, not a security claim.
A VPN is one layer, not a substitute for the basics — see our review of password managers and our threat brief on phishing-as-a-service for the layers that matter more day to day.