Feed: Engadget is a web magazine with obsessive daily coverage of everything new in gadgets and consumer electronics
Feed Link: https://www.engadget.com/
---

Title: How we test VPNs

Date: Fri, 30 May 2025 18:00:36 +0000
Link: https://www.engadget.com/cybersecurity/vpn/ho...

VPN users have an unbelievable amount of choice in the market, but lots of
those choices are bad. Upwards of 180 virtual private networks are available
for commercial users alone. For the casual user who just wants a VPN to
protect themselves online or change their virtual location, the risk of
analysis paralysis is very real.

It doesn't help that VPN providers love to make misleading claims about their
own product. Read a few of their homepages and you'll start to see some
phrases repeat. "Lightning-fast." "Bank-grade encryption." "Zero-logs
policy." It's designed to sound good without meaning much, and unfortunately,
even the best providers love to talk like this.

Our team at Engadget started digging into the VPN world to help you cut
through all this clutter and pick the provider you actually want and need.
We've developed a rigorous testing process that combines investigative
journalism, objective testing and qualitative review. This article explains
how we research and test a VPN.

Update, May 28, 2025: This story has been completely overhauled to reflect
the updated 2025 Engadget VPN testing methodology.

Table of contents

Our process at a glance

VPN testing: Our 11 steps

Get started with our VPN reviews

Our process at a glance

Check the table for a quick illustration of our VPN testing process.

Testing Step

What We Do

Install, configure and use the VPN on multiple platforms

Investigate how easy it is to download, install and configure the VPN

At a minimum, experience all features of the Windows, Mac, iOS and Android
apps

Test speeds

Test download speeds, upload speeds and latencies on a representative sample
of servers around the world

Test each location at least three times across two days and average scores

Test security

Run encryption tests using WireSharkTest for DNS and WebRTC leaks

See how the VPN handles IPv6 traffic

Check that the VPN uses up-to-date protocols

Look at pricing and deals

See what plans and discounts are available

Investigate whether long-term deals rise in cost after the first billing
period

Look for free trials, coupons and other ways to save money

Look at subscription bundles

Check what other standalone apps or services are bundled with the VPN

Investigate how much those bundles cost and whether they're worth buying

Close-read the privacy policy

Investigate the privacy policy for any loopholes

Note what information is saved, what is shared and with whom

Check the VPN's ability to change geolocation

Make sure virtual locations match DNS locations

Test the VPN on streaming sites to see if it gets caught

Investigate the server network

Check how many server locations are physical vs. virtual and how many are
owned vs. rented

Discover which users are most likely to have access to a physical server near
them

Test all extra features

Explore the user interface and any features outside the VPN connection itself

Ensure features work as advertised and judge how easy they are to use

Use the customer service options

Read the help pages to see how they answer simple questions

Test the live chat, how capable the bot is and how difficult it is to reach a
human

Submit an email ticket and grade response times and usefulness

Investigate the VPN's background

Check the VPN's history in the news

Read any published audit reports

Look into past data breaches and/or privacy violations

VPN testing: Our 11 steps

A quick note before we start ΓÇö whenever we say "VPN" in this article, we're
referring to a commercial VPN, the kind any individual can download and use.
Corporate VPNs like Cisco Secure Client and Perimeter81 require a different
testing process.

1. Install and configure the VPN on multiple platforms

The most work you'll likely have to do with a VPN comes when you download and
install it. We run through that process on as many different platforms as
possible. When we can't hit them all, we try to get at least one in each
category ΓÇö desktop, mobile, smart TV and browser ΓÇö plus the "big four" of
Windows, Mac, iOS and Android.

Proton VPN's app for MacOS, a typical user interface.Sam Chapman for Engadget


We take careful notes on the whole process, trying to think from the
perspective of someone who has never used a VPN before. How easy is it to
find the installation file? How do you log in and out? Are there quality-of-
life features, like a programmable auto-connect to save work the next time
you open the VPN app?

After installing each VPN, we run through the basic tasks of connecting,
disconnecting and changing server locations. If these go smoothly, 90 percent
of users will face very few problems with the interface. On the other hand,
any hiccups on the basic connection process bode poorly for the operability
of the VPN's more advanced features.

2. Test speeds

We take it for granted that a VPN will reduce your browsing speeds. Except in
certain rare cases where your ISP has severely misconfigured your local
pathways, it's not possible for a VPN to give you faster speeds than your
normal internet service. That means the "fastest VPN" is the one that drags
down your normal speeds as little as possible.

We use Ookla's speed testing software to check each VPN's servers in three
categories. Download speed describes how much data can move from a web server
to your device in one second; this determines how quickly web pages load and
when streaming videos need to buffer. Upload speed is the same in reverse,
and matters most for torrenting, social media sharing and outbound
communication from your computer.

Testing ExpressVPN's speed using Ookla's speedtest.net.Sam Chapman for
Engadget

The third metric is latency, measured by the length of a "ping" ΓÇö the time
in milliseconds that a single data packet takes to travel between your device
and the web. Latency, which is highly dependent on distance, is important for
anything that happens online in real time, like gaming or video chat.

All three speed stats can fluctuate as individual server loads change. To get
a clear picture of performance across the entire network, we pick six server
locations for each VPN, including the one the app designates as the fastest.
We then test each location three times across two days, averaging each result
to get a final score.

3. Test security

A VPN's most important job is to keep your real IP address hidden. If it
can't do that, we can't recommend it. The simplest way we test a VPN's
security is by checking our IP address while connected. If the VPN server is
airtight, any IP lookup tool should show the server's address, not our home
network.

IP leaks ΓÇö in which your home IP address is visible even while you're
connected through a VPN ΓÇö are most often caused by VPNs using public DNS
servers that make your requests visible to your internet provider. The
culprit can also be a misconfiguration in real-time communication protocols
(WebRTC) or a failure to properly incorporate IPv6 traffic.

Using WireShark to test whether a VPN can encrypt data in transit.Sam Chapman
for Engadget

We also check for weak, outdated VPN protocols like PPTP, or untested
proprietary protocols with no available source code. We finish this step by
testing the VPN's encryption by analyzing a few data packets using Wireshark.

4. Look at pricing and deals

Next, we see how much the VPN costs. We read the fine print on multi-year
deals to see if advertised savings stop after the first billing period; when
VPNs offer "bonus months" for new sign-ups, it's common for prices to go up
later. We also evaluate any free plans, temporary free trials or money-back
guarantees ΓÇö paying special attention to the refunds, as VPNs occasionally
refuse to honor their stated policies.

We close out by seeing if there are any special pricing discounts or coupons
that may make the VPN more affordable. Ultimately, we try to make a call
about whether the VPN gives the user enough value to justify its price.

5. Check out pricing bundles

Many of the top VPNs are expanding their offerings into larger bundles, like
NordVPN Complete, Surfshark One, or ExpressVPN's Identity Guard suite. This
can also happen from the other direction, as companies like Norton and Proton
add VPNs to their existing product lines.

VPN bundles almost always come at an additional subscription cost, which they
sometimes earn with added value ΓÇö and sometimes don't. Whenever we review a
VPN, we check out the products associated with it and advise you on whether
or not to heed the VPN's inevitable calls to upgrade.

6. Close-read the privacy policy

The next step is to sit down with the VPN's privacy policy and read it like a
lawyer would. A VPN privacy policy is technically legally binding, in that
the provider can be sued for false advertising if they violate it. Instead of
lying outright, the less-trustworthy VPNs minimize their risk by hiding
controversial practices behind vague language and loopholes.

Surfshark's privacy policy on the Google Play StoreSam Chapman for Engadget

As an example, a VPN might claim on its homepage to have a "zero-logs
policy," but it's impossible to provide VPN service without keeping at least
some logs. The honest providers lay out exactly what data they keep, how they
anonymize it and what they do with it. Red flags include saving your data for
longer than necessary, logging activity for non-security purposes like
marketing, or claiming that the privacy policy does not apply to partners or
parent companies.

7. Check the VPN's ability to change geolocation

When a VPN changes your virtual location, it needs to do so in a way
destination servers can't see through. The sites you'd want to change your
location for, like Netflix, YouTube and sports streams, block content in
regions where they don't have a licensing agreement to stream it (that's why
Netflix libraries change in every country). These sites know VPNs can
circumvent their blocks, so they ban VPN access whenever they detect it.

A VPN can change your virtual location to switch up what's available on
streaming -- so you can, for example, watch Friends on Netflix in the US.Sam
Chapman for Engadget

The best VPNs fight back by updating their server IP addresses quickly enough
that streaming platforms can't block them. We test a VPN's unblocking ability
by connecting to multiple streaming websites ΓÇö each in several different
countries ΓÇö and looking for proxy errors. We check to see if content is
accessible and whether speeds remain fast enough to view it.

8. Investigate the server network

A VPN's "server network" is the selection of IP addresses it lets users
connect to. Large server networks are a common selling point for VPNs, which
argue that more servers means better performance and more locations means
more options to circumvent blocks.

While it's true that a larger network is a good sign, it's easy to
artificially inflate the numbers. For one thing, a VPN provider can set up
virtual servers with IPs from locations where it isn't physically present.
This is helpful for getting locations in countries like China and India that
ban most VPNs, but means you can't always trust that a server which looks
close to you actually is.

Sam Chapman for Engadget

It's also common for providers to rent server space from third-party data
centers to get more locations out faster. While convenient, this adds more
potential failure points, since the data center operators may not follow the
VPN's security standards (this is how NordVPN was briefly compromised in
2018).

When reviewing a VPN, we investigate not just the quantity of its server
network, but also its quality. If it doesn't disclose which servers are
virtual and/or rented, we check the IP addresses of suspicious locations and
research whether the VPN has worked with data center providers.

9. Test all extra features

Most VPNs include features beyond the core ability to connect to a server.
These extras range from vital security measures like kill switches (which cut
you off from the internet if you aren't connected to a VPN server) to
tangential nice-to-haves like ad and malware blockers (which often work well
but can't replace a designated antivirus).

VPN special features can get elaborate -- NordVPN Meshnet is one of the most
extensiveSam Chapman for Engadget

We test two things: whether these features work and whether they're easy for
beginners to use. The former depends on the feature ΓÇö for example, for an
ad-blocker, we'll see if it blocks different types of ads. The latter is
qualitative and depends on where the feature is found in the VPN app, how
well it explains itself and what customization options exist.

10. Use the customer service options

No VPN client is so well designed that you'll never need help. Good customer
support starts with an up-to-date knowledge base written in clear English by
a human author, with logical organization and plenty of screenshots. An
active user community is a bonus, whether hosted on the VPN site or somewhere
else (often Reddit).

We test each VPN's customer support options by using them ourselves.Sam
Chapman for Engadget

Most VPNs have other tech support options, generally live chat and/or email
tickets. We test both by submitting a simple question. With live chat, we
determine whether it's possible to talk with a human and how long it takes to
reach that point. With email, we measure how long it takes to get a reply
from the experts and how useful it is for solving the problem.

11. Investigate the VPN's background

The first step is to find out exactly who we're dealing with. We comb through
the VPN's history since its launch, looking for any security breaches,
violations of its own privacy policy or any attempts to pull the wool over
the customers' eyes. News archives are the best source, but we also
incorporate academic research by security investigators and published third-
party audits of the VPNs themselves.

When we find black marks on a VPN's record, we try to place them in context.
A past security breach doesn't necessarily disqualify a VPN from our
recommendation ΓÇö most of the best options have slipped up at least once.
The best evidence comes from how the provider responded to the incident. Did
they change anything or double down? Did their recovery produce lasting
improvements, or did the same problem happen again a year later?

Privacy violations are much more serious. A VPN that breaks its agreement to
not log information on its users cannot be trusted to keep its word in the
future without evidence of drastic internal change. Another major red flag is
a lack of transparency, like when it's unclear where a VPN is based or who
owns it.

Get started with our VPN reviews

Reviewing a VPN is a matter of patient investigation, rigorous testing and an
unwillingness to take anything at face value. We're constantly refining our
process, so we'll make sure to update this page whenever we change any of the
steps above.

Now that you understand our process, you're ready to dive into our coverage
of the best VPN services (soon to get an extensive update), or head straight
to our in-depth ExpressVPN review to see the process in action.

This article originally appeared on Engadget at
https://www.engadget.com/cybersecurity/vpn/ho...
175845189.html?src=rss

---
VRSS v2.1.180528