How to choose a VPN: what to check before you pay

Most VPN sales pages look alike, and nearly all of them promise speed, privacy and freedom. The useful differences are in the details: who runs the service, what it records, how the apps behave when the connection drops, and how easily you can get your money back. This guide gives you a practical list of things to check before you pay.

Start by defining your goal

A VPN is a tool, and the right one depends on the job. Write down in one sentence why you want it. Common reasons are safer use of public Wi-Fi, keeping browsing activity away from your internet provider, reaching a service while travelling, or connecting to a home network. If you are not sure how the technology works, read our explainer on what a VPN is first.

Your goal changes what matters. A VPN does not make you anonymous, as our guide on VPN privacy myths and limits explains. For public Wi-Fi, reliable apps on your phone and laptop matter more than a long server list. For changing your apparent location, server locations and speed matter more. For reducing what your internet provider sees, the VPN company's own logging practices matter most, because you are moving trust from one company to another.

No-logs claims and independent audits

A VPN provider can see your real internet address and, in principle, the sites you connect to. That makes the logging policy the most important part of the service. Almost every provider says it keeps no logs, but the phrase has no fixed meaning. It can mean no record of the sites you visit while still keeping connection times, data volume or device details.

Read the privacy policy, not just the marketing page, and look for plain answers to these questions.

• Does the provider store your real address or connection timestamps, and for how long?
• Does it record the sites or services you visit?
• What does it collect at sign-up, and how is payment handled?
• What diagnostic or analytics data do the apps send back?

A promise is stronger when someone outside the company has checked it. Some providers pay independent firms to audit their systems or their no-logs claims, and publish the result. Read the scope. An audit may cover only part of the infrastructure, it reflects one moment in time, and it does not guarantee future behaviour. Be careful with words like "audited" or "verified" that come without a link to the actual report.

Jurisdiction and ownership

A VPN company is based somewhere, and the laws of that place affect what it can be forced to hand over and what it may promise. Some countries have strong data protection rules, others can order companies to keep or share records. Laws differ by country and change over time, so check the rules that apply to you and to the company rather than trusting a general claim that one place is safe.

Ownership matters just as much and is often harder to find. You should know who is behind the product you trust with your traffic. Look for a company name, a registered address, named leadership and a history you can verify independently. A service that offers only a contact form is asking for a lot of trust and giving little in return.

Protocols and open source apps

A protocol is the set of rules your device and the VPN server use to build the encrypted connection. Common, widely reviewed choices include OpenVPN, WireGuard and IKEv2. Many providers also offer their own custom protocol. That may work well, but outsiders find it harder to examine, so it is reasonable to prefer a service that also supports a well-known open standard.

Check which protocols are available on which devices, and whether you can switch between them. Having a choice helps when one protocol is slow or blocked on a particular network. Make sure the default is a modern one.

Open source apps are another useful signal. When the code is published, independent developers can read it, test it and report problems. That does not make a product safe by itself, because published code can still contain mistakes. Still, a provider that opens its apps to inspection gives you more to verify. If the apps are closed, look harder at audits and the company's track record.

Kill switch and leak protection

A VPN only helps while the tunnel is up. If the connection drops, your device may quietly return to the normal network and expose your traffic with no warning. A kill switch blocks internet access until the VPN reconnects. If you use a VPN for privacy rather than convenience, this is close to a must-have.

Check how it works on each platform you use. Some kill switches exist only on desktop, some are off by default, and phones handle network changes differently. Also look at what happens when you move between Wi-Fi and mobile data, since that is when many leaks occur.

• DNS leaks: your device asks your normal provider to look up site names instead of using the VPN, which reveals the sites you visit.
• IPv6 leaks: a service that handles only the older address format may let newer traffic bypass the tunnel.

You can test for these yourself. Connect to the VPN, open one of the free leak testing pages, and check that the address and DNS servers shown belong to the VPN and not to your internet provider. Repeat after switching networks and after a dropped connection.

Server locations and simultaneous devices

A large server count sounds impressive but tells you little. What matters is whether the service has servers where you need them and runs them well. Some providers use virtual locations, where a server sits physically in one country but is listed as another. That can be fine for some purposes and misleading for others, so look for a note in the documentation.

Count the devices you want to protect, including phones, laptops, tablets and possibly a router. Providers set different limits on simultaneous connections. Check whether the limit applies to devices or connections, and whether a router counts as one device for the whole home. For more on setups beyond a single computer, see our guide on using a VPN on a phone, router and streaming devices.

Testing speed honestly

Every VPN adds some overhead, because your traffic takes a longer route and is encrypted along the way. The effect depends on server distance, protocol, the provider's network and your own connection. Sales page claims are rarely tested under your conditions, so test it yourself.

1. Run a speed test without the VPN and note download, upload and latency.
2. Connect to a nearby server and repeat the test several times, at different times of day.
3. Try a distant server, since distance affects speed and delay.
4. Test what you actually do, such as video calls or large downloads, not only a number.

A single result means little, because networks vary from minute to minute. Look for patterns. Your own plan also sets the upper limit, so a fast VPN cannot make a slow line fast.

Free VPNs and how they earn money

Running a VPN costs money for servers, bandwidth, development and support. A service that does not charge you has to cover those costs another way. Some free tiers are honest samples of a paid plan, with limits on data, speed or locations. Others earn money in ways that work against your privacy.

• Advertising and tracking: the app may show ads or share usage data with partners.
• Selling data: some services have been accused of passing browsing information to third parties.
• Pressure to upgrade: tight caps, slow speeds and crowded servers push you towards paying.

Not every free option is harmful. A free tier from a company that also sells a paid plan, with a clear policy and published audits, can be a sensible way to try the software. The risk is greatest with anonymous apps that show no company information. If you cannot explain how the service pays its bills, assume that you or your data are part of the answer. A paid plan is not automatically safe either, so the other checks still apply. We explain pricing in our guide on VPN prices and renewals.

Refund windows and how to test within them

A refund window is your safety net, but only if you use it. Read the terms before you buy: how long it lasts, when it starts, how to claim, which plans it covers and whether any part of the payment is excluded. Consumer rights around cancellation differ by country, so check your local rules as well as the provider's terms.

The window runs from purchase, so plan your testing before you pay.

1. Day one: install the apps on every device you intend to use and confirm that sign-in, connection and the kill switch work.
2. First few days: run leak and speed tests at different times and use the VPN in your normal routine.
3. Midway: test the specific thing you bought it for. Do not assume any service will unlock a particular site, because services change how they treat VPN traffic without notice.
4. Contact support: ask a real question and note how quickly and clearly you get an answer.
5. Before the window closes: decide. If you are not satisfied, request the refund in writing and keep the confirmation.

Turn off automatic renewal if you are unsure, and take screenshots of the plan, price and terms on the day you buy.

Support quality

Look for setup guides for each platform and a way to reach a person. You can judge support before buying by sending a pre-sales question, such as what the service logs or how the kill switch behaves on your phone. A clear, honest answer is a good sign. A vague or copied reply is a warning. A provider that says "we cannot guarantee that" is usually more trustworthy than one that promises everything.

Criteria comparison table

This table summarises what to look for and what should make you cautious. It lists criteria, not providers, and works as a template for comparing services side by side.

VPN selection checklist

Go through this list before you enter payment details. If you cannot tick most items, keep looking or ask the provider more questions.

• Write down your main goal in one sentence.
• Read the privacy policy and note what is logged and for how long.
• Find a published audit report and check its scope and date.
• Identify the company, its country and its owner.
• Check for a kill switch on your platforms, and plan DNS and IPv6 leak tests.
• Understand how the service makes money, especially if it is free.
• Read the refund terms and put the deadline in your calendar.
• Turn off auto-renewal while you are still testing.

Key takeaways

• Define your goal first, because the best VPN for public Wi-Fi is not necessarily the best one for changing your location.
• A no-logs claim is only a promise. Look for specific wording and an independent audit report, and read its scope.
• Jurisdiction and ownership tell you who you are trusting. Laws differ by country, so check the local rules.
• Test speed and leaks yourself, at different times and on different networks.
• Free services must earn money somehow, so find out how before you install one.
• Use the refund window deliberately and cancel on time if the service does not fit.
• No VPN can promise anonymity or guaranteed access to any streaming service, so be wary of anyone who does.