How we score VPNs — and what we have not tested

What we have not done

We have not run any of these VPNs ourselves. No speed test, no streaming check, no leak test, no refund claimed and timed. So there is no speed figure, no streaming result and no refund experience anywhere on this site presented as ours, and every review carries a notice saying so.

That is unusual to admit and it costs us. Speed charts are what VPN reviews are made of. But a chart of numbers nobody measured is worth less than no chart, and you would have no way of telling the difference — which is precisely the problem with the genre.

What we do check

Prices, renewal rates, refund windows and device limits, read off each provider's own checkout rather than its marketing page, dated, with the source page recorded for every figure. Audit reports, jurisdiction and ownership. And what actually happened when a provider was asked for user data by a court or a police force — which is the only real-world test of a no-logs claim, and it has a public record.

Last checked September 12, 2026; next October 12, 2026. The full record, including the figures we could not verify and why, lives in data/price-checks/ in the repository.

The five criteria and their weights

The weights are fixed for the calendar year and identical for every VPN. Two of the five are currently unscored, because we have not measured them — so the overall score is the weighted average of the remaining three, renormalised. That is why every score on this site is marked provisional, and why nothing can score above 9.5 until it has actually been tested.

The rubric, in full

It is not prose — it is a script, scripts/score.mjs, which reads the data and produces every number you see. Keeping it as code means the published method and the published scores cannot drift apart.

Privacy & security (30%)

Starts at 8.0 for an independent no-logs audit in the last two years, 6.5 for an older one, 6.0 where only a security or infrastructure audit exists, and 3.0 where nobody has checked the claim at all. Jurisdiction then moves it: +1.0 outside the intelligence-sharing alliances, −0.25 inside the Nine and Fourteen Eyes, and −1.0 inside Five Eyes — a gagged warrant served on a member is shared with the other four, and that is a real cost to a privacy product whatever its audit says. RAM-only servers add 0.5.

Then the part that matters most: +1.5 if the no-logs claim has been tested by a court or a police force and held, −2.0 if data was handed over. Two of the ten have handed data over. Most review sites mention it in passing, if at all, because those two pay well.

Apps & ease (15%)

Platform coverage out of ten, and how many of eight features are present: kill switch, split tunnelling, obfuscation, port forwarding, dedicated IP, ad blocking, multi-hop and RAM-only. Both are checkable on the provider's own site.

Value (15%)

Scored on what three years actually costs — the introductory term at the introductory rate, then the published renewal — not on the headline price. The advertised “2-year” plan is usually 26 to 28 months, and one is 39, so the real term length is used rather than a round number. Unlimited devices adds 1.0 and ten or more adds 0.5; a 45-day refund window adds 1.0, 30 days adds 0.5, and anything shorter subtracts 1.5. A free tier adds 0.5.

This is the choice that decides the ranking, and it is worth being explicit about: scoring the headline rate would reorder this entire page. We score the real cost because the gap between the two is the single most useful thing we can tell you.

Speed (25%) and streaming (15%) — not scored

When we do measure these, speed will be the share of baseline bandwidth retained across four regions, three runs a server, median reported; and streaming will be a title actually playing on 14 services — Netflix US, Netflix UK, Netflix JP, Netflix CA, Netflix AU, Prime Video, Disney+, Hulu, Max, Paramount+, Peacock, BBC iPlayer, ITVX, DAZN — from at least two servers each. Until then both are left out rather than guessed.

Ties

Where two VPNs score the same, the tie breaks on the privacy sub-score, then on jurisdiction. Privacy is the heaviest criterion at 30%, so it is the right thing to break on — and publishing the rule means a tie can never quietly be settled by whichever programme pays best.

What a provisional score means

That it rests on documents and public record rather than on our own measurements. It is enough to tell you which providers have been audited recently, which are incorporated somewhere that can compel them quietly, which have already handed data over, and what each will actually charge you in year two. It is not enough to tell you which is fastest. We will say so on the page rather than let a number imply otherwise.

As each VPN is bought and run properly, its review changes from provisional to tested and the speed and streaming weights come back into its score. The date that happens will be on the review.

What we cannot measure at all

We cannot see inside a provider's servers. A no-logs audit is the best available evidence, not proof, and a court test that held is evidence about one moment, not a guarantee about the next. Where the honest answer is “nobody outside the company knows”, that is what the page will say.

Money

We earn a commission when you buy through links on this site. It has no effect on scores or rank order — and the current ranking is the proof: the VPN at the top pays us nothing, because we have not been accepted into its programme, while the one we earn most from sits sixth. A provider with no affiliate programme at all (Mullvad) is scored exactly like one that has. Full details on the affiliate disclosure page.