What Is a VPN: Settings, Privacy Rules, and the Best VPN Services in 2026

What is a VPN and how does it actually work? VPNs are used by millions of people, but most use them incorrectly. Some turn one on once a week when they need to access a blocked website. Some believe a VPN makes them anonymous online. Some choose the first free service they find, log in to their accounts through it, and then wonder where leaks come from.

This article is for anyone who wants to understand how a VPN actually works, which rules matter if you do not want to harm your privacy, and which services are reasonable choices in 2026.

What is a VPN: what it does and does not do

VPN (Virtual Private Network) is an encrypted tunnel between your device and a VPN provider’s server. All traffic passes through that tunnel: your internet provider can see that you are connected to a VPN, but not which websites you visit. Websites see the VPN server’s IP address instead of your real IP. That is the technical core. Everything else is about protocols, servers, and specific implementations.

What a VPN gives you:

• Protection for traffic on public networks. Cafes, hotels, airports, and universities are places where a network administrator may be able to inspect unencrypted traffic. With a VPN, the network provider sees only that you are connected to a VPN server and nothing more.
• A different geolocation. This works both ways. If you are abroad and want to access Diia or Army+, connect to a Ukrainian server and receive a Ukrainian IP address. If a service is blocked in your region, use a server in another country.
• A way around ISP-level blocking. If your internet provider blocks domains at the DNS or transport level, a VPN can bypass that restriction.
• Protection from basic ISP monitoring. Your internet provider can see the list of domains you visit through DNS and SNI. A VPN hides this: the provider sees only that you are connected to a VPN server.

What a VPN does NOT give you:

• Complete anonymity online. If you log in to Google through a VPN, Google still knows it is you. Your browser stores cookies, a fingerprint, and history. A VPN changes your IP address, but does not hide who you are.
• Protection from phishing and malicious websites. A VPN does not check where you click. It encrypts traffic. A fake link will reach you in exactly the same way.
• Protection from browser fingerprinting. Websites can identify you through your browser configuration, fonts, canvas, GPU, and hundreds of other parameters. A VPN does not hide these. Specialized browsers address this problem: Tor Browser, Mullvad Browser, or Brave with the right settings.
• Protection from access to your device. If malware is already installed on your system, a VPN will not help.

Threat model: the main question before choosing a VPN

Before choosing a VPN, answer one question honestly: who are you protecting yourself from?

• Your internet provider and the owner of a public network. This is the most common scenario. Any decent paid VPN solves it.
• Advertising networks and Big Tech. A VPN helps only partly: it hides your IP and makes location-based targeting harder. Without a properly configured browser and tracker blocking, that is not enough.
• A government. It depends on the country. If you are in Ukraine and simply want more privacy, any audited VPN with a no-logs policy that does not store activity logs can work. If you are in Russia, Iran, or China, you need obfuscation tools such as Shadowsocks, V2Ray, or specialized plugins. Ordinary VPN traffic is detected and blocked there.
• A global adversary such as the NSA, FSB, or other intelligence services. A VPN will not help. You need Tor and disciplined OPSEC, and even that is not a guarantee.

The more precisely you understand who you are protecting yourself from, the easier it is to choose a tool. If you do not have a threat model, default to protecting traffic on networks and improving basic online privacy. That is enough for 95% of users.

Protocols: WireGuard, OpenVPN, IKEv2

A protocol is the algorithm used to establish and encrypt the tunnel between your device and a server. In 2026, paid VPNs commonly offer three standard protocols plus proprietary forks.

WireGuard. The current standard. The official WireGuard website describes it as a fast, modern protocol that uses up-to-date cryptography. It has around 4,000 lines of code compared with tens of thousands in OpenVPN, which simplifies auditing and reduces the attack surface. It is significantly faster than OpenVPN, especially on mobile devices. Modern cryptography: ChaCha20, Curve25519, BLAKE2s. If your VPN supports WireGuard, it should be the default. The alternatives below matter only when WireGuard does not work for some reason.

OpenVPN. An old and reliable protocol dating back to 2001. It has been audited for years and is slower than WireGuard, but remains stable on difficult networks. Some corporate VPNs still use it as the primary option. Mullvad announced that it is ending OpenVPN support entirely in 2026 and keeping only WireGuard. Other providers still offer both, but the direction is clear.

IKEv2/IPsec. Useful on mobile devices because it reconnects quickly when switching between Wi-Fi and cellular networks. In ordinary scenarios, there is little reason to choose it over WireGuard.

Proprietary protocols. NordVPN’s NordLynx is a wrapper around WireGuard with its own IP anonymization system. ExpressVPN’s Lightway was built from scratch, audited by Cure53, and designed for fast reconnection with minimal overhead. Both work, but if your threat model is strict, open WireGuard is preferable.

Default choice: WireGuard. If your provider does not support it in 2026, consider whether you should stay with that provider.

Rules for using a VPN with maximum privacy

A VPN will not protect you by itself. The application is not what protects you; your usage habits do. The most common mistake is treating a VPN as an “anonymity button.” It is not one. Below are specific rules that turn a VPN from decoration into a useful tool.

Privacy ≠ anonymity

This is the main source of confusion for most users.

Privacy means third parties along the route cannot see your traffic. Your internet provider cannot see which websites you visit. The administrator of a hotel Wi-Fi network cannot see what you are doing. The website you visit does not know your real geolocation from your IP address.

Anonymity means nobody can connect your online activity to your real-world identity. That is a different task, and a VPN does not solve it. The moment you log in to Google, Facebook, Telegram, or your exchange account, you place an “it’s me” signature over the entire VPN setup. The website knows who you are and can logically observe your activity from that point onward.

Conclusion: a VPN gives you privacy. Anonymity requires Tor, a separate pseudonymous account, a separate device, and discipline. That is another level.

Anonymous payment: when it matters

A payment trail ties your identity to a VPN account. If you pay for a subscription with a Visa card in your name, the provider technically knows who you are even if it does not keep activity logs.

For most scenarios, this is not a problem. If your goal is to protect your connection on cafe Wi-Fi, it does not matter whether the provider knows your name. It does not keep traffic logs, so there is nothing useful to link to you.

Anonymous payment matters in two cases: you live in a country where the use of a VPN itself may be a problem, or your threat model includes a scenario in which a VPN provider is forced to disclose user information through payment records.

Services that support anonymous payment:

• Mullvad accepts Monero, Bitcoin, and cash sent by mail in an envelope. It does not require an email address at registration and issues a 16-digit account number. Cryptocurrency payments receive a 10% discount.
• NordVPN accepts cryptocurrency. An email address is required, but you can create an anonymous one.
• Proton VPN accepts cryptocurrency and also offers a functional free plan.

If you are a crypto user, paying for a VPN with Monero is one of the few practical everyday use cases for Monero. Paying for privacy with a public card funded through a KYC exchange looks slightly comical.

DNS leaks and WebRTC leaks: check them

A VPN may be configured perfectly, but if your DNS request travels outside the tunnel, your internet provider still sees the domains you visit. This is called a DNS leak.

WebRTC is a separate issue. It is a browser technology for voice and video calls that can reveal your real IP address even when a VPN is active. The browser can access the network stack directly, bypassing the VPN.

How to check: for DNS, use dnsleaktest.com or ipleak.net. For WebRTC, use browserleaks.com/webrtc. Connect to the VPN and open those websites. If the results display your real IP address or your internet provider’s IP, you have a leak.

What to do: switch DNS in the VPN application settings. There is usually an option such as Use VPN’s DNS only. Disable WebRTC in the browser. In Firefox, set media.peerconnection.enabled = false in about:config. In Chrome, use an extension such as WebRTC Network Limiter.

Kill switch: always enable it

A kill switch instantly cuts all internet traffic on the device if the VPN connection drops. Without it, every second spent reconnecting is a second in which your traffic reaches the open internet with your real IP address.

In 99% of cases this is not a disaster, but if you are using a VPN for a task that requires protection, the kill switch must always be enabled. Every decent provider has one. Make sure it is active. The name varies: ProtonVPN and NordVPN call it kill switch, while Mullvad calls it lockdown mode.

Do not log in to personal accounts through an “anonymous” VPN

A classic mistake. You configure a VPN for anonymity, pay with cryptocurrency, leave no obvious trail, and then check Gmail using your primary account. That is it: your “anonymity” is broken. Google connects your main account to a specific IP address at a specific time.

If you need real anonymity, maintain two sets of accounts and make sure you never mix them. It is better to use a separate browser or profile for “anonymous” activity.

Your browser matters more than your VPN

Websites identify you by more than your IP address. A browser fingerprint, meaning the combination of your extensions, fonts, Canvas settings, GPU, and language parameters, is unique in many cases. That means a website may recognize you even after you change your IP with a VPN.

If privacy is your goal:

• Basic level: Brave or Firefox with tracker protection enabled.
• Higher level: Mullvad Browser. It is a fork of Tor Browser without Tor itself, designed to make all users look the same to websites.
• Maximum level: Tor Browser. It is slower and looks suspicious to some websites, but it hides the fingerprint most effectively.

A VPN plus ordinary Chrome with all your extensions is not privacy. It is only an IP address change.

What never to do

Free VPNs. There are two exceptions on the market: Proton VPN Free, which follows the same no-logs principles as the paid plan and has no traffic limit, and Windscribe Free with a 10 GB monthly limit. Everything else advertised as a free VPN is either a service that sells your data to advertisers or malware. In 2015, Hola sold users’ bandwidth as a botnet. Facebook’s Onavo collected data for competitive intelligence. Hotspot Shield had a real IP and geolocation leak vulnerability in 2018, and its free plan still shares geolocation with advertisers.

VPNs under Russian or Chinese jurisdiction. The issue is not the technology, but the fact that these services are legally required to cooperate with the relevant intelligence agencies upon request. Do not use them.

VPNs without audits of their no-logs policy. Anyone can claim “we don’t keep logs.” In 2017, PureVPN handed session logs to the FBI despite officially claiming not to keep them. Without an independent audit, no-logs is marketing.

VPNs with opaque ownership. If you cannot quickly understand who stands behind a brand, that is a problem. Kape Technologies, the owner of ExpressVPN, became a private company in 2023 and stopped publishing financial reports. That does not automatically make ExpressVPN bad, but transparency decreased.

What to look for when choosing a service

VPN marketing is so standardized that it is impossible to distinguish a good service from a bad one by the promotional website alone. These are the criteria worth evaluating.

Jurisdiction. The country where the company is registered determines mandatory data-retention laws and participation in international intelligence-sharing systems.

• Good jurisdictions: Switzerland (Proton VPN), Panama (NordVPN), the British Virgin Islands (ExpressVPN), Sweden (Mullvad; although Sweden is a member of 14 Eyes, Swedish law does not require VPN logs), and Romania (CyberGhost, outside 5/9/14 Eyes).
• Questionable jurisdictions: the United States, United Kingdom, Australia, Canada, and New Zealand, which form the 5 Eyes intelligence-sharing alliance, as well as the expanded 9 and 14 Eyes groups, including the Netherlands, France, Germany, and others.
• Avoid: Russia, China, Iran.

Jurisdiction is not everything. PIA (Private Internet Access) is based in the United States but has a court-proven no-logs track record: it has received FBI subpoenas several times and had nothing to provide. Surfshark is based in the Netherlands, a 9 Eyes country, but audits confirm its no-logs policy. Jurisdiction is a risk factor, not a verdict.

Verification of no-logs claims. “No-logs” means the provider does not keep logs of your activity. Anyone can make that claim, so trust should be reserved for providers whose promises have been tested by an independent auditor. There are three levels of evidence.

• Independent audit. An external company such as Deloitte, PwC, KPMG, or Cure53 checks infrastructure and server configuration. This is the most common format and the basic standard.
• Transparency report. A provider regularly publishes how many government data requests it received and how often it refused them. Proton VPN and CyberGhost do this regularly.
• Court-tested. A real case in which a provider was forced to produce data but had nothing to provide is the strongest proof. Mullvad passed that test during a Swedish police raid in 2023. PIA has done so several times in US courts.

RAM-only servers. Servers without hard drives: all data resides in RAM. Rebooting a server erases everything. This is not a cure-all, but it complicates a scenario in which someone physically seizes a server and extracts data. NordVPN, ExpressVPN, Surfshark, CyberGhost, and Mullvad use RAM-only servers.

Number of servers and countries. More is not always better. PIA advertises 35,000+ servers, Proton 19,000+, CyberGhost 11,000+, NordVPN 8,300+, and Mullvad around 700. Mullvad has fewer, but the company physically owns its servers instead of renting them. That is more than enough for ordinary tasks. The number of countries matters if you need a specific region.

Speed. Speed tests depend on your location, internet provider, and selected server. A general rule: WireGuard is 2–5 times faster than OpenVPN. NordVPN consistently ranks among the best performers in independent tests over recent years. Proton VPN and ExpressVPN are close. Mullvad is fast on nearby servers but slower on distant ones because it has fewer locations.

P2P and torrents. If you download files through torrents, make sure the provider does not block P2P traffic. NordVPN, Mullvad, Proton VPN, Surfshark, CyberGhost, and PIA allow it. ExpressVPN permits it on most servers.

Multi-hop / Double VPN. Traffic passes through two VPN servers in sequence. This makes correlation harder and reduces risk if one server is compromised. Available from NordVPN (Double VPN), Proton VPN (Secure Core), Mullvad (Multihop), and Surfshark.

Streaming. If you need another region’s Netflix, BBC iPlayer, or Disney+, ExpressVPN, NordVPN, and CyberGhost traditionally bypass VPN detectors most effectively. Proton VPN’s paid plan also works. Mullvad is not designed for streaming and is often blocked.

Payment methods. If you need anonymity, use Monero, cash by mail with Mullvad, or at least Bitcoin. Otherwise, Visa and Mastercard cards issued by Ukrainian banks work: Western providers accept them without problems. PayPal, Apple Pay, and Google Pay are available where supported.

Company ownership. Mullvad is a private Swedish company, Mullvad VPN AB. Proton VPN belongs to Swiss company Proton AG. NordVPN and Surfshark are part of Nord Security after merging in 2022. ExpressVPN, CyberGhost, Private Internet Access, and ZenMate belong to Kape Technologies, which has been owned by Unikmind Holdings since 2023. The fact that one holding company owns multiple brands does not automatically make them bad, but it is worth considering.

Top VPN services in 2026

We examine real strengths and weaknesses. We do not have a “favorite” service because each option is suitable for a different set of tasks.

Mullvad: maximum privacy

Jurisdiction: Sweden. Servers: ~700 in 50+ countries, all RAM-only, some company-owned. Price: a fixed €5 per month, with no discount for long subscriptions. Payment: cash by mail, Monero, Bitcoin, bank transfer, card, PayPal.

Mullvad is a rare case in a market where a company sacrifices convenience for privacy. Registration requires no email or password: you receive a 16-digit account number that serves as your login. You can pay anonymously by sending an envelope with cash and the account number to Sweden, after which the company adds time to your account.

In 2023, Swedish police arrived with a warrant to seize user data. They could not take anything because nothing was stored. This is the strongest real-world no-logs test passed by any VPN on the market.

Strengths:

• Regular audits: X41 D-Sec, Assured Security, NCC Group, SEC Consult in 2025–2026.
• DAITA, Defence Against AI-guided Traffic Analysis: random traffic injection to protect against traffic analysis.
• Its own Mullvad Browser, a fork of Tor Browser.
• Open-source clients.

Weaknesses:

• OpenVPN is being removed in 2026, leaving only WireGuard. This is not a problem for most users.
• Not suitable for streaming. Netflix and BBC iPlayer do not work.
• Fewer servers than competitors.
• The interface is minimalist and may feel unfamiliar to beginners.

Who it is for: users who treat privacy as the top priority; crypto users handling significant amounts; journalists, activists, and security researchers.

Proton VPN: the best balance

Jurisdiction: Switzerland. Servers: 19,000+ in 145 countries on the paid plan. Price: from $4.99 per month with a two-year subscription. Free plan without a traffic limit. Payment: card, PayPal, cryptocurrency, cash by mail.

Proton VPN is part of the Proton ecosystem: Proton Mail, Drive, and Pass. It offers a Swiss jurisdiction, open-source clients on every platform, regular audits in 2022, 2023, and 2024, and an annual transparency report. In 2024, Proton VPN received 53 legal requests and could not provide data in any of those cases because it had none.

Proton VPN’s free plan is the only reasonable free VPN on the market. There are no ads, no traffic limits, and no dark patterns. You connect to 10 countries but cannot choose a specific server. Speed is lower than on the paid plan but sufficient for everyday use.

Strengths:

• Secure Core: multi-hop through servers in Switzerland, Iceland, and Sweden.
• Stealth protocol for bypassing deep packet inspection in countries with blocking.
• Open-source clients and audited code.
• Integrated Proton Mail, Drive, Pass, Calendar, and Wallet if you already use the ecosystem.

Weaknesses:

• Long-term plans are more expensive than NordVPN and Surfshark.
• Refunds are pro-rata only, rather than a full 30-day refund like competitors offer.
• Unreliable in China.

Who it is for: privacy-focused users who do not want to lose functionality. The free plan is the optimal option for anyone who wants to try a VPN without paying.

NordVPN: best for everyday use

Jurisdiction: Panama. Servers: 8,300+ in 129 countries, all RAM-only. Price: from $3.39 per month with a two-year subscription. Payment: card, PayPal, cryptocurrency, Apple Pay, Google Pay.

NordVPN is the most popular mass-market VPN and one of the fastest in many tests. Deloitte audits in 2022, 2023, and 2024 and PwC audits in 2018 and 2020 confirmed its no-logs policy. In 2025, Cure53 also completed a security audit of the infrastructure.

NordLynx is a wrapper around WireGuard that addresses the original protocol’s static-IP issue.

Strengths:

• Speed consistently ranks near the top of independent tests.
• Threat Protection blocks trackers and malware at the DNS level.
• Optional Double VPN, Onion over VPN, and dedicated IP.
• Works with streaming services, including Netflix in different regions.
• 10 simultaneous connections.

Weaknesses:

• The jurisdiction is good, but the headquarters is in Lithuania / the Netherlands after the merger with Surfshark, which places it in the EU.
• The desktop interface occasionally breaks after updates.
• One server in Finland was compromised in 2018. The company disclosed the incident a year later, which did not increase trust.

Who it is for: most ordinary users. Speed, streaming, P2P, and all major features.

Surfshark: unlimited devices for a low price

Jurisdiction: the Netherlands (9 Eyes). Servers: 3,200+ in 100+ countries, all RAM-only. Price: from around $2 per month with a two-year subscription. Payment: card, PayPal, cryptocurrency, Apple Pay, Google Pay.

Surfshark has been part of Nord Security, the same group as NordVPN, since 2022, but operates as a separate brand. Its main advantage is one that other providers do not offer: an unlimited number of simultaneous connections on one account. One subscription covers every device in a household.

The Netherlands belongs to the 9 Eyes alliance, whose members exchange intelligence data, but local law does not require log retention. Deloitte confirmed the no-logs policy twice, in 2023 and 2025. The servers are diskless.

Strengths:

• Unlimited connections per account.
• MultiHop through two servers, and CleanWeb to block ads and trackers.
• Camouflage and NoBorders for networks with blocking.
• Works with streaming services, including Netflix.
• One of the lowest prices on the market.

Weaknesses:

• Jurisdiction in the 9 Eyes intelligence-sharing alliance, although there is no log-retention requirement.
• The same parent company as NordVPN, which provides less diversification if that matters to you.
• Speed can be uneven on distant servers.

Who it is for: users who want to protect many devices simultaneously without paying much; families and people with many gadgets.

ExpressVPN: simplicity and streaming, with a caveat

Jurisdiction: British Virgin Islands. Servers: 3,000+ in 105 countries, RAM-only (TrustedServer). Price: from $4.99 per month with a two-year subscription. Payment: card, PayPal, cryptocurrency.

ExpressVPN has traditionally been one of the best services for streaming and ease of use. It has undergone more than 20 audits by KPMG, PwC, and Cure53. It uses its own Lightway protocol. A real case from Turkey in 2017 showed that ExpressVPN could not provide logs in response to an official request because none existed.

Strengths:

• One of the best options for bypassing geoblocks on streaming services.
• Lightway works quickly and reliably on unstable networks.
• Simple interface with little room for configuration mistakes.
• 8 simultaneous connections.

Weaknesses:

• Expensive compared with competitors.
• Owner Kape Technologies is not the most transparent structure.

Who it is for: users who value convenience and streaming. Not the best option if privacy is the top priority.

CyberGhost: a large network and streaming, also under Kape

Jurisdiction: Romania, outside 5/9/14 Eyes. Servers: 11,000+ in 100 countries, RAM-only. Price: from around $2 per month on a long-term plan, with 45 days for refunds. Payment: card, PayPal, Bitcoin through BitPay.

CyberGhost maintains one of the largest server networks on the market and offers servers optimized for specific tasks: separate ones for streaming and separate ones for torrents. Romanian jurisdiction does not require data retention and is outside intelligence-sharing alliances.

Deloitte Romania audited the no-logs policy in 2022, 2024, and again in 2026. The company publishes a quarterly transparency report, more often than most competitors. NoSpy servers are located in CyberGhost’s own Romanian data center and can be accessed only by CyberGhost staff.

Strengths:

• A very large network of servers and countries.
• Dedicated servers for streaming and torrents.
• Some of the industry’s most frequent transparency reports, plus a bug bounty program.
• A 45-day refund window, the longest on the market.

Weaknesses:

• Kape Technologies ownership and associated review websites.
• 7 simultaneous connections, fewer than competitors.
• More transparent options exist for maximum privacy: Mullvad and Proton.

Who it is for: users who want many locations and stable streaming at a low price and are not concerned by the ownership structure.

What to avoid

• PureVPN. It handed session logs to the FBI in 2017. IPv6 leaks and firewall-rule errors were found in 2025. It has the worst real-world track record among popular VPNs.
• Hotspot Shield. It had a geolocation leak vulnerability in 2018, and the free plan shares location data with advertisers.
• Any “free” VPN from the App Store or Play Store other than Proton VPN. Most sell data or integrate advertising.
• VPNs under Russian or Chinese jurisdiction, regardless of marketing promises.
• A VPN promoted through bonus codes on YouTube or Twitch without audits. Marketing first, technology later.

Summary table

A quick comparison by key criteria. Details are in the sections above.

How this fits into your overall OPSEC

A VPN is one layer of protection, not complete protection. If you are a crypto user and take OPSEC seriously, a VPN fills a specific niche:

• Protection for traffic when using exchanges and web3 services, especially on networks you do not trust.
• Access to services that block Ukrainian IP addresses. Some crypto services use sanctions scripts that indiscriminately block IP addresses associated with Ukraine.
• A smaller attack surface through your ISP. Your provider cannot see that you are accessing an exchange and cannot become the starting point for targeted phishing.

What a VPN does not do:

• It does not protect you from losing your seed phrase. That requires a hardware wallet. We covered the basic backup methods in “Seed phrase storage: 5 safe methods in 2026”.
• It does not protect you from phishing. That requires attention and a hardware wallet that confirms transactions on the device.
• It does not provide on-chain anonymity. Transactions are public. If your address has ever been linked to KYC, all subsequent transactions are visible.

A VPN is infrastructure. A hardware wallet, seed phrase, password manager, and security keys solve other problems that a VPN does not address.

Conclusion

The practical answer to the question “what is a VPN?” is simple: it solves a specific and narrow problem. It hides your traffic from your internet provider and the owner of the network and changes your geolocation. It does not make you anonymous or protect you from phishing or malware.

Start with a threat model. For 95% of users, any paid VPN with an independent no-logs audit is enough: it protects public networks and basic privacy. If your scenario is more serious, such as a country with blocking, a need for anonymous payment, or a risk that user data may be requested, narrow the list to services with a no-logs policy tested in practice and payment through Monero or cash.

The profile-based recommendations are simple. NordVPN or Proton VPN cover almost everything for everyday use. Choose Mullvad for maximum privacy with anonymous payment. Surfshark is suitable for many devices at a low price. Proton VPN Free is the only reasonable way to try a VPN without paying. CyberGhost and ExpressVPN are strong for streaming, but both belong to Kape, so consider the ownership structure.

Whatever service you choose, the application itself is not what matters. Your usage habits do. Enable WireGuard and the kill switch, check for DNS and WebRTC leaks, do not log in to personal accounts through an “anonymous” VPN, and configure your browser. The boundary remains the same: a VPN is infrastructure, one layer. A hardware wallet protects your seed phrase, a password manager protects passwords, security keys protect access to accounts, and a VPN replaces none of those tools.