This methodology explains what we examine, how we control a test and how evidence becomes a score. It is written so readers can understand the limits of every result and editors can repeat the process consistently.
What our methodology is designed to answer
Our testing process starts with a practical question: how well does a VPN protect a real connection while remaining usable on the devices people rely on? We examine privacy, security, speed, reliability, streaming access, applications, support and total subscription cost. Each category is assessed separately so that one impressive result cannot hide a serious weakness elsewhere.
Research and evidence collection
Before hands-on checks begin, we record the provider’s ownership, legal jurisdiction, privacy policy, independent audits, supported protocols, application versions, server claims and current plan terms. Provider statements are treated as claims until they can be supported by technical documentation, a credible independent source or a repeatable observation. Sources and the date checked are kept with the review notes.
Test environment and controls
Performance results depend on the connection, hardware, operating system, protocol, server distance and network congestion. We therefore record the device, OS version, app version, ISP connection, baseline speed, protocol, test server and time window. The same baseline and test method are used for comparison, and unusual results are repeated before they influence a conclusion.
Speed, latency and connection stability
We compare download speed, upload speed and latency against an unprotected baseline. Nearby and long-distance locations are tested more than once, with medians preferred over a single best run. We also watch for failed connections, unexpected disconnects and large swings between repeated tests. Results describe the measured setup and are not promises of the speed every reader will receive.
Privacy and logging review
We read the privacy policy and supporting documentation to identify what account, device, diagnostic and connection information may be collected, why it is processed and how long it may be retained. We examine company ownership, jurisdiction, audit scope and past incidents where reliable documentation exists. An audit is useful evidence for the period and systems it covered; it is not a permanent guarantee.
Security and leak checks
We review encryption, protocol choices, authentication, kill-switch behavior and protective defaults. During a controlled connection interruption, we check whether traffic is exposed before the app recovers. IPv4, IPv6, DNS and WebRTC results are checked where the platform supports them. A pass applies to the tested device and configuration, so material platform differences are reported.
Apps, features and device coverage
Desktop and mobile applications are assessed for installation, clarity, connection controls, automatic protection, accessibility and consistency. Features such as split tunneling, multi-hop routes, obfuscation, ad blocking and router support are verified by platform because availability often differs between Windows, macOS, Android, iOS and other devices.
Streaming, P2P and restricted networks
Streaming checks use legitimate accounts and ordinary playback attempts on disclosed platforms. Access can change without notice, so results are dated and never described as guaranteed. For P2P, we review provider rules, server availability and relevant technical limits without encouraging copyright infringement. Claims about censored or restricted networks require current, location-specific evidence.
Pricing and value assessment
We compare the amount charged at checkout, contract length, introductory rate, renewal price, tax treatment, refund window and included features. A low monthly equivalent does not automatically receive a high value score when it requires a large upfront payment or renews at a much higher rate. Prices are dated because promotions and regional terms change frequently.
Scoring and weighting
Category scores summarize the documented evidence and test results available on the review date. Privacy and security receive the greatest weight because they are central to a VPN’s purpose; performance, reliability, usability, support and value also contribute. Editors may adjust a final score when a serious limitation would be hidden by a simple average, but the reason must be explained in the review.
Retesting and corrections
Major application releases, ownership changes, policy revisions, security incidents and material pricing changes can trigger a review update. A changed date means the relevant evidence was checked, not that every test was repeated. Confirmed factual errors are corrected promptly, and a conclusion is revised when the correction changes the product assessment.
Limits of our testing
No laboratory can reproduce every home network, device, country or future service change. Our results are a dated comparison under stated conditions, not a guarantee of anonymity, compatibility or uninterrupted access. Readers should verify current plan terms and use the refund period to test a service on their own connection.
Questions or corrections?
Send us a question about a test, request clarification or provide evidence that may improve a published result.