Which VPN clients can I actually read the source of?

Mullvad. Clients published as open source. Only providers publishing open-source clients. Ordered by transparency score.

How many providers qualify for this list?

5 of 11. The other 6 are excluded because they do not meet the requirement, and they are named at the bottom of the page rather than quietly dropped.

What does this ranking ignore?

Whether the code has been independently audited — that is a separate page.

5 of 11 qualify · Updated August 13, 2026

VPNs with open-source apps

A closed-source client asks you to trust that it does what the marketing page says. An open-source one lets a researcher check. This page lists providers that publish client source across their platforms, which is a precondition for anyone outside the company verifying leak handling, kill-switch behaviour or telemetry.

The rule for this page. Only providers publishing open-source clients. Ordered by transparency score.

Answer

Mullvad, then IVPN

Clients published as open source. The strongest privacy posture of any provider in this dataset, and the only one we cannot earn a commission from.

Visit Mullvad

We earn nothing from Mullvad. This link is included because the ranking says it belongs here.

Providers that qualify, ordered by the rule above
#	Provider	Deciding fact	Transparency	Overall
1	Mullvad Unpaid	Clients published as open source	10/10	85.5
2	IVPN Unpaid	Clients published as open source	10/10	82.5
3	Proton VPN	Clients published as open source	9/10	90.0
4	Private Internet Access Unpaid	Clients published as open source	8/10	73.0
5	Windscribe Unpaid	Clients published as open source	8/10	67.0

Why these, in order

1. Mullvad

85.5

Clients published as open source. The strongest privacy posture of any provider in this dataset, and the only one we cannot earn a commission from.

Against it: No native app for Apple TV, Android TV or games consoles.

Visit Mullvad

2. IVPN

82.5

Clients published as open source. A deliberately small, transparent operation that costs more than the market and makes no attempt to hide it.

Against it: One of the smallest server networks in this dataset.

Visit IVPN

3. Proton VPN

90.0

Clients published as open source. The best-documented security stack in this dataset, and the only free tier we consider safe to recommend.

Against it: Refunds are prorated against usage, not returned in full.

Visit Proton VPN

4. Private Internet Access

73.0

Clients published as open source. The only provider here whose no-logs claim has been tested by a court rather than only by an auditor — but it is a US company.

Against it: United States jurisdiction, inside the Five Eyes agreement.

Visit Private Internet Access

5. Windscribe

67.0

Clients published as open source. Unusually honest about its own incidents, but Canadian jurisdiction and a three-day refund window are real costs.

Against it: Canada is a Five Eyes member state.

Visit Windscribe

What did not qualify, and why

Excluded providers are named rather than omitted. If one of them is the VPN you already pay for, this tells you exactly which requirement it misses.

Provider	Why it is not on this list
NordVPN	Clients are closed source.
Surfshark	Clients are closed source.
ExpressVPN	Clients are closed source.
CyberGhost	Clients are closed source.
PureVPN	Clients are closed source.
FastestVPN	Clients are closed source.

Questions

Which VPN clients can I actually read the source of?: Mullvad. Clients published as open source. Only providers publishing open-source clients. Ordered by transparency score.
How many providers qualify for this list?: 5 of 11. The other 6 are excluded because they do not meet the requirement, and they are named at the bottom of the page rather than quietly dropped.
What does this ranking ignore?: Whether the code has been independently audited — that is a separate page.