Who is paying for the bandwidth?
A VPN is not a piece of software you download once and then own. It is a fleet of servers in datacentres somebody rents, on transit somebody meters, behind IP addresses somebody leases, with an abuse desk answering the complaints a shared address attracts. Every connected user draws on all of it, continuously, and none of them draws on it for free.
That is what makes this category different from most free software. A free note-taking app costs its publisher almost nothing per additional user. A free VPN with ten million installs carries a bandwidth bill every month for as long as those installs stay active, and the bill grows precisely with the product’s popularity. Nobody absorbs a cost like that by accident.
So the useful question is not "is this VPN safe", which no free app will answer against itself, but "point at the revenue". There are three honest answers: paying customers of the same company cover it, advertisers or data buyers cover it, or somebody covers it for a reason they have not published. Which of the three you are in is usually answerable in five minutes on the provider’s own site.
Is a free VPN safe? Work out the funding model first
The first model is a loss leader funded by a paid tier. The company sells subscriptions, publishes the prices, and gives away a limited version because a proportion of free users eventually pay. One of our four providers does this: Proton VPN’s free tier has no data cap and is funded by paid subscriptions rather than advertising. What makes that checkable is the audit scope. The most recent Securitum engagement ran from 20 to 27 May 2026, on site at Proton AG in Zürich, two senior consultants over six person-days, covering the no-logs policy and the production infrastructure — not a separate premium estate. It is the fifth consecutive annual audit since 2022, and every full report is published rather than summarised in a blog post. Repeated audits of the infrastructure free users actually sit on are the entire difference between this model and the rest.
The second model is advertising. The app is free, it shows you ads, and an advertising stack needs identifiers to target and to prove delivery. That is how the product works, and it sits in direct tension with why you installed it. A privacy tool paid for by advertisers has to know enough about you to be worth paying for.
The third model is selling something you produce. Bandwidth resale exists in this market: the free app turns your connection into an exit point through which other people’s traffic is routed, and the operator sells that capacity. Aggregated browsing data is the other saleable output. In both cases the product being sold is the user, which is a phrase used loosely everywhere else and is literally accurate here.
The fourth is the one that should stop you: you cannot tell. No paid tier, no advertising in the app, no named parent company, no explanation of who pays the transit bill. That is not an absence of a funding model. It is a funding model you have not been shown, and the shortlist of reasons somebody would quietly pay to carry a stranger’s traffic is not reassuring.
A free VPN sees everything your ISP used to see
This is the part that makes an unidentifiable free VPN worse than no VPN at all, and it follows from what the tool does rather than from anything specific to free ones. A VPN does not delete the record of where you go. It moves the record. Before you connect, your internet provider can see the domains you contact. After you connect, your provider sees an encrypted link to one address, and the VPN operator is now the party in a position to see the rest. The whole value of the swap is that the new observer keeps less than the old one.
Now compare the two parties on everything except their marketing. Your ISP is a company you have a contract with. It bills you, so it has your name anyway. It is licensed in a country whose law you live under, answerable to a regulator, publishing retention periods, with a complaints route that has a human at the end. None of that makes it trustworthy — in the United States it is legally permitted to sell your browsing data, which is one of the better reasons to use a VPN at all. It makes it accountable, which is a different property.
An anonymous free app has none of those. If you cannot say which company operates it, you cannot say which country’s law applies, who can compel it, what it retains, or who to complain to. Installing it does not remove an observer: it moves your browsing record from a regulated company you have a contract with to one you cannot name, and grants it a device-wide tunnel permission on the way. For that purpose, running nothing is the better position.
Nor does the free app gain you anonymity, because no VPN does at any price: cookies, fingerprinting and logged-in accounts all work above the network layer. The trade is one observer for another, and the identity of the second is the only thing you are choosing.
Avoid
- Treating an app-store rating as evidence about who operates the service
- Installing a VPN whose operating company is not named anywhere in the listing or the policy
- Assuming a free VPN buys anonymity — no VPN does, at any price
Why "no logs" from an unaudited free app is an unfalsifiable claim
Every VPN says it keeps no logs, and a user cannot check it. You cannot observe the absence of a record on a machine you do not control. The claim is not merely unproven, it is unfalsifiable by construction: there is no experiment you can run at home whose result would contradict it. That is why the only external evidence in this market is a published audit, and why our rubric weights audit evidence highest of the seven criteria.
An audit is paid for by the provider, on systems the provider presents, at a time it agrees to. Those are real limits. But it is not nothing, and the best demonstration is in our own dataset. KPMG assessed PureVPN’s servers and configurations from 16 to 22 February 2023, and the engagement did not come back clean: origin IP addresses were appearing in the error logs of failed connections for users connecting by manual configuration, and some logs recorded first-connection time, last-connection time and a connection count. PureVPN states both were remediated and verified. An auditor with access found retained data the marketing page did not mention, at a paid provider with a published trust centre.
A free app that has never been audited has not passed that test. It has skipped it, usually for a structural reason rather than a sinister one: an assurance engagement is a five-figure expense and a product with no subscription revenue has no line item to pay it from. This is why our rubric scores a missing audit as zero rather than as an average. Scoring absence as average would let a provider that has published nothing sit level with one that was examined and found something.
Calibrate on the paid end of our own coverage before assuming the free end is better. FastestVPN has exactly one published audit, by Altius IT, with fieldwork from 15 December 2022 to 29 January 2023, never repeated since — and that report’s scope explicitly excluded security safeguards and third-party controls. Its own privacy policy, quoted inside that report, lists a Facebook Pixel among the analytics tools running on its website. That is a company charging money and publishing a full PDF report, still carrying those two facts. An app charging nothing and publishing nothing is the same position with the evidence removed.
The owner can change without you noticing
The second thing an audit cannot cover is who will own the software next year. Apps and extensions are acquired routinely, and the buyer inherits something valuable: an installed base that has already granted a tunnel permission, or in the extension case permission to read and change data on every site the user visits. The update then arrives silently through the store. Our guide to built-in and browser VPNs covers the extension version of this pattern; the mechanism is identical for a standalone app.
This is why a privacy policy and an audit are dated documents rather than standing guarantees: both describe a company as it was on the day the work was done. If the operating entity is not named, you cannot even tell whether it has changed hands.
The minimum bar is that the parent is disclosed and checkable, and all four providers we cover clear it: Proton VPN operates under Proton AG, majority held by the non-profit Proton Foundation; NordVPN under Nord Security; PureVPN under PureSquare, trading as GZ Systems Limited; FastestVPN under Fastest Technology Limited. Proton’s structure is the unusual one, because a majority non-profit owner changes who it can be sold to and on what terms. Whether that reassures you is a judgement — but only a company that has told you who it is lets you make it.
What we cannot do is tell you about a specific free app by name. We hold no evidence about services outside our four, and our keyword file records that we declined to publish "is X VPN safe" pages for several high-volume queries for exactly that reason. The test here is one you can apply yourself, to any app, in a minute: find the operating company, find its country, find what it sells. If any of the three is missing, that is the finding.
How much does a VPN cost if you simply pay for it?
Less than the alternative implies, and the spread is wide enough that "a VPN costs" is not one number. FastestVPN advertises $0.83 a month on a two-year term, which is $19.95 charged once, against $5.00 if you pay monthly. PureVPN publishes $2.15 a month on two years, $2.55 on one year, and $12.95 monthly. Both of those we read back from the live pricing pages on 14 August 2026. NordVPN and Proton VPN we could not: NordVPN returns 403 to automated requests and Proton renders prices from client-side script, so their figures — $3.39 and $4.49 a month on two years, $12.99 and $9.99 monthly — are recorded as unverified in our dataset rather than dated as though we had confirmed them.
Two things distort all of those headline numbers. The low rate requires paying the whole term up front, so the cash leaving your account is roughly $20 to $108 depending on provider, not the monthly figure in the advertisement. And none of the four publishes what it will charge on renewal. The advertised price is a customer-acquisition rate for the first term, the second is typically a multiple of it, and it is charged automatically on a date most subscribers have forgotten. We cannot put that number in a table because no provider has published one — which makes a comparison of introductory prices a comparison of the least stable thing about them.
We have made our own error in this area and it is logged. FastestVPN sells a $40 lifetime plan, and we once expressed it as $0.33 a month by dividing over ten years — a figure nobody published, which then fed our cheapest-VPN ranking. Divide by three years instead and it is $1.11. The number was ours, not the provider’s, so it came out of the pricing table and the $40 sits in the editorial text where the caveat travels with it.
So the honest comparison is not "free versus $12.99 a month". It is an unidentified funding model against roughly $20 to $108 for two years, with a renewal you should diary and can cancel.
How to get a free VPN without paying in something else
Four routes do not require trusting an operator you cannot name. They suit different problems.
- A free tier from a company with a paid business and audits covering the same infrastructure. Our free-tier shortlist finds exactly one among the providers we cover, and lists one rather than padding the count.
- A refund window used as a genuine trial: 30 days at Proton VPN and NordVPN, 31 at PureVPN and FastestVPN. Turn off auto-renewal the day you subscribe, not the day you intend to leave. Proton refunds are prorated against usage rather than returned in full, and cash payments are not refundable at all.
- Running your own server, which removes the commercial operator entirely — you pay a host instead, and you are the only user on that address, which is a different privacy trade rather than a better one.
- A browser proxy for a single geographic unblock you do not care about privately. Several browsers ship one free; our guide to built-in and browser VPNs covers which are proxies and where each falls short.
What even the good free tier does not do
A free tier funded by subscribers is a real product, and it is also a funnel. The company offers it because a share of free users convert. It is a legitimate deal precisely because both halves are visible: you get a working tunnel, they get a conversion opportunity, and nothing is being sold behind you.
What you should expect to give up is capability rather than integrity. Free users get a smaller set of locations than paying ones, and we deliberately do not publish which locations, because they change often enough that any list we wrote would be wrong within months — check the provider’s own page on the day you sign up. Free servers also carry the users who are not paying, so throughput varies more than on the paid fleet. Features that cost the provider extra to run, such as port forwarding for peer-to-peer transfer or multi-hop routing, are paid-plan functions.
The limits of the paid product apply here identically. A free tier from an audited company does not make you anonymous, does not stop fingerprinting, does not protect a compromised device, and does not guarantee any streaming catalogue will load. It removes your internet provider from the list of parties who can see where you go and hands it to a company you can name that has been examined five years running. That is the whole of what free buys, and it is worth having on those terms rather than the ones the advertising suggests.
Avoid
- Reading "no data cap" as "no limits" — locations, features and server load are all still restricted
- Signing up for a paid plan without putting the renewal date in a calendar — the most expensive omission in this category
- Using any free VPN for something where being identified would matter to you