How we score

A VPN score is only useful if you can reconstruct it. This page gives you everything needed to do that: the criteria, the weights, the standard for full marks, and the rule about money.

The arithmetic

Each provider is scored 0–10 on seven criteria. Each raw score is multiplied by that criterion’s weight and divided by ten. The seven results are added, giving a total out of 100. There is no rounding stage where an editor nudges a number, and no bonus for providers we have a commercial relationship with.

total = Σ (raw ÷ 10 × weight), weights sum to 100

Every raw score in the dataset carries a written reason, and each reason states something checkable — an audit that exists or does not, a jurisdiction, a published refund window. If a reason cannot be stated as a fact, the criterion is not scored on it.

The seven criteria

Independent audit

20% of total

Full marks require: A named third-party firm audited the no-logs claim and the app source within the last two years, and the report is public.

Jurisdiction and ownership

15% of total

Full marks require: Incorporated outside the Fourteen Eyes agreement, with disclosed ownership and no history of undisclosed parent companies.

Protocol and crypto stack

15% of total

Full marks require: WireGuard and OpenVPN both shipped, modern cipher defaults, and no reliance on a closed protocol the reader cannot inspect.

Leak protection

15% of total

Full marks require: Kill switch on every desktop and mobile app, IPv6 and DNS handled in-tunnel, and no leak observed in our own testing.

Transparency

15% of total

Full marks require: Open-source clients, a published transparency report, and signup that does not require identifying information.

Price and refund terms

10% of total

Full marks require: Low effective monthly cost without a multi-year lock-in, and a refund window of 30 days or more with no usage cap.

Platform coverage

10% of total

Full marks require: Native apps across desktop, mobile, TV and router, with a usable number of simultaneous connections.

Why audit is weighted highest

Every VPN advertises a no-logs policy. The claim is unfalsifiable from the outside: you cannot inspect a server you do not control, and a privacy policy is a marketing document until somebody independent has tested it. An audit is not proof — it is a snapshot, taken with the provider’s cooperation, of a system that can change the next day. But it is the only external evidence that exists, so it carries the most weight here, and a provider with none scores zero on that criterion rather than an average.

Why jurisdiction is weighted, and why it is not weighted higher

Where a company is incorporated determines who can compel it and under what process. Providers inside the Five, Nine or Fourteen Eyes agreements are more exposed to routine legal process from member states. That is a real factor, but it is not decisive on its own: a Swedish provider holding no account identity may be a smaller target than a Panamanian one holding email addresses and payment records. Jurisdiction gets 15%, not 40%, for that reason.

What is deliberately not in the rubric

Server count. A provider can add a thousand virtual servers in a week. It measures marketing budget, not quality.
Advertised speed. Vendor speed claims are unverifiable. Speed enters the site only through our own measurements, on the lab pages, and only after a test has been run.
App design. Real, but subjective and unstable across releases.
Commission. Not an input, at any weight.

The money test

Any review site can claim independence. The checkable version is whether unpaid providers appear near the top. Of the 11 providers in our dataset, 7 have no affiliate arrangement we participate in — Mullvad, IVPN, Surfshark, ExpressVPN, Private Internet Access, Windscribe, CyberGhost. 3 of them currently sit in the top five: Mullvad and IVPN and Surfshark. If that ever stops being true, the rubric changed, and this page will say why.

Recomputing a score yourself

Open any review. The breakdown table gives you the raw score and weight for all seven criteria. Multiply, add, and you get the number in the heading. If you weight jurisdiction higher than we do, redo the sum with your own weights — the inputs are all there, which is the point of publishing them.

Corrections

Facts drift. Prices change weekly, audits are re-run, companies get acquired. Every fact on this site carries the date we checked it. If you find one that is stale or wrong, report it and the correction is logged with a date.