How KotoVPN scores VPNs

The arithmetic

Each provider is scored 0–10 on seven criteria. Each raw score is multiplied by that criterion’s weight and divided by ten. The seven results are added, giving a total out of 100. There is no rounding stage where an editor nudges a number, and no bonus for providers we have a commercial relationship with.

total = Σ (raw ÷ 10 × weight), weights sum to 100

Every raw score in the dataset carries a written reason, and each reason states something checkable — an audit that exists or does not, a jurisdiction, a published refund window. If a reason cannot be stated as a fact, the criterion is not scored on it.

Why audit is weighted highest

Every VPN advertises a no-logs policy. The claim is unfalsifiable from the outside: you cannot inspect a server you do not control, and a privacy policy is a marketing document until somebody independent has tested it. An audit is not proof — it is a snapshot, taken with the provider’s cooperation, of a system that can change the next day. But it is the only external evidence that exists, so it carries the most weight here, and a provider with none scores zero on that criterion rather than an average.

Why jurisdiction is weighted, and why it is not weighted higher

Where a company is incorporated determines who can compel it and under what process. Providers inside the Five, Nine or Fourteen Eyes agreements are more exposed to routine legal process from member states. That is a real factor, but it is not decisive on its own: a Swedish provider holding no account identity may be a smaller target than a Panamanian one holding email addresses and payment records. Jurisdiction gets 15%, not 40%, for that reason.

What is deliberately not in the rubric

• Server count. A provider can add a thousand virtual servers in a week. It measures marketing budget, not quality.
• Advertised speed. Vendor speed claims are unverifiable. Speed enters the site only through our own measurements, on the lab pages, and only after a test has been run.
• App design. Real, but subjective and unstable across releases.
• Commission. Not an input, at any weight.

What we cover, and the conflict that comes with it

We cover 4 providers, and we earn commission from all 4. That is a real conflict of interest and pretending otherwise would be worse than disclosing it. This site is not a survey of the VPN market, and no page here claims to be one.

What a published rubric buys you under that conflict is a constraint we cannot quietly escape. The scores are arithmetic over sourced facts, so a provider that pays us can still finish last — and FastestVPN does, at 55.0 out of 100, because its only audit dates from January 2023 and has never been repeated. A page optimised for revenue would not print that, and it certainly would not put the reason in a table.

The way to hold us to it: every criterion score on every review carries a written reason stating a checkable fact. If a score moves without a fact moving, the rubric has been bent, and you will be able to see it.

Recomputing a score yourself

Open any review. The breakdown table gives you the raw score and weight for all seven criteria. Multiply, add, and you get the number in the heading. If you weight jurisdiction higher than we do, redo the sum with your own weights — the inputs are all there, which is the point of publishing them.

Corrections

Facts drift. Prices change weekly, audits are re-run, companies get acquired. Every fact on this site carries the date we checked it. If you find one that is stale or wrong, report it and the correction is logged with a date.