VPNs should, by definition, protect your data, but sometimes they don’t. Don’t be fooled by marketing headlines and incomplete service descriptions! Take care of your data, do your own research, and avoid services that are too good to be true (e.g., free ones).

Do you remember the story of Pinocchio and the chapter when he meets the Fox and the Cat? Due to his naivety, Pinocchio not only trusts the two, but he even offers them a sum of money from the potential gain. Their answer is well-known:

“We do not work for gain,” answered the Fox. “We work only to enrich others.”

“To enrich others!” repeated the Cat.

“What good people,” thought Pinocchio to himself.

Even small children understand that the Fox and the Cat do not have good intentions. However, Pinocchio is blinded by their sweet words.

When it comes to online privacy, don’t be a Pinocchio. Look around, read between the lines, and assume the worst. Consider the possibility that the service intends to get the most of your private data.

This article explains why privacy is important when it comes to VPN services, how you can do your own research, why you should stay away from free VPNs, and lists several VPNs that may not be your best friend for keeping your private data safe.

What is VPN privacy important, and how can a VPN get your data?

A VPN (Virtual Private Network) can see everything you do online, and it may log your activities. Moreover, by ignoring your right to privacy, malicious VPNs may use or sell your data.

According to a scientific study on Android VPN apps, the following practices are quite common:

• Third-party user tracking – 75% of the apps analyzed used tracking libraries to monitor user activities.
• Malware injection – over 38% of the studied apps contained some malware presence detected by VirusTotal.
• Traffic interception – about 16% of the analyzed apps might forward traffic in a peer-forwarding fashion rather than using their own hosted machines.
• Traffic manipulation – 16% of the analyzed VPN apps deployed non-transparent proxies to modify user’s HTTP traffic. Also, several apps actively injected JavaScript code for serving ads and redirecting e-commerce traffic to external ad partners.
• App permissions abuses – 4% of the analyzed VPN apps used the app permissions to implement localhost proxies to intercept and inspect user traffic locally.

Unfortunately, most VPN users are not aware of these practices. The same study analyzed the public user reviews of the VPN apps on Google Play and showed that only a small number of VPN users have publicly raised any concerns.

For your own sake, you need to be one of those concerned about their online privacy. It would help if you did your homework, did your own research, and looked for red flags when choosing your VPN provider.

How to do your own research

Every time you subscribe to a VPN service (as a matter of fact you should do this with every service or app you subscribe to that has access to your data) you should take at least five minutes and look for:

• the contact information;
• the company running the service;
• the privacy policy page;
• any news or articles on the Internet related to the service.

And you should ask yourself questions like:

• Is the contact information easily available on the website? Is the physical address listed clearly?
• Is the company running the service listed with identification info (e.g., tax id)?
• Does the privacy policy present the way the service process users’ private data? Does the service log data? Does it share the data with third parties?
• Are there any independent audits publicly available? Take a search on “[VPN name] audit.” Look for independently performed audits by reputable companies (e.g., PricewaterhouseCoopers) rather than self-made audits.
• What info can you find regarding the reputation of a VPN service by searching online? You can try, for example, “[VPN name] privacy concerns” or “is [VPN name] safe?”. Take your time and read 2-3 articles and judge for yourself.

If you have the slightest doubts that the VPN is fully engaged in protecting users’ privacy, search for another provider. There are plenty of excellent ones. Just take a look at the list of VPN services that offer access to the WireGuard protocol.

Are free VPNs safe?

You have probably heard this before: “If the app you are using is free, then you are the product!”. It means that one way or another, sooner or later, the free app or service will get paid for letting you use it.

Does that mean that your data is sold and your privacy is endangered? Not necessarily, but there is no way you, as a user and private person, can verify how your data is managed and the consequences of using a free service.

A VPN service has access to many private data based on its functioning principle. It can “see” your browsing habits, for example, and it may use this info in various ways (it can sell this data to interested companies or partner with companies that target you for numerous products).

Taking all these into accounts I do not consider free VPNs safe.

You may be tempted to believe that freemium services (those offering both free and paid plans) are safer. And, generally speaking, they should be. However, as the cost of providing free VPN services are high (due to infrastructure costs), many freemium VPN services look for additional ways to monetize their users. Thus, my advice is to stay away from them too.

VPN services that may not protect your privacy

Several VPN services are either transparent of exploiting user data or exposed publicly for unfair practices. We have gathered a list of such services and explained why it is advisable to avoid them. If you know of other similar services, please let us know in the comments sections.

[1] Hotspot Shield

Hotspot Shield apps are installed on millions of devices all over the World, and the VPN service is considered to be one of the most popular VPNs available on the market. Of course, Hotspot Shield began as a free service and later switched to the freemium model. However, it seems that Hotspot Shield’s practices are not as transparent and privacy-oriented as one expects from a VPN provider.

1. The company behind the HotspotShield service

Hotspot Shield is (now) run by Aura, a group of companies (most of them located in the United States) that manage several VPN services. This should not be a problem by itself if there were no privacy and security concerns related to several VPNs owned by this group.

2. Aura’s privacy policy

Strangely, Aura’s privacy policy page does not mention Hotspot Shield but lists other VPNs like Betternet, Hexatech, and Touch VPN.

The privacy policy of Aura clearly states that their applications use various tracking technologies (Cookies, Pixel Tags / Page Tags / Web Beacons / Tracking Links, SDKs) to collect information about their users.

The user-related info is used, among others, to serve ads (!).

Moreover, it looks like the data collected from Aura apps is shared with third-party services that may, in their turn, use the data for marketing purposes and serve ads.

3. Service security

In 2018 a security researcher found a way to identify Hotspot Shield users. The data leaked (country where the user was located and the user’s Wi-Fi name) could have been used to locate the user. The Hotspot Shield development team rapidly fixed the problem, but the Hotspot Shield apps’ security policies’ concern remains.

4. Third party auditing

In 2017, CDT (the Center for Democracy and Technology) filed a complaint signaling “undisclosed and unclear data sharing and traffic redirection occurring in Hotspot Shield Free VPN.” In plain words, CDT said that Hotspot Shield was misleading users related to the amount of data shared with third-party partners.

And the CDT conclusion says it all:

“Consumers who employ Hotspot Shield VPN do so to protect their privacy, and Hotspot Shield’s use of aggressive logging practices and third-party partnerships harm its consumers’ declared privacy interests.”

Additionally, Hotspot Shield was also found using various shady practices such as:

• injecting Javascript code for advertising and tracking;
• using various tracking libraries;
• redirecting traffic to e-commerce sites.

Conclusion: Hotspot Shields and the companies running the service do not seem to be interested in complete privacy and anonymity. Hiding the IP address and encrypting traffic is not enough! Thus, my advice is to avoid them.

[2] Betternet (asa well as Hexatech and TouchVPN)

Betternet is a hugely popular VPN service with millions of users from all over the World. It started as a free service, and then, a few years back, it switched to the freemium model.

However, there are some red flags regarding the Betternet service.

1. The company behind the Betternet service

It is quite a challenge to find out who runs the service. On the Betternet website, Betternet LLC is listed. However, the Terms and conditions page mentions Pango and Pango GmbH as the entities behind Betternet. Strangely, when one clicks on the link to the Pango privacy policy, one is redirected to … (surprise!) Aura, the same group of companies that own Hotspot Shield. Additionally, other VPN services are mentioned, such as Hexatech and TouchVPN.

Of course, the same privacy policy applies to all services managed by the group, which implies that user tracking is performed at scale.

2. Service security

A service vulnerability that allowed hackers to push fake updates and install malicious apps was discovered in 2020. The Betternet team fixed the issue rapidly after it came out, but the question regarding Betternet security practices remains.

3. Third party auditing

The Betternet Android app was listed in the article that presented VPN apps that included tracking technologies. The Betternet app had, at the time of the study (2017), no less than 14 tracking libraries!

Conclusion: is Betternet safe to use? I don’t think it is. You should better find other VPNs that have a better reputation.

As Hexatech and TouchVPN are also run by Aura my advice is to stay away from them too.

[3] Hola VPN

Hola is another hugely popular free VPN service. However, it logs as much info about you as it can. On the positive side, their privacy policy is transparent about their extensive logging policy.

And, here it is what Hola logs:

• your IP address;
• name and email address, screen name;
• payment, billing information, and any other information you provide to the service;
• when you register through a third-party website (such as Gmail), Hola gets access and logs your user name, email address, profile picture, birth date, gender, and preferences.
• when you register through a social network account (e.g., Facebook), Hola gets and stores the followings: your full name, home address, email address, birth date, profile picture, friends list, personal description, as well as any other information you made publicly available on your social media account;
• installed applications from your devices;
• browser type, web pages you visit, time spent on those pages, access times, and dates (for free users).

As you can see, by using Hola, your private data stops being private. It is transferred, stored, and probably used by Hola.

Moreover, Hola shares gathered data with “trusted third-party service providers or partners for the purposes of providing you with the Services, storage, and analytics.” This means that your data is furthered processed and used, probably, against you.

And, yes, Hola may hand you your data and your profile to authorities, even though Israel, where Hola headquarters are located, is not a “Fourteen eyes” country.

Conclusion: stay away from Hola if you consider that your data should remain private!

[4] PureVPN

PureVPN is a solid VPN provider with a privacy policy that states clearly that the service does not keep “any logs that can identify or help in monitoring a user’s activity”.

However, PureVPN was caught logging user data. In 2017, an investigation made public revealed that PureVPN provided data to the FBI for the criminal case. That proved that the “no logs” claim was untrue. This should raise some concerns for those interested in privacy and anonymity.

It is fair to mention that in 2019 and 2020, PureVPN completed two no-logs audits conducted by Altius IT and KPMG, respectively. The audits confirmed that, at the time of the audit, PureVPN kept not logs, and they “did not find any evidence of system configurations and/or system/service log files that independently, or collectively, could lead to identifying a specific person and/or the person’s activity when using the PureVPN service.”

Conclusion: Is PureVPN safe? Taking into account the latest audits, we may say it is. However, the fact that at some point, PureVPN shared user data with authorities remains a red flag.

Summary

Your personal data is important, and you should keep it private. It sounds obvious, but sometimes it is not. Especially when it comes to data privacy in the Internet world.

Plenty of apps and services gather access to your data and use them for their own gain. Don’t let this happen!

Online privacy and security are built on trust. That is why we have listed several VPN services that may have trust issues and that you should, in my opinion, avoid.

Do you know another VPN provider that should be on the list? Feel free to let us know in the comments below. Would you like to be notified when we publish new articles? Subscribe to our newsletter! It will make a Transylvanian baby-bat happy.

This article aims to list (almost) all WireGuard VPN providers and present their approach toward offering access to the WireGuard protocol.

WireGuard seems to be the future of VPN protocols due to its simplicity and performance. The best VPN providers were involved in testing and supported the development of WireGuard in the last few years. And now, WireGuard is ready for broad-scale adoption.

You may test the new VPN protocol yourself by subscribing to one of the WireGuard VPN providers listed below.

Why is WireGuard the next generation VPN protocol

WireGuard is a relatively new VPN protocol developed by Jason A. Donenfeld that brings significant benefits to VPN users. It is important to know that:

• WireGuard is free and open-source.
• The project has about 4,000 lines of code and a smaller attack surface compared to other VPN protocols. Also, the codebase can be easily audited.
• It uses the latest, high-speed, state of the art cryptography (ChaCha20 for symmetric encryption, Poly1305 for authentication, Curve25519 for ECDH, BLAKE2s for hashing and keyed hashing, SipHash24 for hashtable keys, HKDF for key derivation).
• It uses the concept of crypto-key routing.
• It runs at Layer 3, and it was recently included in the Linux kernel.

Comparing to other VPN protocols, WireGuard is:

• faster than OpenVPN on UDP;
• uses less memory and CPU than IPSec;
• works well on any device, uses less bandwidth, offers better performance, and seamlessly switches between mobile and WiFi connections.
• more secure.

Additionally, it seems that, due to its stateless nature, WireGuard improves the battery life of mobile devices.

All these make WireGuard ideal for streaming with VPN (Netflix, Hulu, BBC iPlayer) and torrenting.

Of course, WireGuard also has some drawbacks. You may read more about them here.

WireGuard VPN providers

VPN providers have started to implement WireGuard for several years but only recently have released stable solutions (after the official WireGuard launch on March 30th, 2020).

Basically, there are two approaches:

• Some VPN services offer access to a WireGuard config generator to create configuration files for their VPN servers. A user may import the config file(s) into the WireGuard client apps (available on Windows, macOS, Android, iOS) or use the config(s) from the command line on Linux.
• Other VPN service providers have implemented WireGuard in their applications for a more user-friendly experience.

You may find below the list of WireGuard VPN providers and their implementation.

[1] NordVPN – Advanced WireGuard support

NordVPN is one of the first VPN providers that has implemented WireGuard in its native apps.

NordLynx (the NordVPN WireGuard implementation) is available for Windows, macOS, Android, iOS, and Linux. It is super easy to configure, as all you have to do is to change the VPN protocol (Settings > General > VPN protocol > NordLynx protocol) in the NordVPN apps.

NordLynx is not simply a WireGuard implementation as it is enhanced with a double NAT system (Network Address Translation) for increased security. The double NAT firewall creates two local network interfaces for each user, and it assigns a dynamic IP address for each secure VPN connection such that no identifiable data is stored on the server.

This is consistent with the NordVPN zero-logs policy.

[2] Mullvad – Impressive WireGuard options

Mullvad, the privacy-oriented VPN provider, started to offer the WireGuard protocol as part of its service in 2017. It is one of the few VPNs that expose WireGuard both through the WireGuard apps by generating config files and from within its own VPN clients.

Mullvad apps implement WireGuard as follows:

• The Android VPN and iOS VPN apps only offer access to the WireGuard protocol.
• For macOS and Linux, WireGuard is the default protocol, but you may switch to OpenVPN if you want to.
• For Windows, you need to select the WireGuard protocol (gear icon > Advanced > Tunnel protocol > WireGuard).

Mullvad stands out as a WireGuard VPN provider by the advanced options available. For WireGuard, you may select the port (Automatic or 53), bridge mode (Automatic/On/Off), MTU (1280-1420), and you may reset your WireGuard key anytime you want.

The WireGuard configuration file generator is … impressive. Firstly, take note that:

We [Mullvad] never get access to your private key; only the public key is sent to us. The private key is stored locally in your browser so that you can create multiple files from the same key, and as soon as you leave this page, it is deleted.

Secondly, you may generate a config file or a QR code that can be imported by the WireGuard apps. Start by generating a new WireGuard key (you have 5 slots available for apps and manually generated configs) and choose a location/server.

You may even enable the Multihop (double VPN) option and have two VPN servers to secure your data on your chosen port. And, you may opt-in for a VPN kill switch (only on Linux).

[3] PrivateInternetAccess – WireGuard on all apps

PrivateInternetAccess was involved in funding the WireGuard development, and, as soon as it was released publicly, PIA has added WireGuard as an additional VPN protocol for its VPN software.

To ensure that the server-client connection remains private, no IP addresses are leaked, and no logs are kept, PrivateInternetAccess has extended the WireGuard VPN tunneling kernel with additional protections:

• PIA WireGuard servers run RESTful APIs protected by RSA certificates;
• A daemon deletes connection data at regular intervals when keepalives are no longer being sent for three minutes.

[4] StrongVPN – WireGuard on apps and routers

StrongVPN started to deploy WireGuard in September 2019.

The WireGuard protocol is integrated into the StrongVPN apps (Windows, macOS, Android, iOS) along with OpenVPN and IKEv2.

StrongVPN with WireGuard can also be set up on various routers. You may get started with your router VPN on steroids by following these guides.

[5] IVPN – WireGuard with extra privacy protection

IVPN is one of the early adopters of the new technology. WireGuard is available for all IVPN subscribers on all available servers.

To solve potential privacy issues regarding WireGuard, IVPN proposes the following approaches:

• No connection data or metadata about your keys are stored, and IVPN takes care to ensure that data is not held longer than required for optimal usage.
• IVPN allocates random VPN tunnel IP addresses and rotates them at your request.
• The apps support periodically changing IP addresses. This process is implemented together with key regeneration.
• All IVPN apps support periodic, automatic key regeneration, which also changes the internal IP address.

[6] CyberGhost – WireGuard for Linux and iOS

CyberGhost is also a WireGuard VPN provider. At this time, WireGuard is available in the Linux and iOS apps. It will probably be added soon to the other apps as well.

[7] AzireVPN – Simple WireGuard config

AzireVPN is another Swedish VPN provider that implements WireGuard. At this time, AzireVPN offers access to a config file generator that lets you select the location, file extension type, port, and IP (IPv4/IPv6).

Additionally, you may install WireGuard on Linux (CLI), the Android VPN app, or use the pre-alpha Windows VPN client.

[8] VyprVPN – Apps with WireGuard support

VyprVPN released version 4.0 of their apps (Windows, macOS, Android, iOS) with full WireGuard support. It supports all servers.

Golden Frog (the company behind VyprVPN) does not explain how they implement WireGuard in their apps; therefore, I suppose it is pretty standard.

[9] VPN.ac – Basic WireGuard config file generator

VPN.ac offers access to a basic WireGuard config generator. Thus, you need to install the official WireGuard client apps and import the config files.

You may add up to 6 devices for a VPN.ac account.

[10] TorGuard – WireGuard on all apps + config generator

TorGuard also offers access to WireGuard from all its apps (Windows, macOS, Linux, iOS, Android). On Android, you need to tap the VPN Tunnel option and choose the WireGuard protocol. On iOS, tap the settings icon and change Connection Type to WireGuard, from OpenVPN, IKEv2, or IPSec.

A WireGuard config generator is still available from the Client Area, and you may activate access to 25+ WireGuard tunnels from around the World. All you have to do is generate a config file and import it to the WireGuard app corresponding to your operating system.

Dedicated IPs through WireGuard are also available, and they can be added to every app.

[11] Mozilla VPN – New WireGuard VPN service from Mozilla

The recently launched secure VPN service from Mozilla uses the server network powered by Mullvad and the WireGuard protocol. At this time, Mozilla VPN is available in the US, Canada, the UK, Germany, France, Italy, Spain, Belgium, Austria, Switzerland, Malaysia, New Zealand, and Singapore, and it works on Windows 10, Android, iOS, and Chrome OS.

[12] Hide.me – Hassle-free in-app WireGuard access

Hide.me team took its time to implement WireGuard to offer the desired quality of service. WireGuard is available on all Hide.me apps, and the activation is hassle-free. Access the app settings, select the VPN protocol menu, and check the WireGuard option.

It is important to note that Hide.me implements a secure key exchange mechanism. Thus, when you connect to a Hide.me WireGuard server, a new private key is generated on your device. The private key never leaves your device; only the public one is sent to the server. The connection is double encrypted with an ephemeral session shared key.

[13] Surfshark – Secure WireGuard implementation

Surfshark addresses the concern on WireGuard about assigning the same static IP address to a user every time a connection is established by implementing double NAT (similarly to NordVPN). Thus, as a user gets a different IP address each time, there is no purpose in saving any identifiable data on the server. This is consistent with the Surfshark no-log policy.

Surfshark supports the WireGuard protocol on its iOS, Android, Windows, and macOS apps!

[14] OVPN – WireGuard config generator and more to come

OVPN offers access to a basic WireGuard config generator. Thus, you will need to install the WireGuard client app suitable for your device, generate the configs from the OVPN client area, and connect to the OVPN servers.

Port forwarding has been integrated into the OVPN WireGuard implementation, and Public IPv4 and Multihop functions will follow it. Also, WireGuard is the default protocol in the OVPN Android app (you may also set it up with the WireGuard client app on Android), and WireGuard will soon become available in the OVPN desktop apps for Windows, macOS, and Ubuntu.

[15] Other commercial WireGuard VPN providers

As all major VPN players have adopted WireGuard (except ExpressVPN that recently presented Lightway), most VPN services started to add the WireGuard protocol to their services. I will list them here as soon as I find out about them (you may let me know in the comments if I missed any):

• CactusVPN offers WireGuard on its Windows, macOS, iOS, and Android apps, as well as a WireGuard config generator for its servers;
• WideVPN with a WireGuard config generator;
• Windscribe with a config generator and WireGuard implementation on all its VPN apps.

A special case of WireGuard VPN service is the Cloudflare WARP. Built as an extension of the 1.1.1.1 DNS resolver, WARP uses WireGuard to add more privacy and security to its users. And it is free!

WireGuard VPN FAQ

Summary

We have listed more than 10 VPN providers that already offer access to the WireGuard protocol. In the next months, more and more services will get in line and implement WireGuard.

Do you know another WireGuard VPN provider that is not on the list? Feel free to let us know in the comments below.

Would you like to be notified when we add new VPN services to the WireGuard list? Subscribe to our newsletter! It will make a Transylvanian baby-bat happy.