# VPN service

A virtual private network (VPN) service is a proxy server marketed to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against data profiling or MitM attacks on hostile networks.
A wide variety of entities provide VPN services for several purposes. But depending on the provider and the application, they do not always create a true private network. Instead, many providers simply provide an Internet proxy that uses VPN technologies such as OpenVPN or WireGuard. Commercial VPN services are often used by those wishing to disguise or obfuscate their physical location or IP address, typically as a means to evade Internet censorship or geo-blocking.
Providers often market VPN services as privacy-enhancing, citing security features, such as encryption, from the underlying VPN technology. However, users must consider that when the transmitted content is not encrypted before entering the proxy, that content is visible at the receiving endpoint (usually the VPN service provider's site) regardless of whether the VPN tunnel itself is encrypted for the inter-node transport. The only secure VPN is where the participants have oversight at both ends of the entire data path or when the content is encrypted before it enters the tunnel.
On the client side, configurations intended to use VPN services as proxies are not conventional VPN configurations. However, they do typically utilize the operating system's VPN interfaces to capture the user's data to send to the proxy. This includes virtual network adapters on computer OSes and specialized "VPN" interfaces on mobile operating systems. A less common alternative is to provide a SOCKS proxy interface.
In computer magazines, VPN services are typically judged on connection speeds, privacy protection including privacy at signup and grade of encryption, server count and locations, interface usability, and cost. In order to determine the degree of privacy and anonymity, various computer magazines, such as PC World and PC Magazine, also take the provider's own guarantees and its reputation among news items into consideration. Recommendation websites for VPNs tend to be affiliated with or even owned by VPN service providers.

## VPN Use Cases

* Accessing Geo-Restricted Content. VPNs allow users to bypass regional restrictions by hiding their IP address from the destination server and simulating a connection from another country. For example, users in regions with limited streaming libraries can use VPNs to access content available in other locations, such as accessing Netflix US from abroad.
* Protecting Data on Public Wi-Fi. Public Wi-Fi networks, such as those in cafes or airports, are often not encrypted and susceptible to eavesdropping by other users of the same network. VPNs encrypt users' internet traffic, protecting sensitive data like login credentials, financial information, and personal communications from potential interception.
* Ensuring Privacy for Activists and Journalists. Activists and journalists working in restrictive or authoritarian regions often use VPNs to maintain anonymity and protect sensitive communications. VPNs mask IP addresses and encrypt data, ensuring safe access to information and secure communication channels.

## Criticism and limitations

Users are commonly exposed to misinformation on the VPN services market, which makes it difficult for them to discern fact from false claims in advertisements. According to Consumer Reports, VPN service providers have poor privacy and security practices and also make hyperbolic claims. The New York Times has advised users to reconsider whether a VPN service is worth their money. VPN services are not sufficient for protection against browser fingerprinting.

## Common misconceptions

* A VPN service does not make one's Internet use private. Users can still be tracked through tracking cookies and device fingerprinting, even if the user's IP address is hidden.
* A VPN service can log the user's traffic, although this depends on the VPN provider.
* A VPN service does not make the user immune to cyberattacks.
* A VPN service is not in itself a means for good Internet privacy. The burden of trust is simply transferred from the ISP to the VPN service provider.
* A VPN service is not a VPN. VPNs allow you to access a private network from a remote location as if you were in the same place. VPN services do not grant access to private networks.

## Legality

In March 2018, the use of unapproved VPN services was banned in China, as they can be used to circumvent the Great Firewall. Operators received prison sentences and were penalized with fines. Russia banned various VPN service providers in 2021.

## Comparison of commercial virtual private network services
### Privacy

PC Magazine recommends that users consider choosing a provider based in a country with no data retention laws because that makes it easier for the service to keep a promise of no logging. PC Magazine and TechRadar also suggest that users read the provider's logging policy before signing up for the service, because some providers collect information about their customers' VPN usage. PC World recommends that users avoid free services as a rule of thumb and said free services either sell their users' browsing data in aggregated form to researchers and marketers, or only offer a minimal amount of data transfer per month.

### Technical features

| Service | Leak Protection | Leak Protection | Leak Protection | Protocols | Protocols | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Obfuscation / Censorship Avoidance | Network Neutrality | Network Neutrality | Server | Server |
| Service | First-party DNS servers | IPv6 supported / blocked | Offers kill switch | Offers OpenVPN | Offers WireGuard | Supports multihop | Supports TCP port 443 | Supports Obfsproxy | Offers SOCKS | Linux support | Supports SSL tunnel | Supports SSH tunnel | Blocks SMTP (authent.) | Blocks P2P | Dedicated or virtual | Diskless |
| Atlas VPN | Yes | Yes | Yes | No | Yes | Yes | No | No | No | Yes | | | Some | No | Dedicated | No |
| Avast SecureLine | Yes | Yes | Yes | Yes | No | No | No | | | No | | | | Some | Dedicated | No |
| ExpressVPN | Yes | Yes | Yes | Yes | No | No | | | | Yes | Yes | | | No | Both | Yes |
| Hotspot Shield | No | No | Yes | No | No | No | | | | No | | | | ? | | |
| IPVanish | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | No | No | No | No | Dedicated | No |
| IVPN | Yes | No | Yes | Yes | Beta | Yes; OpenVPN | Yes | Yes | | Yes | | Yes | No | No | Dedicated | |
| Mullvad | Yes | Yes | Yes | Yes | Yes | Yes; WireGuard and SOCKS5 | Yes | No | Yes | Yes | Yes | Yes | No | No | Dedicated | Yes |
| NordVPN | Yes | No | Yes | Yes | Yes; NordLynx based on WireGuard | Yes; OpenVPN and SOCKS5 | Yes | | Yes | Yes | | | Yes | No | Dedicated | Yes |
| PrivadoVPN | Yes | Yes | Yes | Yes | Yes | | | | Yes | Yes | | | | No | | |
| Private Internet Access | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | | | Some | No | Dedicated | Yes |
| ProtonVPN | Yes | No | Yes | Yes | Yes | Yes | Yes | No | No | Yes | Yes | Yes | | Some | Dedicated | |
| PureVPN | Yes | Yes | Yes | Yes | No | No | Only through SSTP | No | No | Yes | | | No | Some | Both | No |
| Surfshark | Yes | No | Yes | Yes | Yes | Yes (WG, OVPN, IKEv2) | Yes | No | No | Yes | | | Some | No | Both | Yes |
| TunnelBear | Yes | Yes | Yes | Yes | No | No | No | Yes | Yes | Yes | | | No | Some | | |
| Windscribe | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No | Yes (via Stealth protocol) | No | No | No | Dedicated | Yes | Yes |
Notes
* ↑ The support team may be willing to whitelist your email provider's SMTP server upon request.
* ↑ Only on free plan.
* ↑ With the exception of one virtual server located in Antartica.

### Encryption

| Service | Data encryption | Data encryption | Handshake encryption | Handshake encryption | Data authentication | Data authentication |
| Service | Default provided | Strongest provided | Weakest provided | Strongest provided | Weakest provided | Strongest provided |
| Atlas VPN | ChaCha20-Poly1305 / AES-256 | ChaCha20-Poly1305 | 2048-bit Diffie–Hellman | ECP521 | SHA-384 | SHA-384 |
| Avast SecureLine | AES-256 | AES-256 | | | | |
| ExpressVPN | AES-256 | AES-256 | | CA-4096 | | |
| Hotspot Shield | AES-128 | AES-128 | TLS 1.2 ECDHE PFS | TLS 1.2 ECDHE PFS | HMAC | HMAC |
| IPVanish | AES-256 | AES-256 | RSA-2048 | RSA-2048 | SHA-256 | SHA-256 |
| IVPN | AES-256 | AES-256 | | RSA-4096 | | |
| Mullvad | AES-256 (GCM) | AES-256 | RSA-4096 | RSA-4096 | SHA-512 | SHA-512 |
| NordVPN | AES-256 | AES-256 (CBC) | 2048-bit Diffie-Hellman | 2048-bit Diffie-Hellman | | |
| Private Internet Access | AES-128 (CBC) | AES-256 | ECC-256k1 | RSA-4096 | SHA-1 | SHA-256 |
| PrivadoVPN | AES-256 | AES-256 | | | | |
| ProtonVPN | AES-256 | AES-256 | RSA-4096 | RSA-4096 | HMAC with SHA-384 | HMAC with SHA-384 |
| PureVPN | AES-256 | AES-256 | | | | |
| SaferVPN | AES-256 | AES-256 | 2048bit SSL/TLS | 2048bit SSL/TLS | SHA-256 | SHA-256 |
| TunnelBear | AES-128 (CBC) | AES-256 (CBC) | 1548 bit Diffie–Hellman | 4096 bit Diffie–Hellman | SHA-1 | SHA-256 |
| Surfshark | AES-256 | AES-256 (CBC) | 2048-bit Diffie–Hellman | 2048-bit Diffie–Hellman | | |
| Windscribe | AES-256 | AES-256 | RSA-4096 | RSA-4096 | SHA-512 | SHA-512 |
Notes
* ↑ ChaCha20-Poly1305 for all devices except for Windows, which does not support it and therefore uses AES-256
* ↑ Only on iOS 8 and earlier. All other supported devices and operating systems use AES-256 (CBC).
* ↑ iOS 9 and later use 2048 bit. iOS 8 and earlier use 1548 bit. All other supported devices and operating systems use 4096 bit.
* ↑ iOS 8 and earlier use SHA-1. All other supported devices and operating systems use SHA-256.

### Definitions

The following definitions clarify the meaning of some of the column headers in the comparison tables above.