VPN Comparison

I made a spreadsheet comparing different open source VPN providers.

Part 2 here

Providers

Notes

  • Please do not start a flame war about Proton.
  • Please do not start a flame war about cryptocurrencies. Monero is the only cryptocurrency listed because of its privacy.
  • The very left column is the category for each row, the middle section is the various VPN providers, and the right section is which VPNs are the best in each category.
  • IVPN has two differing plans, which is why "Standard" and "Pro" are sometimes differentiated.
  • For accounts, "Generated" means a random identifier is created for you to act as your account, "Required" means you must sign up yourself. Proton VPN allows guest use under specific conditions (e.g. installed from the Google Play Store), but otherwise requires an account.
  • Switzerland is seen as more private than Sweden. Gibraltar is seen as privacy neutral.
  • All prices are in United States Dollars. Tax is not included.
  • Pricing is based on the price combination to achieve the exact time frame. For example, Proton VPN does not have a 3 year plan but you can achieve 3 years by combining a 2 year plan with a 1 year plan.
  • The availability section is security based. Availability is framed around a GrapheneOS and secureblue setup.
  • The Proton VPN Flatpak is unofficial, but based on the official code.
  • Availability on secureblue is based on the ujust install-vpn command. Security features must be disabled on secureblue in order to use the GUI for IVPN and Mullvad VPN, but not for Proton VPN. Mozilla VPN and NymVPN are available as Flatpaks, which are safer than layering packages.
  • I wanted to include more categories, such as which programming languages they are written in, connection speed, and security, but that became far too difficult and complex, so I decided to omit those categories.

Takeaways

  • NymVPN is very very new, but it's off to a strong start. It wins in almost every category. I actually hadn't heard of it until I started this project.
  • If you want a free VPN, Proton VPN is the only one here that meets that requirement.
  • If you want to pay week-by-week, IVPN is the only one that allows that.
  • If you're paying month-by-month on a budget, Mullvad VPN is the cheapest option.
  • NymVPN is the cheapest plan for anything past 1 month.
  • If you want to use Accrescent as your main app store, IVPN is the only VPN available there for now.
  • If you want to pay for a bundle of apps, including a VPN, Proton sells more than just a VPN.
  • Mozilla VPN is terrible. The only thing it has going for it is a verified Flatpak, but NymVPN also has that so it doesn't even matter.

top 97 comments

sorted by: hot top controversial new old
[–] 46 points 1 year ago (6 children)

Why is being on the Google Play store a feature worth highlighting? To use an F-Droid expression, that would be an anti-feature.

  • source
  • hideshow 6 child comments
  • [–] 12 points 1 year ago (1 child)

    With the upcoming restrictions on third-party apps that Google has announced maybe? It'll be easier to get from Play, and may not be available otherwise at all.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 1 year ago

    I don't think giving into Google seizing more power is the way. People doing that is what enables the corporation to continue and have more control over their lives, including their privacy.

  • source
  • parent
  • [–] [S] 0 points 1 year ago (3 children)

    As I mentioned, the availability section is security focused. F-Droid has potential security issues compared to Accrescent or the Google Play Store.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 1 year ago* (2 children)

    I didn't suggest F-Droid for inclusion though. I merely used its applicable terminology. Still, with Google Play, you trust Google to ensure that the apk is from the actual source, and with F-Droid, that's delegated to F-Droid. I don't see that as being less secure.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 6 points 1 year ago (1 child)

    I didn’t suggest F-Droid for inclusion though. I merely used its applicable terminology.

    My bad, I understand now.

    Because it's security focused, it includes app stores that are good for their security (regardless of privacy). Other app stores, such as F-Droid, have security issues that Accrescent and the Google Play Store don't share. This topic has been argued to death countless times before, and I don't want to start a flame war, but do try researching it and see what comes up.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 year ago*

    While F-Droid has security issues, the ideological security benefit it provides that Accrescent/Play Store/Obtainium doesn't is the guarantee that the app is open source, and if the developer goes rogue (I.e. Simple Mobile Tools) it gets removed. A lot could be improved though.

  • source
  • parent
  • [–] 31 points 1 year ago (3 children)

    What about logging policies? Seems like that would be an important category to visit - which providers store logs or don't etc. I've heard of some that use RAM-only logging that allegedly never gets stored on disk.

  • source
  • hideshow 3 child comments
  • [–] 3 points 1 year ago (2 children)

    Even so, you never knowif they're really no log. What guarantees that apart from a verbal promise?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 1 year ago

    There is no guarantee unless you could personally audit their facilities and inspect what they did with your account etc. But I would still choose one that states they have a good policy versus one that says nothing on the subject.

  • source
  • parent
  • [–] 29 points 1 year ago

    I believe Wireguard/OpenVPN/etc profile availability is more important than Google Play Store.

  • source
  • [–] 27 points 1 year ago (13 children)

    Are any of these good options for port forwarding? I'm currently using PIA and I'd rather not.

  • source
  • hideshow 13 child comments
  • [–] [S] 24 points 1 year ago (2 children)

    Proton VPN supports port forwarding. IVPN and Mullvad VPN do not. Mozilla VPN and NymVPN don't explicitly state whether or not they do from what I found, so I'm not sure.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 year ago (1 child)

    I had the same dilemma after mullvad stopped allowing you to create port forwards. I switched to Proton which works fine but I'm curious what other options are out there. It can be hard to find the details about port forwarding, especially if it only works when using their app and not with openvpn/wireguard which is easier for running containers.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago (2 children)

    Yeah the spreadsheet is kind of useless without that information

  • source
  • parent
  • hideshow 2 child comments
  • [–] 21 points 1 year ago (1 child)

    Why is proton consistently red in the pricing category despite being cheaper than (or on par with) other options like mozilla which is consistently yellow? Am I misreading this as green = good, red = bad?

  • source
  • hideshow 1 child comment
  • [–] 16 points 1 year ago

    I suggest adding AirVPN.

  • source
  • [–] 15 points 1 year ago (1 child)

    I have never heard of NymVPN

  • source
  • hideshow 1 child comment
  • [–] 14 points 1 year ago (5 children)

    Never heard of NymVPN. Does anyone use them?

    I use Mullvad, and I really trust their devs. Not really looking to change, but having more options is always good.

  • source
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (3 children)

    Same boat, Nym's long term costs seem to scale much better, but I'd be reluctant to leave Mullvad

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago* (2 children)

    I looked on the website. This is actually an "early bird" special price that is ~80% discounted. So after a while, it's going to be $162/year and $310/2 years.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    I looked on the website. This is actually an “early bird” special price that is ~80% discounted. So after a while, it’s going to be $162/year and $310/2 years.

    I don't really pay attention to these "discounts". It is, generally, just a marketing tactic. Plenty of services/websites/shops have the same discount 24/7.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    You're right, it is pretty common to do that but there's always the chance they just cancel the discount around renewal. If you have autopay then you probably already committed to the new price before you realized what happened.

  • source
  • parent
  • [–] 11 points 1 year ago (1 child)

    Why is proton VPN excluded from the winners for open source, license, and based on, despite having the exact same values populated as the other 4 winners?

  • source
  • hideshow 1 child comment
  • [+] 9 points 1 year ago* (last edited 1 year ago) (3 children)
  • [–] [S] 1 point 1 year ago (1 child)

    I do not agree with placing switzerland over sweden in that location category

    I'd be happy to hear your elaboration on this. From what I know, Switzerland is seen as the gold standard in terms of privacy.

    and i think a category should included, that tracks age of vpn or something like that

    The issue is that age doesn't correlate with security. There could be an outdated, insecure VPN that's been around for 10 years, or a modern, secure VPN that's been around for 10 days. If I included it, there would be no "good" or "bad" values. Nevertheless, I will include this in version 2.0.

    (and just for someone curiouse, it should be mentioned that nymvpn does use mullvad servers/ has a deal with mullvad)

    I knew NymVPN used a small bit of Mullvad VPN's code, but I didn't know they used their servers. Could you link to this?

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)
  • [–] 7 points 1 year ago* (7 children)

    Does anyone have experience with the Mullvad, NymVPN, or AirVPN clients (if they exist) on Linux? I'm still mad Proton removed support for their Linux client and replaced it with an intern-level gnome-only taskbar applet. Also, do they support generating plain Wireguard configs?

  • source
  • hideshow 7 child comments
  • [–] 6 points 1 year ago (4 children)

    Why is Tor never compared to vpns for most people? Like 90% are just wanting an encrypted tunnel to a proxiy right?

  • source
  • hideshow 4 child comments
  • [–] 1 point 1 year ago

    VPNs and Tor are used for different purposes (sort of).

    And common tasks like downloading big-ish files or streaming video should not be done on Tor (it's possible, but I believe it is discouraged), but can be done easily over a VPN.

  • source
  • parent
  • [–] 6 points 1 year ago (3 children)

    I'm having problems opening the image, is it just me?

  • source
  • hideshow 3 child comments
  • [–] [S] 8 points 1 year ago* (2 children)

    I've included it both as a post image and as an embedded image for maximum compatibility (e.g. for RSS readers), so there shouldn't be any problems. I've tested it on multiple browsers on multiple devices just fine.

    Edit: It seems lemmy.world is breaking all lemmy.ml images

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 year ago (7 children)

    ProtonVPN has started to become blocked on tons of websites. I have to switch servers all the time, to the point I won't be able to keep a VPN connection up like I used to.

    I've read Mullvad has worsened as well. There seems to be a general ban on VPN use (there was always some of course)

    My last hope: non profits who offer VPN. They keep logs, don't allow torrenting, and require a real name to subscribe. Very few server choices, if any.

    I'm... fine with that. I just want privacy. No surveillance. And I trust the non profit. Plus I torrent on a VPS anyway

    What I would like to see are local VPNs, with a small enough pool of users on each server to not get flagged. A rotation between servers from time to time. Compliant with the law of course (as long as the law doesn't require total surveillance, evidently). The goal is to hide everyone's activity from the providers and websites (yes, I know, fingerprinting)

    But maybe there's some other existing tool/service I'm not aware of?

  • source
  • hideshow 7 child comments
  • [–] 3 points 1 year ago (6 children)

    Does using a VPS truly enhance safety while torrenting? Isn't it still possible for downloads and uploads to be traced back to your identifiable IP address, especially considering that the VPS provider logs your IP and email details?

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 1 year ago* (5 children)

    VPN on VPS (easy to do with gluetun)

    Basically you use a container that's a VPN connection and connect other containers to it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 1 year ago (1 child)

    Exactly this, the commenter above even mentioned they have a VPS already, what's stopping them from (this is just an option) slapping tailscale on there, enabling it as an exit node and being done with it? Would literally take 5 minutes and suddenly your traffic is coming from a datacenter and not your home IP

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Both comments are me. Configuring Tailscale (or Headscale?) is on my to-do.

    To be clear, connecting to the VPS is not what I use for the anonymizing part, it's the gluetun container that connects to ProtonVPN servers. This way I can still access my VPS with its real IP. Not sure if there was a confusion there.

    Simply using my VPS as relay would still attach my browsing to a single IP I'm the sole user of... or not? I do not know how that works.

  • source
  • parent
  • [–] 2 points 1 year ago (2 children)

    Thank you for clarifying. Does using a VPN on a VPS offer the same level of privacy as connecting a VPN container to a torrent container from a home connection? I'm curious about the advantages of using a VPS in this context.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    No advantages privacy-wise, but it's like a seedbox! I keep the torrent client running. Also I'm on a limited mobile data plan on my router at home, so this helps.

    When I found out you could get a free 200GB VPS (look up free tier vps) - and because I had another paid VPS already anyway - I decided to make a seedbox. It's not a ton of storage but it works really well, very happy with it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 year ago

    This is great, thanks for sharing! You've got a few useful feedback points, let me add one more: does a provider have an onion address. This allows decoupling of payment from usage. Not a big thing, but good to know.

  • source
  • [–] 5 points 1 year ago (1 child)
  • [–] 4 points 1 year ago

    Maybe adding number of servers and country diversity

  • source
  • [–] 4 points 1 year ago

    Whats best for mainland China?

  • source
  • [–] 6 points 1 year ago* (10 children)

    FWIW took me less than 1h yesterday to setup WireGuard on 4 different devices :

    • server with wg-easy and thus easy to use Web UI (before 2-step auth)
    • peers
      • BananiPi 3 F (RISC-V) headless via nmcli
      • desktop on Debian via NetworkManaged
      • mobile phone on /e/OS via the WireGuard client (with Ente Auth to login back on server as admin)

    ... and it was the first time I used WireGuard.

    So I'm trying to imply that one shouldn't use commercial VPNs or benefit from their services, solely that setting up your own depending on your abilities and needs might not be as complex as you initially imagine.

    PS: I did have experience with OpenVPN before and a running server already with Docker and nginx as reverse proxy.

  • source
  • hideshow 10 child comments
  • [–] 8 points 1 year ago (5 children)

    Maybe I misunderstand wireguard, but don't you still need a VPN provider to connect to? If it's just your home server, how would you get any anonymity?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 1 year ago* (4 children)

    You can host WireGuard on your server, you don't need a VPN provider specifically, you need a server to put WireGuard on though. Depends who you want to be anonymous from, as per usual it's the threat model that defines the solution.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 year ago (3 children)

    I was thinking for torrenting.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (1 child)

    There's plenty of seedbox companies out there, you can get 10Gbps+ connections and they run the torrent client for you so there's no upload happening from your local PC at all.. Many offer VPN capabilities at the same time, but for general browsing I use a VPS with my own wireguard.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 year ago (1 child)

    I assume you're talking about creating a VPN into your own personal network? Unless you have family or friends in a different country I fail see how you're circumventing geo restrictions or gain anonymity on the internet.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago

    Wrong assumption, you can install it on any other machine you have root access to, e.g. remote ssh. You can rent a server in another country and put your VPN server if that's your need.

  • source
  • parent
  • [–] 6 points 1 year ago (2 children)

    no love for windscribe? :(

  • source
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (4 children)

    You probably dont want to use a super well known vpn for many reasons...

  • source
  • hideshow 4 child comments
  • [–] 7 points 1 year ago* (2 children)

    I'm not sure about your statement, but using a very unknown vpn could lead to possibly tracking you because theres less of a crowd to blend in with.

    Assuming your statement is correct (idk if it is), then there's a middleground i guess.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    Are you sure you can blend in? Depends on the vpn and the laws I guess... If they are able to identify your connection. As far as I know, they all have credentials connected to your account...

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    You are right.

    It is easier to blend in though if the vpn doesn't log (and before logging is added by feds if possible) or if the person tracking you is not a government and doesnt have that control or is just the service you use, etc.

  • source
  • parent
  • [–] 3 points 1 year ago

    Using one only because it's super well known? Sure. It can be well known and scummy. But it can also be well known, trusted, vetted, etc.

    And you also probably don't want to use one that is barely known as there's the lack of trust, getting, who runs it's, etc.

  • source
  • parent
  • [–] 3 points 1 year ago (1 child)

    Would Nym work with Glueten? It seems bewz so its not listed on their github but it supports wireguard so maybe it does.

  • source
  • hideshow 1 child comment
  • [–] 1 point 1 year ago*

    As long as you can generate a wireguard config that works, for example, on your desktop/main pc with wireguard directly, then Gluetun should have no issue (as far as im aware).

    Gluetun specific provider support is usually just there to get setup faster (I think so it can automatically get configs for certain countries, etc).

  • source
  • parent
  • [–] 3 points 1 year ago (1 child)

    Nymvpn seams great! I've never heard of it either. I just hope it stays around and gets a name for itself.

  • source
  • hideshow 1 child comment
  • [–] 3 points 1 year ago (1 child)

    Wow, Nym’s payment model past month-to-month looks good. I don’t really need port forwarding, so the advantage I see they have over Mullvad is the decentralized nature of their servers. Mullvad does have multi-hop but it goes through Mullvad owned or rented servers. Does anyone know if Nym really does use servers that aren’t leased/rented by them for decentralization? Otherwise, they are no different from Mullvad and only the payment model is better.

  • source
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Nym pays users to be a relay as far as I know. There are 5 relays or 2 relays with your preference (depends on the speed and security you want). Maybe they own some servers that I don't know but their encryption techniques are quite advanced. There are articles on their websites that they cannot log anything.

  • source
  • parent
  • load more comments
    view more: next ›