Most free VPNs are worse than no VPN at all. They log your traffic, sell your browsing data to advertisers, inject ads into web pages, or use your device as a node in a botnet. We tested and verified only three free VPNs that are genuinely safe — backed by independent audits, transparent business models, and no data monetisation.
The problem
These are not theoretical risks. These are documented, specific harms from VPNs with tens of millions of users. If any of these are installed on your device, uninstall them now.
Hola operates what is effectively a residential proxy botnet. When you install Hola, your device becomes an exit node — meaning other users' internet traffic routes through your IP address. Criminals using Hola's Luminati (now Bright Data) commercial network can commit crimes that appear to originate from your home address. In 2015, Hola was used to coordinate a DDoS attack against 8chan, with bandwidth harvested from Hola's free users without their knowledge. Your IP address becomes someone else's tool. This is not a privacy concern — it is a criminal liability.
A 2017 analysis by researchers at Carnegie Mellon University found that HotSpot Shield's free tier was injecting JavaScript code into web pages to serve targeted ads, and redirecting e-commerce traffic through affiliate networks. A complaint was filed with the FTC. AnchorFree (HotSpot Shield's parent at the time) denied the most serious allegations, but their own privacy policy at the time explicitly acknowledged sharing data with "advertising partners." The free product's business model depends on monetising user traffic.
SuperVPN was downloaded over 100 million times before Google removed it from the Play Store. Security researchers discovered it contained critical vulnerabilities that exposed users to man-in-the-middle attacks, and that it was hardcoded to connect to servers flagged in threat intelligence databases. A 2020 breach exposed data from over 20 million users including email addresses, device identifiers, and payment data — from a VPN that was supposed to protect user data.
Both TouchVPN and Betternet operate on an explicitly data-funded model. Betternet's own privacy policy (at time of analysis) stated that it collects browsing data and shares it with third-party advertising partners. TouchVPN is owned by Aura (formerly Pango), who have faced scrutiny for aggregating data across their portfolio of free VPN apps. Independent analysis of the Betternet APK found 14 malware trackers embedded in the Android app. The business model is surveillance, not privacy.
The business reality: running VPN servers at scale costs real money — bandwidth, hardware, staff, audits. If you are not paying, and there is no paid tier subsidising you, then the revenue has to come from somewhere. In every case above, it came from you. The three VPNs we recommend below each have a clear, honest answer to the question of how they pay their bills.
Our verified picks
Each of these has been independently audited, has a transparent business model that does not rely on data sales, and has published open source code. These are not affiliate picks dressed up as recommendations — Hola and SuperVPN would pay affiliate commissions too. We only list what we would install on our own devices.
Side by side
We include Hola VPN in this table as a cautionary baseline. Every "No" in the safe column corresponds to a documented harm.
| VPN | Data limit | Server locations | Audited | Sells data | Injects ads | Speed | Verdict |
|---|---|---|---|---|---|---|---|
|
Proton VPN Free
Our #1 pick
|
None | 3 countries | Yes | No | No | 30–100 Mbps | Use this |
|
Windscribe Free
Our #2 pick
|
10GB/mo | 11 countries | Yes | No | No | 50–150 Mbps | Use this |
|
hide.me Free
Our #3 pick
|
10GB/mo | 5 locations | Yes | No | No | 40–120 Mbps | Use this |
|
Hola VPN
Avoid
|
Unlimited* | 190+ countries | No | Yes | Yes | Variable | AVOID |
*Hola's "unlimited" data comes at the cost of routing other users' traffic through your device. Speed results are our own tests across 4-week periods. Speeds vary by server load and location.
Honest assessment
On Proton VPN free specifically: the limitations are real but bounded. Here is exactly what you get and what you give up.
Bottom line on who should stay free: if your use cases are privacy on public Wi-Fi, basic encryption, DNS leak prevention, and general browsing — the free tier is completely adequate. 90% of people who say they "need a VPN" actually only need these things. The paid tier is for streamers, torrenters, travellers to restricted countries, and people who need servers in specific locations.
Practical guidance
Five specific situations where the free tier will fail you, and the honest answer is that you need to pay.
You need servers in more than 3 countries. Proton free locks you to Netherlands, USA, Japan. If you need a UK server for BBC iPlayer, a German server for regional content, or any location outside those three — upgrade.
You need to unblock Netflix, BBC iPlayer, or Disney+. Streaming services block shared VPN IPs aggressively. Free tier IPs — shared across thousands of users — are almost always blocked. Paid VPNs rotate IPs and maintain dedicated streaming servers. The free tier does not do this reliably, if at all.
You are torrenting. Proton VPN free explicitly blocks P2P traffic. There is no workaround. You need a paid plan with P2P-enabled servers. Windscribe free also throttles P2P connections significantly.
You regularly use more than 10GB/month on Windscribe. One HD film is roughly 4–7GB. If you use Windscribe free for anything beyond basic browsing, you will hit the cap. At that point, switch to Proton VPN free (unlimited) or pay for Windscribe.
You need to work from China or other VPN-blocked regions. All three free tiers lack obfuscation protocols. China's Great Firewall can detect and block standard WireGuard and OpenVPN traffic. Paid plans from Astrill, ExpressVPN, and Surfshark have obfuscation that works in China. Free tiers do not.
If you need to upgrade, our recommendation is Surfshark. At $2.19/mo on the 2-year plan, it covers all five gaps above: 100+ countries, reliable streaming unblocking on Netflix and BBC iPlayer, full P2P support, no data caps, and an obfuscation mode for China. Unlimited simultaneous devices means one subscription covers your whole household.
See Surfshark deal ↗Common mistake
This is a critical distinction that almost no free VPN guide explains clearly. A browser VPN extension routes traffic from your browser through a proxy server. Everything else on your device — other browsers, torrent clients, apps, system processes, OS updates — sends traffic through your normal unprotected connection.
The specific products to be aware of:
None of these are independently audited. Several (SetupVPN in particular) have been found to contain trackers and log browsing data. Even the legitimate ones — like Opera's built-in VPN — explicitly state they are proxies, not full VPNs. Opera's VPN does not encrypt anything: it changes your apparent IP address within the browser, that is all.
If you want real protection, you need a full system-level VPN app — like the three we recommend above. A browser extension is not a substitute, and for security use cases it provides a false sense of protection that may be worse than using nothing.
Common questions