What Should You Look for in a VPN?
Choosing a VPN means choosing which party you trust, and how much. A decision procedure: which properties matter for your threat model, and which only sound reassuring.
Provider comparison pages rank features, and the ranking is almost always wrong. Feature lists measure the part of the decision you can least influence. What separates a service you can rely on from one you cannot is much narrower, and it has almost nothing to do with how many countries appear in the server list.
Short answer#
Two things carry the weight. Who operates the server you connect to, and what they can be compelled to hand over. Everything else you will read in a comparison is either identical across providers or irrelevant to the risk you actually care about.
The second question is the one people skip. There is no universally best provider, because the answer depends on who you are defending against.
Begin with the adversary#
A VPN changes what your network sees. It does not change what the service you log into already knows, and it does not change who follows you afterwards.
That makes the useful first question narrow. Are you trying to stop a curious network, or are you trying to stay unlinked from an adversary that can compel the operator? The two need different things, and most of the marketing copy on offer answers neither one directly.
Privacy versus anonymity draws this line in full. The short version is that a single tunnel buys you the first situation and has very little to offer against the second, which is also why the rest of this level keeps returning to who is running the machine.
The properties that actually vary#
Only a handful of things differ meaningfully between providers. They are worth sorting into two groups.
Who operates the server. Some operators publish who owns them. Mullvad states that Mullvad VPN AB and its parent Amagicom AB are entirely owned by two named founders, and publishes an owner’s directive alongside that structure. Other operators tell you only that a brand exists.
What they were ever asked for. This is checkable, and few pages surface it. As displayed in 2026, IVPN’s transparency report lists 34 government requests between 2016 and 2026, of which three were judged valid, with data provided in none of them. That is a stronger signal than a policy promise, because it describes what happened rather than what is intended.
What they keep regardless. Every service needs enough state to run a network. Connection metadata, which servers are busy, how many people are online at once. The useful question is never whether any of this exists. It is whether any of it can be joined back to you.
How the service is funded. If revenue comes from selling data, the privacy policy is not a technical document. Most subscription services avoid this, but it is worth thirty seconds of checking.
The properties that are the same everywhere#
Worth naming explicitly, because these eat most of the attention in comparisons.
Encryption standard, protocol availability, kill switch behaviour, and the presence of a no-logs claim all have near-universal answers among services large enough to review. AES-256 with a modern handshake is the norm. WireGuard, OpenVPN and their variants are all present. A kill switch is a feature every serious provider ships.
Where a provider does differ here, it is usually because they left the mainstream, which brings its own costs. The protocol trade-offs are covered separately, and none of them are free.
What no provider can fix#
This is the part that gets left out of every comparison table.
A VPN does not touch what the sites you visit know about you. It does not stop a browser fingerprint. It does not hide which accounts you hold, and it will not help if the machine itself is compromised. If any of those is your actual concern, the tunnel is the wrong tool and no amount of provider diligence will change that.
None of this makes a VPN a poor choice. It makes a VPN a specific choice, covering a specific set of problems.
How to check a claim rather than accept it#
Three habits separate a real check from reading a marketing page.
Look for the weakest specific claim rather than the strongest general one. Mullvad’s policy lists what it does not keep, down to DNS queries and connection timestamps, which is checkable in a way that “we take your privacy seriously” is not.
Look for a published answer to a legal request. A provider that has never been asked has told you nothing either way.
Treat third-party verification as dated and scoped. An audit describes one system on one week, and the scope is usually printed on the cover.
Common misconceptions#
“A no-logs policy makes a provider trustworthy.” A policy is a statement of intent. It becomes evidence when something external tests it, such as a seizure finding nothing, or a transparency report showing requests refused.
“Independent means safe.” Small and founder-run describes ownership, not operations. A two-person company and a listed holding company both depend on rented hardware in buildings they do not own.
“The fastest service is the best service.” Speed is a property of the path to you, not of the operator’s ethics. It rarely correlates with anything you care about here.
“Audited means verified.” An audit covers a snapshot. Read the scope before you read the verdict.
Which one should you pick#
Pick against a specific adversary and the choice gets easy. If you want a company network to stop logging your browsing, a mainstream provider is fine and the decision barely matters. If you want a record to exist nowhere that can be requested, the operator’s structure and the location of the hardware both narrow the field sharply, and the comparison pages will not tell you how.
The two articles that follow this one work through that field: who is actually behind the brands, and who controls the machines.
Related#
- What Is a VPN?: what a tunnel changes and what it leaves alone
- Privacy vs Anonymity: the distinction this decision turns on
- What Does Your ISP See?: the visibility a VPN actually removes
- What Is a VPN Protocol?: why protocol differences matter less than they seem to
Sources
- IVPN Transparency report IVPN
- No-logging of user activity policy Mullvad
- Policies Mullvad
- ExpressVPN statement on Andrey Karlov investigation ExpressVPN
Last reviewed October 8, 2026. Corrections and additions are welcome.