The 4 Best VPN for Windows 11 (2023 Update)

CyberGhost: Temporarily save up to 83%  🔥

Surfshark: Get an 81% discount on this hidden page  🔥

IPVanish: Temporarily get 61% OFF  🔥

How we test the best VPN for Windows 11

We tested 30 paid and free VPN services on Windows 11, Windows 10, macOS, iOS, and Android. For each of the services, we ran through the following tests:

> Test 1: Logging Policy

What is a logging policy?

When you surf the web using a VPN, you assume your privacy is guaranteed. However, that depends on the VPN provider you are using. As all your data is routed through their VPN servers, they can track you, just like your Internet Service Provider.

For instance, a VPN service could track the following:

• What you do online, like the websites you visit and the files you download.
• Where you approximately live via your public IP address.

Many free VPNs, like Hola VPN, actively track the websites you visit and how you engage with those websites. That information is then sold to advertisers and data brokers. That’s how they can offer their service for free. As the saying goes: “If the product is free, you are the product.”

Our research shows that roughly 30% of all VPN services store your originating IP address, and around 5% track your browsing behavior.

Whether or not a VPN provider tracks you should be written in their logging policy. Sadly, these statements are often purposefully written in complicated and vague language.

What do we test for?

We read each VPN service’s privacy and logging policies to study what information they are tracking. Some data logging, like aggregated bandwidth usage and server load data, helps the VPN provider improve their service and doesn’t say anything about you. So we don’t mind it.

However, collecting the following information is not acceptable:

• Browsing activity: We analyze whether the VPN provider tracks what you do online. We don’t like it even when the data is directly deleted at the end of your VPN session. This should never be monitored and stored.
• IP Address: We analyze whether the VPN provider tracks your originating IP address, which shows where you approximately live and what Internet Service Provider you are using. This should never be monitored and stored.

> Test 2: Ownership

What do we mean by ownership?

A VPN service is owned and operated by a company, which is frequently owned by another company. This is called a corporate holding structure and is very common. Both these companies can, theoretically, access your data.

Moreover, these companies are registered in countries, like the United States or the Netherlands, which will have unique Data Retention Laws.

So it matters who owns your VPN service and where they are registered.

At first glance, it might seem that there are many VPN services. However, when you dig deeper, it turns out that a few companies own the vast majority of the popular VPN services:

• Kape Technologies, from the United Kingdom, owns ExpressVPN, CyberGhost VPN, Private Internet Access, and ZenMate.
• Ziff Davis, from the United States, owns IPVanish, Buffered VPN, StrongVPN, SaferVPN, Encrypt.me, Perimeter 81, and more.
• Aura (or Pango), from the United States, owns Hotspot Shield, JustVPN, TouchVPN, and provides the VPN technology for many other VPN services like Bitdefender, Kaspersky, Panda, and more.
• CyberSpace, from the Netherlands, owns NordVPN, Surfshark, and Atlas VPN.
• Gaditek, from Pakistan, owns PureVPN, Ivacy VPN, and Unblock VPN.

What do we test for?

We analyze the owner of the VPN service, the jurisdiction in which they are registered, and the data retention laws of that jurisdiction. We also check the company’s history to find out whether there have been scandals.

For instance:

• Kape Technologies was called Crossrider until 2018. Crossrider created a development platform for browser extensions. Unfortunately, this platform was used by ad injectors and malware creators, which hurt the company’s reputation.
• IPVanish handed over data to Homeland Security in 2016. According to its logging and privacy policy, it wasn’t supposed to have this data. Even though IPVanish has changed owners twice since the incident, the privacy industry remains apprehensive.

> Test 3: Independent Audit

What is an independent audit?

VPN providers make a lot of claims, especially in their marketing material. “Zero-Log Policy” and “Military Grade Encryption” are just some of the buzzwords flying around. But how do we know if any of this is true?

That’s where the independent audit comes in. A VPN company can hire an auditor to analyze a specific element of its operation or infrastructure. Often this is the server infrastructure or the privacy policy.

Examples include:

• ExpressVPN’s audit by PricewaterhouseCooper (PwC) in 2019 analyzed whether ExpressVPN’s TrustedServer technology wiped all data each time the server was rebooted.
• NordVPN’s audit by PwC in 2020 investigated the server infrastructure, configuration, and technical logs. It also interviewed NordVPN’s employees.
• Surfshark’s audit by Cure53 in 2021 investigated Surfshark’s server infrastructure for flaws.
• Private Internet Access (PIA) audit by Deloitte in 2023 investigated the server environment in relation to PIA’s privacy policy.

What do we test for?

We analyze whether the VPN providers underwent an independent audit, what the audit investigated and what flaws it uncovered. 

> Test 4: Available VPN Protocols

What is a VPN protocol?

A VPN protocol sets the communication rules between a VPN server and a VPN app. It determines how the two identify each other, how the app logs into the server, how the data is sent, how the encryption works, and more.

Switching VPN protocols can dramatically impact the time it takes to connect to a VPN server, the download speeds, and the overall security.

The most common protocols are:

• OpenVPN: The most popular and versatile open-source VPN protocol. It is fast, secure, and very customizable. It works with nearly all operating software and is used by almost every VPN service.
• WireGuard: The next-generation open-source VPN protocol, designed to improve OpenVPN and IPsec. It has far fewer lines of code and allows for considerably higher download speeds than the other two.
• IKEv2: A very secure VPN protocol designed by Cisco and Microsoft. Although it should also be fast, our tests show it to be considerably slower than both OpenVPN and WireGuard.
• L2TP/IPSec: A simpler, older, and slower VPN protocol.
• PPTP: One of the oldest VPN protocols, with several vulnerabilities.

Some VPN providers, like NordVPN, Hotspot Shield, and ExpressVPN, have designed their proprietary VPN protocols. Of the three, only ExpressVPN’s protocol is open source, allowing others to inspect its code.

• NordVPN has developed NordLynx, based on WireGuard.
• ExpressVPN has developed Lightway from scratch.
• Hotspot Shield has developed Catapult Hydra from scratch.

There isn’t a best VPN protocol. Most VPN software use OpenVPN as the default option, while offering WireGuard or IKEv2 as alternative options.

What do we test for?

We test which VPN protocols are offered by the various VPN providers. We also check whether these protocols are available on all devices or limited to specific operating systems. 

> Test 5: Supported Encryption Standard

What is an encryption standard?

An encryption standard specifies how digital data is encrypted. In 1977, the Data Encryption Standard (DES) was released as the first symmetric key algorithm. This means that the same encryption key is used for encrypting and decrypting the data.

In 2002, the United States government replaced DES with the Advanced Encryption Standard (AES). AES is a version of the Rijndael block cipher. It uses a block size of 128 bits, with a key size of 128, 192, or 256 bits.

Most VPN protocols use AES-128 or 256 in the GCM or CBC version. GCM is faster than CBC because it can be written in parallel rather than in a series, which increases its throughput. It is also more secure because each block can be encrypted independently.

What do we test for?

We check the default encryption standard of the VPN service and what alternatives are offered. If AES-128 is the default, we expect it to be AES-128 (GCM). Otherwise, we prefer AES-256.

> Test 6: Basic Security Features

What are basic security features?

There are several basic security features that each VPN should offer:

• AES-256 encryption: The most secure encryption standard. With modern computing technology, it is virtually unhackable via brute-force methods.
• OpenVPN and WireGuard: OpenVPN is the gold standard of open-source VPN protocols, and WireGuard is the modern challenger for the title.
• Split tunneling: The ability to allow specific programs to bypass the VPN tunnel and directly connect to the internet.
• Kill switch: The automatic blocking of the internet connection if the encrypted VPN tunnel fails.

What do we test for?

We test whether the VPN provider offers each of these features and, in the case of the kill switch feature and split tunneling feature, whether they work as promised.

> Test 7: Advanced Security Features

What are advanced security features?

There are several advanced security features that can increase your privacy. The most important ones are:

• Ad, tracker, and malicious website blocker: The automatic blocking of ads, tracking cookies, and dangerous URLs known for phishing attacks and malware.
• Dedicated IP address: The ability to get a unique IP address. This helps when you need to access restricted servers that only authorized IP addresses can access. It can also help to avoid blacklists, captchas, and confusing your online bank with ever-changing IP addresses.
• Double VPN: The ability to route your internet traffic through two VPN servers rather than one, known as VPN server chaining. This doubles your encryption, adds additional IP protection, and offers complete privacy.
• Obfuscated servers: Specialized VPN servers that change your data to hide the fact that you use a VPN. This can help in highly censored countries like China or the UAE, which try to block VPN traffic.
• Override GPS Location: A feature that allows you to set your GPS location to the location of the VPN server. This is also known as GPS spoofing and can stop apps like Google Maps or Facebook from knowing where you are.
• RAM-only servers: Specialized VPN servers that don’t have classic hard drives. The advantage is that the information on the server’s Random Access Memory (RAM) is wiped automatically every time the server is restarted. So when a server is confiscated, there won’t be any data on it.

What do we test for?

We test whether the VPN provider offers these features and whether they work as promised.

> Test 8: IP Leak

What is an IP leak?

All your devices have a public and a private IP address. When your devices communicate with each other over the same network, they use the private IP address. When your devices communicate over the internet, they use the public IP address.

The public IP address is shared by all your devices and assigned by your Internet Service Provider (ISP). It is usually an IPv4 address, but it could also be an IPv6 address, which is slowly replacing IPv4.

Your IP address can be a privacy threat for two reasons:

• It indicates your approximate location on a zipcode or neighborhood level.
• Combined with your browsing history, it can identify you personally and grant a detailed overview of all your surfing habits.

A VPN is designed to combat this. Its core purpose is to encrypt your internet connection and replace your public IP address with the IP address of the VPN server. This has two benefits:

• Your ISP only knows that you’re using a VPN but cannot see the websites you are visiting. So it cannot track your surfing habits.
• The apps and websites you visit can only see the IP address of the VPN server, not yours. So they don’t know where and who you are.

An IP leak occurs when your originating public IP address is visible rather than the VPN server’s IP address.

What do we test for?

We connect to a VPN service and run an IP address lookup. We have an IP leak when the IP address is our own rather than that of the VPN server.

> Test 9: DNS Leak

What is a DNS leak?

A Domain Name System (DNS) translates human-friendly domain names into the actual IP address of a website. So, for instance, when you type SoftwareLab.org into your browser, it will automatically take you to 165.227.148.211, thanks to the DNS.

So if the DNS is the internet’s phonebook, then the DNS servers are the phone operators. They are the ones that translate the domain name to the IP address. In most cases, your Internet Service Provider (ISP) operates the DNS servers.

As you can imagine, this gives your ISP an overview of your entire browsing history. After all, each time you visit a website, its DNS servers are needed to get you there. That is why high-quality VPN services have their own DNS servers.

A DNS leak occurs when your DNS queries route via the ISP’s DNS server rather than through the VPN tunnel to the VPN’s DNS servers. For example, this can occur when you use a VPN that doesn’t have its own DNS servers or when you have made a mistake while manually adjusting your VPN settings.

What do we test for?

We connect to a VPN service and run a DNS server lookup. When the VPN service does not own the DNS servers, we know we have a DNS leak.

> Test 10: WebRTC Leak

WebRTC (Web Real-Time Communication) enables modern web browsers, like Firefox and Chrome, to create communication channels with websites in real time. This allows them to stream live video and audio feeds without requiring additional software. 

During this communication, the website and web browser exchange a range of data, including your public and local IP address. As this is part of the standard functionality of WebRTC, there is no quick fix. You can attempt to block WebRTC requests in your browser, but this is tricky.

Instead, the best way to solve the problem is by using one of the best VPN services. They will allow authorized WebRTC connections to continue, but make sure they send the VPN server’s IP address rather than your own.

What do we test for?

We connect to a VPN service and run a WebRTC lookup. When our original IP address is displayed, we have a WebRTC leak.

> Test 11: Download Speed via OpenVPN

What is OpenVPN?

OpenVPN is an open-source VPN protocol. Therefore, anyone can inspect and critique its source code. This has allowed the protocol to improve continuously since its introduction in 2001.

Today, it is often called one of the most secure VPN protocols. Most VPN services use it to provide reliable and secure connection speeds on multiple operating systems.

Within the OpenVPN protocol, there are two versions:

• OpenVPN UDP (User Datagram Protocol): It is often the default option because it allows for the fastest download speed.
• OpenVPN TCP (Transmission Control Protocol): It allows for greater control over data transmission at the cost of a slower download speed.

Until the introduction of the WireGuard VPN protocol, OpenVPN was the gold standard. All of the best VPNs still use it, although some have started to prefer WireGuard for the higher download speeds.

What do we test for?

We test the download speed of each of the top VPN services while setting the Windows app to the OpenVPN protocol. We test the speed on a 1 Gbps (1.000 Mbps) internet connection to push the VPN to the limit.

> Test 12: Supported Speed via WireGuard

What is WireGuard?

WireGuard is an open-source VPN protocol. It was designed to be simpler, faster, and leaner than OpenVPN and IPsec. Where these two VPN protocols have close to 500.000 lines of code, WireGuard only has 4.000. This makes security audits and debugging considerably faster and easier.

Although it was initially designed for Linux kernel, it now runs on all major operating systems, including Windows, macOS, Android, and iOS.

In our tests, spread across a wide range of VPN services and servers, we found WireGuard to be roughly 60% faster than OpenVPN.

What do we test for?

We test the download speed of each of the top VPN services while setting the Windows app to the WireGuard protocol. We test the speed on a 1 Gbps (1.000 Mbps) internet connection to push the VPN to the limit.

> Test 13: (Virtual) VPN Servers and Locations

What are (virtual) VPN servers?

A VPN server is a server that hosts specialized VPN software, which allows it to create an encrypted VPN tunnel with VPN clients. In some cases, it will also have specialized VPN hardware. For instance, the RAM-only servers of NordVPN and Surfshark are purposely designed to host VPN services.

Most VPN servers are physical VPN servers. That means the server is located in the country indicated in the VPN app. So when you connect to one of these servers, your internet traffic is routed via the physical server in that country, which gives you a local IP address.

However, not all countries have local server infrastructure. Smaller or less developed countries usually don’t have server parks. For instance, the tiny mountainous country of Andorra does not have any physical VPN servers. Yet some VPN providers still offer a VPN server in Andorra.

That is what we call virtual VPN servers. They will give you a local IP address, even though the actual server is located elsewhere. So, for instance, you will get a local IP address from Andorra, even though the server is located in neighboring Spain or France.

Most VPN providers with an extensive server network have servers in roughly 60 countries. If they have servers in more countries, the rest is usually made up of virtual servers. 

What do we test for?

We analyze the number of servers and locations a VPN provider offers. We also examine whether servers can be selected on a country or city level and whether these servers are physical or virtual.

> Test 14: Streaming Compatibility

What is compatibility with a streaming service?

Streaming services don’t always show you all their series and movies. Some shows are limited to specific countries. For instance, Netflix has particular shows that are available in the United States but not abroad.

A VPN service is a great way to unlock these shows. Because when you log into a VPN server in the United States, you will get a local IP address. In theory, this means that you should be able to see all local shows.

In practice, however, this is not always the case. Netflix tries to know whether its users are connecting via a VPN server. And if that is the case, it will block access to Netflix until the VPN is turned off.

Therefore, there is a constant cat-and-mouse game between streaming services and VPN providers. And only some VPN providers can stay consistently one step ahead of the streaming services.

What do we test for?

We test whether a VPN provider can unblock Netflix, Disney Plus, Amazon Prime Video, HBO Max, Hulu, and BBC iPlayer in the United States. In the case of Netflix, we also check other countries, like Australia, the UK, Japan, Brazil, Mexico, and Germany.

> Test 15: Torrenting Compatibility

What is compatibility with a torrent network?

Torrenting is a form of peer-to-peer (P2P) downloading. This means that users make files available for other users to download. So there is no centralized server or service. Instead, the users download from each other.

Users must use a torrent client like μTorrent or BitTorrent to make it work. But in some instances, it can also work as a streaming service, as with Popcorn Time.

Torrenting is not illegal. It is simply the sharing of files. However, the shared files are often copyrighted material like movies and music. This is why torrenting is so often associated with piracy.

What do we test for?

We test whether VPN services allow downloading files via peer-to-peer networks on some or all of their servers.

> Test 16: Annual Price and Price per Device

What is the annual price and price per device?

VPN services usually state their price per month, with a single-month subscription being the most expensive and the price falling with the duration of the contract.

To compare apples to apples, we look at the annual price for a one-year contract and the price per device. It then quickly becomes apparent that most VPN services are priced similarly, except for ExpressVPN, which is far too expensive.

Some VPN providers, like Surfshark and IPVanish, allow you to install their service on unlimited devices. That makes their price-per-device very small. So these are excellent services to share with a friend.

What do we test for?

We calculate the annual price in a one-year contract for each VPN provider. We also look at the price per connection by dividing this price by the number of simultaneous connections allowed.

What VPNs for Windows 11 have we tested?

We have tested 30 paid and free VPNs (Virtual Private Networks). Proton VPN is the best free VPN service. But if you have the money, we recommend getting a paid VPN service.

In the best case, the free version allows you to protect only one device and doesn’t offer you unlimited bandwidth / unlimited data. And in the worst case, the free VPN providers show you ads or secretly sell your browsing history to advertisers and your internet service provider.

And should you be strapped for cash, don’t opt for an expensive VPN like ExpressVPN. Instead, get a cheap VPN, like Surfshark, that allows you to install it on an unlimited number of devices and share the cost with a friend.

• Astrill VPN
• Atlas VPN
• Avast SecureLine VPN
• Betternet VPN
• Bitdefender VPN
• CactusVPN
• CyberGhost VPN
• ExpressVPN
• HideME VPN
• HMA VPN (HideMyAss VPN)
• Hola VPN
• Hotspot Shield VPN
• IPVanish VPN
• Ivacy VPN
• IVPN
• Kaspersky VPN Secure Connection
• McAfee Safe Connect VPN
• Mozilla VPN
• MullVad VPN
• NordVPN
• Norton Secure VPN
• Private Internet Access VPN
• PrivateVPN
• Proton VPN
• PureVPN
• StrongVPN
• Surfshark VPN
• Tunnelbear VPN
• VyprVPN
• Windscribe VPN

The best are: CyberGhost, NordVPN, and Surfshark.

Frequently asked questions

Languages, comparisons and Sources

This page in other languages on SoftwareLab.org:

• Dansk
• Deutsch
• English
• Español
• Français
• Italiano
• Nederlands
• Português
• Svenska

Other comparisons on SoftwareLab.org:

• Best Antivirus of 2023
• Antivirus for Windows 11
• Antivirus for macOS
• Antivirus for Android
• Antivirus for iOS
• Antivirus with a VPN
• Best VPN of 2023

VPN privacy policies and independent audits:

• CyberGhost – Privacy Policy
• CyberGhost – Transparency Report
• ExpressVPN – Privacy Policy
• ExpressVPN – PWC Audit
• ExpressVPN – Lightway Audit
• ExpressVPN – Browser Extension Audit
• IPVanish – Privacy Policy
• NordVPN – Privacy Policy
• NordVPN – Privacy Policy Audit
• Surfshark – Privacy Policy
• Surfshark – Infrastructure Audit

VPN testing tools:

• BrowserLeaks – Data Leak Test
• Fast – Speed Test
• Speed Test – Speed Test
• Exodus – Privacy Audit Android

Custom VPN protocols:

• ExpressVPN – Lightway protocol
• NordVPN – NordLynx Protocol

VPN mergers and acquisitions:

• NordVPN and Surfshark merger
• Kape technologies buys CyberGhost
• Kape Technologies buys ExpressVPN
• Kape technologies buys Private Internet Access