Data notes

Server lists

Every provider page is built from the list the provider itself publishes for its apps or its website. The list is read several times a day. Kept are the location, its country and city, the number of server endpoints and, where the list has one, the virtual marker. Nothing is corrected: a location stands under the country the list names. A source counts as documented when the provider describes it for outside use, as read by the provider's published tools when its own apps or website use it, and as public but undocumented when it answers without a login but is described nowhere. Where a provider's page also states totals of its own, they are shown beside what its list names; the two can differ, for example when a page counts servers it does not list. Where a provider offers no such list, the server page of its website is read instead; such a page names servers but no addresses, so its locations cannot be measured. Server addresses are used for measuring only and are not published.

Virtual markers

Some providers mark locations whose servers stand in another country than the one they are listed under. The site repeats that marker exactly as the list gives it. Where a list has no such field, the column shows a dash, and the provider says nothing either way. The marker is the provider's own statement and not a finding of this site. What a measurement shows is given separately, under status.

Measurements

For a changing selection of locations, one published server endpoint is pinged from probes in many countries. A reply that arrives faster than the distance to the listed country allows rules that country out. A location is shown as incompatible only when several independent probes rule it out, and a finding counts as confirmed once a second day shows the same. A location is shown as compatible only when nothing rules it out and the closest reply places the server within 1,000 km of the listed country; where no probe is near enough for that, the result is that no statement is possible. Measured first are locations where a finding would say something the provider's list does not: lists without a virtual marker, then locations a marking list leaves unmarked. Measured is the published endpoint, not the address traffic leaves from. A full round over all locations takes a few days; until then a location is shown as pending.

Method

Networks

For every published server endpoint the site records which network announces its address on the internet. This comes from a public routing table, not from a measurement of our own. Published are the network and how many locations sit in it, never an address. The country shown with a network is where the network is registered, which says nothing about where a server stands. What the table does show is which providers place servers with the same operators.

Networks behind VPN servers: who shares them

Prices

Prices are read from each provider's own pricing page, without an account and without a discount code, from the country named above the table. A provider may show other prices to visitors from other countries. Kept are the plan, the term, the price of the first term, a crossed-out price and the price and term at renewal, each only where the page states it. The price per month and the comparison with the renewal price are computed from these figures, with bonus months counted in. Where a pricing page can only be read after a browser check, no prices are collected. Prices that could not be checked again for two weeks are no longer shown.

Changes

Each reading of a server list or pricing page is compared with the one before, and every difference is recorded with its time: a location added or removed, a marker, country or network changed, a price changed. The first reading of a provider is a starting point and not a change. A changed marker or country counts only once two readings in a row show it, because some lists answer differently from one request to the next. Where a list names a different selection of servers on every request, changes in the number of endpoints are not recorded. The page and the feed show the last three months.

Changes

Intelligence alliances

Five Eyes stands for the intelligence-sharing arrangement of Australia, Canada, New Zealand, the United Kingdom and the United States. Nine Eyes names these five plus Denmark, France, the Netherlands and Norway; Fourteen Eyes adds Belgium, Germany, Italy, Spain and Sweden. The site files every listed location under the narrowest of these circles its listed country belongs to, and does the same for the country in which a carrying network is registered. The figures say where servers are listed and who carries them. They say nothing about where a provider has its seat, which law applies to it, or what any authority actually obtains.

VPN locations in Five, Nine and Fourteen Eyes countries

Review lines

A review on this site is an evaluation of what the archive holds about a provider: its server list, the measurements, the networks and the stated prices. Each line is produced by a fixed rule. Speaking for a provider: its list marks virtual locations, its list is documented or used by its own published tools, every measured location was compatible, it states which servers it owns, the price does not rise after the first term. Speaking against: a measured location is incompatible with its listed country without being marked virtual, the list names no addresses and so cannot be measured, the price rises after the first term. Everything else is listed as worth knowing, without a verdict. Apps, speed, streaming and customer support are not tested, and no line depends on whether a provider pays a commission.

VPN reviews: what the data shows

Provider websites

Once a day a browser opens each provider's home page the way a first-time visitor would: no cookies, no click, no consent given. Its network log shows every address the page contacts. Addresses on the provider's own domains are the provider's own; everything else is an outside service, named by its domain and, for well-known services, by company and purpose. Advertising, analytics, tag managers, session recording and A/B testing are counted together because they exist to follow visitors or to load code that does. What a site shows depends on the country a request comes from, so the country is named. Not seen is anything that happens after a click, after consent or after login, and statistics a provider runs on its own domain. A site that answers automated browsers with a check is not read; the check is not worked around. An outside service counts as added or removed once two checks in a row agree.

VPN provider websites: which other companies they contact

Features

A feature such as streaming, an ad blocker or P2P support is listed for a provider when its own pricing page, or the page of its server list, names it. The wording was read and written down by hand, and every later reading of the page checks whether those words are still there; a feature whose wording has gone is no longer shown. This says what a provider advertises. Whether streaming works, how well a blocker blocks or how fast a server is cannot be tested without an account with every provider, and is not tested here.

Company, seat and owner

Who is behind a provider is not in any list, so it is looked up by hand: the company named in the provider's own terms or about page, the country it gives as its seat, the owner it or the owner names, and what it publishes about independent audits. Every entry links the page it comes from and carries the date of the look-up. Nothing is filled in from memory or from other websites; where a provider's own pages could not be read or do not say, the field stays empty. The entries are reviewed at intervals of a few months, so a recent change of owner may not be reflected yet.