Our VPN Testing Methodology
Every VPN on the site is evaluated across five separate test areas using the same standardised procedure. Ad revenue does not influence rankings or scores — this page explains in detail how each test is performed, which tools we use and the assumptions behind the scoring.
Last updated: May 25, 2026
1. Independence and Revenue Disclosure
To earn your trust we openly disclose our revenue model. The site's revenue comes from Google AdSense ads; we receive no commission from any VPN provider.
The site's only revenue source is Google AdSense ads. We receive no sales commission from any VPN provider; links to providers are plain, non-commercial links that go directly to the brand's official site.
All providers, including Mullvad, are scored against the same criteria. Ad revenue does not influence rankings or scores — this is the most concrete signal of our impartiality.
Our editorial pledge
- Every VPN subscription we test is purchased with our own money; we do not accept free or sponsored accounts from providers.
- No provider has pre-publication review, edit or veto rights over our content.
- Rankings, scores and critical notes are the responsibility of the editorial team; sales and marketing have no input.
- A provider's score is calculated independently of ad revenue; a brand running ads does not move it higher in the ranking.
2. Testing Methodology
Every VPN is tested in five categories using the same procedure. The detailed protocol for each category is below.
a) Speed test
Measurements over the same baseline, with fixed hardware and ISP, across three geographic regions.
- Tools used
- Ookla Speedtest CLI, Cloudflare speed.cloudflare.com (cross-verification), fast.com (CDN-based sanity check).
- Test locations
- Turkey (Istanbul, near server), Germany (Frankfurt, medium distance), USA (New York, far distance).
- Procedure
- 1Before any test we take 5 measurements with the VPN off and compute the baseline (download, upload, ping).
- 2For each VPN we select the preferred protocol (WireGuard / Lightway / NordLynx).
- 3On every server we take 10 measurements 60 seconds apart; the highest and lowest are discarded and the remaining 8 are averaged.
- 4We run separate tests at a fixed off-peak time (09:00–11:00) and at peak (20:00–22:00).
- 5Results are reported as the percentage drop versus baseline; raw speed alone is not meaningful.
- Metrics we record
- Download (Mbps), Upload (Mbps), Ping (ms), Jitter (ms), packet loss (%).
b) Security and leak tests
Technical tests that verify how much protection a VPN really delivers.
- Tools used
- ipleak.net, dnsleaktest.com (extended test), browserleaks.com (WebRTC + canvas), test-ipv6.com, Wireshark (TCP-level packet inspection).
- Checks performed
- 1IPv4 leak: whether the real IP is exposed while the VPN is active.
- 2IPv6 leak: many home connections have IPv6 enabled; does the provider block it?
- 3WebRTC leak: tested separately in Chrome, Firefox, Edge and Safari.
- 4DNS leak: do queries go to the VPN's own resolver or to the ISP? Verified via the extended test across 6 different resolvers.
- 5Kill switch: the VPN process is forcefully killed during an active connection (Task Manager / kill -9) and we verify that internet access is actually severed.
- Configuration review
- We check whether the provider uses its own DNS, whether the default protocol is modern (WireGuard / OpenVPN UDP), the cipher (AES-256-GCM or ChaCha20) and certificate validation.
c) Streaming test
How reliable is access to geo-restricted platforms?
- Platforms tested
- Netflix (US, UK, JP, TR libraries), Disney+, BBC iPlayer, YouTube TV, Amazon Prime Video, BluTV and Exxen.
- Procedure
- 1We log into each platform with our own paid subscription via parallel browser sessions.
- 2Every target region is tested across 3 different servers (e.g. US East, US West, US Central).
- 3For providers that offer Smart DNS, obfuscated or streaming-optimised servers, standard and special servers are reported separately.
- 4We also record video quality (480p / 1080p / 4K) and buffer time during the test.
- Result metric
- Success rate per platform (%) — 9/9 working servers means 100%, none working means 0%.
d) Privacy and no-logs verification
Evidence-based verification that goes beyond marketing claims.
- Independent audit review
- No-logs and application-security reports published by PwC, Deloitte, KPMG, Cure53, Securitum and Assured AB are read in their original form. The scope (servers, code or configuration), cadence and limitations of each report feed into the score.
- Jurisdiction analysis
- We review which 5/9/14-Eyes alliance the provider's home office belongs to, data-retention laws and history of legal compulsion. Jurisdictions like Panama, Switzerland and BVI are advantageous; the US and UK are disadvantageous.
- Policy review
- The privacy policy and terms are read end to end. Existence of a transparency report and a warrant canary is checked.
- Infrastructure verification
- Claims of RAM-only servers (no disks, everything wiped on reboot) are validated against provider documentation and independent reports.
e) Usability, support and quality
The details that make daily use pleasant or painful.
- Apps
- Windows, macOS, iOS, Android and Linux apps are installed on real devices; install time, first connect time and UI ergonomics are documented.
- Daily use
- Each VPN is used daily for at least 14 days: browsing, email, video calls, gaming and file transfer. Unstable connections, unexpected drops and battery drain are reported.
- Customer support test
- We contact live chat at 3 different times (morning, afternoon, night). Response time, resolution quality and whether the agent actually has technical knowledge are evaluated.
- Refund test
- Does the money-back guarantee really work? At the end of the test cycle we cancel the subscription and request a refund; we report whether the process is friction-free, how many days it takes and how much is actually refunded.
3. Scoring System
The results of the five test categories are mapped onto six scoring dimensions. Each dimension is rated 1–10 and contributes to the final score with the weights below.
| Dimension | Weight | Description |
|---|---|---|
| Security | 25% | Leak-test results, kill-switch reliability, encryption standard, audit coverage. |
| Privacy | 20% | Jurisdiction, no-logs audits, RAM-only infrastructure, transparency report. |
| Speed | 20% | Percentage drop versus baseline; weighted average across three regions. |
| Streaming | 15% | Weighted average of per-platform success rates. |
| Usability | 10% | App quality, support response time, ease of first-time setup. |
| Pricing | 10% | Renewal-price transparency, true monthly cost, refund policy terms. |
Calculation
Final score = Σ(dimension score × weight). Published as a decimal between 0.0 and 10.0.
4. Freshness Policy
The VPN market changes quickly. An independent audit may be strong evidence today and stale in two years. That is why we refresh our data regularly and display it transparently on every page.
- Every VPN goes through the full test pipeline at least twice per year.
- Each review page shows 'Last tested: DD/MM/YYYY' clearly at the top.
- If a major event occurs (breach, ownership change, new audit, critical feature) we run an emergency re-test.
- Pricing is tracked via a separate 'pricingVerifiedAt' field; we adapt to market price changes within 30 days.
5. Transparency and Limitations
- Hardware: Windows 11 (Intel i7, 32 GB RAM), MacBook Pro M2, Pixel 8 (Android 14), iPhone 15 (iOS 17).
- ISP baseline: Türk Telekom fibre (1 Gbps down / 100 Mbps up).
- Primary test location: Istanbul, Turkey.
- Browsers: latest stable Chrome, Firefox, Edge and Safari.
- Speed tests are specific to one ISP and location; results may differ in your geography.
- Streaming success rates change over time — platforms continuously update their VPN detection.
- Some tests are synthetic (controlled environments); real-world conditions may diverge slightly.
- We state explicitly that no independent certification body audits us; publishing our methodology openly is our strongest quality safeguard.
- Users should make the final call based on their own priorities (privacy vs speed vs streaming).
If you have a question or suggestion about the methodology, reach out via the contact page. If you find a serious error we verify it, update the affected page and publish a change note.
Editorial independence
We disclose our revenue model transparently (see Advertising Disclosure). The site's revenue comes from Google AdSense ads; we earn no commission from any VPN provider, which is the most direct signal of our impartiality.