How We Test and Evaluate VPNs

This page is the single reference for how every VPN recommendation on WhatsMyIP.now is produced. Each provider is scored against the same five criteria, in the same order, and we publish the limits of what we can and cannot verify. Every guide on this site links back here rather than restating the methodology.

The Five Criteria

Criterion	Weight	What we look at	How it is verified
Audited no-logs policy	Highest	Whether the no-logs claim has been checked by an outside firm, and whether it survived a real legal test	Published audit reports; court filings and seizure reports
Leak behaviour	High	Whether the tunnel exposes the real IP, DNS resolver, or WebRTC candidates	Our own VPN Leak Test, run on each provider's default settings
Protocol support	Medium	WireGuard or an equivalent modern protocol; obfuscation where censorship matters	Vendor documentation and client inspection
Jurisdiction	Medium	Which governments can compel disclosure, and the provider's record of responding	Corporate registration; transparency reports
Price transparency	Lower	Renewal pricing, refund terms, whether the advertised price is the real one	Checkout flow and published terms

Why Audits Outrank Everything Else

A no-logs policy is a promise until somebody checks it. We weight independent audits highest because they are the only mechanism that converts a marketing claim into a verifiable one — and we weight tested claims higher still. When Swedish police raided Mullvad's offices in April 2023 and left without user data, that was worth more than any audit report, because it proved the architecture rather than the paperwork.

Audits also age. A 2021 audit tells you little about a client rewritten in 2025, and ownership changes can reset the picture entirely. We record the auditor, the year, and the scope — apps, infrastructure, or the no-logs claim specifically — because "audited" alone is close to meaningless.

How We Run Leak Tests

1. Record the baseline: real IP, ISP-assigned DNS resolvers, and WebRTC candidates with the VPN off.
2. Connect using the provider's default settings — not a hardened configuration, because defaults are what most people actually run.
3. Re-run the same checks and compare. Any appearance of the baseline IP, the ISP's resolvers, or a local WebRTC candidate is a failure.
4. Force-kill the VPN client process and immediately retry, to see whether the kill switch actually holds.
5. Repeat on IPv4 and IPv6 separately — IPv6 leaks are the most commonly missed failure mode.

You can run exactly the same checks yourself: our VPN Leak Test performs steps 1–3 in the browser, and how to test if your VPN is working walks through the rest.

What We Deliberately Do Not Do

• We do not publish specific prices in guides. VPN promotions change monthly; a price quoted here would be wrong within weeks. We describe pricing structure instead and link to the provider for the current figure.
• We do not rank by commission. Several providers we rate highly — Mullvad in particular — pay nothing at all.
• We do not publish head-to-head speed benchmarks as absolute numbers. Throughput depends on your ISP, your distance to the server, and time of day. A number measured on our connection tells you almost nothing about yours, which is why we recommend testing during a refund window instead.
• We do not claim insider knowledge. We have no access to any provider's infrastructure. Everything here comes from published audits, vendor documentation, court records, and our own client-side testing.

Conflicts of Interest

Some provider links on this site are affiliate links, and we may earn a commission if you subscribe through one. That relationship is disclosed on every page that carries such a link. It does not influence ordering, scoring, or which providers appear — the criteria table above is applied before any commercial consideration, and providers with no affiliate programme are included on the same terms as those with one.

When Pages Are Updated

VPN guides are reviewed when any of the following changes: a new independent audit is published, ownership or jurisdiction changes, a provider's client software has a major release, or a leak test that previously passed begins to fail. The "Last updated" date on each guide reflects the most recent such review.

Frequently Asked Questions

Do affiliate commissions influence your rankings?

No. The five criteria are applied before any commercial consideration, and providers with no affiliate programme at all — Mullvad among them — are included and rated on identical terms.

Why don't you publish speed benchmark numbers?

Because they would mislead. Throughput depends on your ISP, your distance from the server, and the time of day, so a figure measured on our connection predicts very little about yours. We recommend testing during a refund window instead.

How do you decide when a page needs updating?

A guide is reviewed whenever a new independent audit appears, ownership or jurisdiction changes, a client has a major release, or a leak test that previously passed starts failing.

Can I reproduce your leak tests myself?

Yes — that is the point. The browser-based portion is exactly what our free VPN Leak Test runs, and the kill-switch and IPv6 steps are described here in full so you can repeat them on any provider.

How we evaluate VPNs: every provider on this site is judged on audited no-logs claims, leak-test results, protocol support, jurisdiction, and price transparency — never on commission. How we score every provider →

ⓘ Affiliate disclosure: Some links to VPN providers in these guides are affiliate links - We may earn a commission at no extra cost to you. This never affects rankings or evaluations.

Last updated: 2026-08-02