How we test VPNs

It's hard to tell exactly how many VPNs there are on the market. At times I've seen listings that exceed 400, but the best estimate is somewhere around 180 , from the best VPNs like Proton VPN and Surfshark to something called "Potato VPN," which I have to assume involves an actual, physical potato.

The problem for the customer is that, at first glance, most of these VPNs look the same. Potato VPN makes bold claims on its website: "Ultra-fast and reliable," "Stay private and protect yourself online," "Enjoy all apps & sites without restriction anywhere." You'll see similar claims on the sites for much better providers like ExpressVPN, NordVPN and Mullvad. There are vast differences between VPNs under the surface, but as they all talk exactly like each other, you may think one is the same as the next.

But VPNs aren't interchangeable. In an age when free VPNs often conceal traps and even many paid VPNs don't live up to the hype, learning how to evaluate a service is a vital skill. The good news is, it's a skill you can learn, even if you don't think you're a technical person. We developed our in-depth 11-point VPN testing process to be both rigorous and straightforward. 

Yahoo Tech's 11-point VPN testing process

1. Install and use the VPN apps

VPNs have universal benefits, so they should be usable by everyone. A good VPN recognizes that it's a tool for a wide range of end users and builds its apps with simple setups and user-friendly interfaces. This is a fairly subjective category, so we take extensive notes in order to help you with a worthwhile opinion.

First, we download and install the VPN on several operating systems, including Windows, macOS, Android and iOS. We also test out browser extensions and any other distinct versions of the app we can reasonably reach. During this step, we think from the perspective of a new user — not just of the VPN we're reviewing, but of all VPNs.

For a VPN to earn our recommendation, it needs to make the most fundamental tasks doable without thinking. Do you have to tinker with your computer's settings to make it usable, or does the installation wizard do that for you? How easy is it to log in? Does the app connect you to your chosen VPN server right away, or does it get hung up? If the VPN stumbles on basic tasks, it's not likely to do much better on advanced features.

2. Test speeds

What we commonly think of as "internet speed" actually consists of three components: latency, download speed and upload speed. Latency measures real-time communication — for example, when you move your avatar in an online game, your latency (also called ping) is the length of time it takes the other players to see you move. Download speed has the most influence on how fast your browser feels, while upload speed is mainly important for posting and torrenting.

A VPN impacts all three metrics, usually making them slower by adding extra steps. How much slowdown you see depends partly on physical distance from the server, but there's a lot the VPN provider can do to grease the wheels.

We use Ookla speedtest to look for the fastest VPNs by checking test server locations several times each. If the VPN includes a "fastest server" option, we start there, then work our way around the world until we've touched six continents. To hedge against random fluctuations, we test speeds several times (including at least once on a different day) and take the average to get our final score.

3. Test security

If you've never heard of an IP address before, think of it as a digital identity that makes you unique online. IP addresses make the internet work, but they can also expose you in a number of ways. VPNs keep you anonymous online by hiding your real IP address behind one used by the VPN. People can tell that someone is taking actions via the VPN, but not that it's you.

To maintain that privacy, a VPN has to be leak-proof. That means no IP leaks from servers falling down on the job, no DNS links from resolving website addresses outside the VPN's protection and no WebRTC leaks from misconfigured live conversation technology. It also means either planning for IPv6, the new internet protocol, or blocking it altogether; IPv6 can cause leaks if a VPN isn't properly built for it.

We test VPN security by running simulations of circumstances that might make our real IP address leak, then checking our address with an IP monitoring tool. For example, we might switch servers without warning, visit websites not secured by HTTPS or intentionally activate IPv6 in our device settings.

4. Inspect pricing

Getting an accurate picture of a VPN's pricing requires looking beyond the front page. Like most other subscription services these days, VPNs highlight their best deals to bring in new users, while far too often burying price hikes at the back of the signup page. Common tricks include adding free months to lower the average per-month price and offering extremely good deals that renew at much higher prices.

Unfortunately, even some very good VPNs use these tricks, since a provider's advertising is too often divorced from its actual product. Part of our job is to determine whether VPNs that use these pricing tricks are worthwhile in spite of how they're sold. In addition, we look at refund guarantees and whether they're likely to be honored, and note unusual payment methods like cash, cryptocurrency or vouchers.

5. Look for deals and bundles

Paying the base price for a subscription usually only gets you the bare minimum — a working VPN and no more. If a VPN has extra features like password managers, antiviruses, identity theft insurance or data leak monitoring tools, they tend to come at an extra price. One very common extra is a dedicated IP address, which makes it easier to get the VPN through firewalls on other restricted networks you might use.

In our reviews, we'll let you know whether any of the higher-level non-VPN extras are worth your money. We'll also list any collaborations between the VPN provider and other services. You'll commonly see bundles including cloud storage, eSim partnerships and occasionally some weirder coupons.

6. Examine the privacy policy

It's a common misconception that VPN privacy policies are all just empty promises, but there's a lot more to them than might appear at first glance. If a VPN makes specific claims in its privacy policy that are blatantly false, it leaves itself open to legal action for false advertising. That means you can learn a lot about a VPN by what its privacy policy leaves just vague enough to not count as a false claim.

For example, almost all VPNs claim to have a "strict zero-logs policy" or something similar. However, a VPN can't operate with absolutely no data on its users — you need to store some information for the length of a session. There's nothing stopping an unscrupulous VPN from changing the definition of "logs" until its no-logging claims are already met, for instance.

Ideally, a VPN provider will include a clear list of what it does save and how it handles that data so it doesn't threaten user privacy. To that end, we close-read each VPN's privacy policy with an eye toward exploitable loopholes. Common examples include policies that don't apply to parent companies or subsidiaries, logging marketing data outside the VPN's own website, and saving data for unclear purposes or excessive lengths of time.

7. See if the VPN can change your location

Given how many people rely on VPNs to extend their streaming capabilities, the " Netflix test" is one of the most important in our arsenal. It's a simple maneuver with big implications. Streaming services like Netflix change their content by country because they only hold copyrights in certain regions. By using a VPN to change your virtual location, you can get around those blocks and see what's streaming in other countries.

The catch is that the streamers all know about VPNs. To avoid copyright violations, they block all traffic from IP addresses they know are part of a VPN's list. Good VPNs configure their servers regularly to stay ahead of those blocks. Testing a VPN's locations on Netflix, therefore, is both important in its own right and a proxy for how well the company pays attention to its infrastructure.

Our location-change test is a lot like our speed test. We pick several test locations and check them repeatedly against Netflix, looking for proxy errors and checking whether the content has actually changed.

8. Check the server list

A VPN gives you a list of locations to choose from when you connect. Each location represents one or more servers with an IP address in the named country. These servers are either physically located in their countries, or are placed somewhere else and set to virtually represent a certain region.

Virtual server locations are particularly important. They have legitimate uses, like offering IP addresses in locations where it wouldn't be practical to put physical servers, but VPNs also use them to inflate their lists for marketing regions. When testing a VPN, we look at how many of its servers are virtual and whether the real locations of those servers closely match their virtual locations.

We also check the absolute numbers of locations and how well distributed they are across the world. VPNs are often reluctant to place real or virtual servers in the southern hemisphere, so one that reaches South America and Africa will always score points with us.

9. Test the extra features

A VPN's extra features run the gamut from basic security touches and quality-of-life measures to unusual innovations that land well outside the bounds of VPN functionality. We use each of these features, testing whether they do their jobs and noting how easy they are to find and operate.

These tests take different shapes depending on the extras in question. A kill switch, for example, is a security feature that shuts off your internet connection if you lose touch with the VPN. We test this by simulating abrupt disconnections through force-quitting the VPN app. For an ad blocker or parental control feature, it's as simple as attempting to access blocked content and seeing what results.

10. Get help from customer service

Everyone needs help sometimes, so we test the customer support options for each VPN we review. We'll start by reviewing the written FAQs to see how easy or hard it is to find a useful article with the answers we need. Whenever we can, we try to come in with a specific question and imagine ourselves as new users who need to solve it.

After looking through the written help, we take our test question to the live chat support and email options. We grade live chat based on how quickly we reach a human expert and whether they're able to help. We likewise test email tickets on accuracy and response time. If there's an active user community, we'll dive into that too.

11. Research the VPN's background

The most important information about a VPN's background and history is usually public knowledge. You can see how a provider has dealt with security incidents in the past, whether it's ever gone against its own privacy policy and any mistakes it tried to hide from its customers. Reporters and security analysts are constantly holding VPNs accountable, often noticing weaknesses before the VPNs themselves catch on.

The VPN's response is the key element here. If it acknowledges its mistake and makes clear changes to prevent it from reoccurring — and it actually doesn't reoccur — we'll boost its score. On the other hand, if it proposes misleading bandaids or claims the mistake wasn't its fault, its score goes down.

We also check for basic information like when the VPN was founded, where it's based and who owns it. If the company isn't clear about any of these, it suggests they've got something to hide.

How to run your own VPN tests

If you want to learn about a VPN that Yahoo Tech hasn't yet reviewed, you can use the steps below to check it out for yourself.

1. Download, install and use the VPN on the big four platforms (Windows, Android, macOS and iOS) and any other versions we can get our hands on.

2. Test speeds in multiple server locations (at least one on each continent) several times each across multiple days.

3. Check for all the common types of IP address leaks.

4. See if the VPN's pricing is fair, competitive and free from hidden fees.

5. Look at which extra features of the VPN you can have for an additional cost.

6. Make sure there are no loopholes in the privacy policy.

7. Test whether the VPN can unblock Netflix and other websites that check virtual location.

8. See if the VPN has accessible servers with good speeds around the world.

9. Use all the features outside core VPN functionality.

10. Approach the VPN's customer service options with a problem and see how easy it is to get help.

11. Read up on the VPN's background, including its location, parent company and how it's dealt with security incidents in the past.

Explore our VPN coverage

Properly reviewing a VPN is a lot of work, but it's something you can learn to do, at least in part, yourself. All it takes is the right tools, some dedication and a healthy amount of suspicion. To see the practical results of the process above, start with our article on the best VPNs .

Best VPNs in 2026 | The best VPNs for streaming in 2026 | The fastest VPNs in 2026 | Best VPN for Mac in 2026 | Most secure VPN in 2026 | 8 ways to make your VPN run faster | Does using a VPN impact internet speeds? | Are VPNs really safe? | See Yahoo Tech’s full VPN coverage