A VPN advert makes two kinds of claim, and they don’t weigh the same. One kind can be checked by someone outside the company, and the other can only be believed. How to judge a VPN comes down to that split: give weight to the claims an outsider could prove wrong, and set the rest aside. That alone removes the providers whose pages hold nothing but promises.
This guide assumes one reader in the United Kingdom choosing a service for a phone and a laptop, for ordinary browsing. It names no providers and quotes no prices, because both date within a season.
The question that decides how to judge a VPN
A VPN relocates your trust instead of removing it. Your traffic leaves your device and passes through a machine you can’t see, run by people you’ve never met. Every promise on the page describes that hidden host, so the useful question is who could catch the promise being false.
Sort any claim into one of three classes. Some you can test from your own devices in minutes, such as whether pages still load when the tunnel drops. Others an outside reviewer can test, such as a published design or an independent audit. The rest only the provider can know, such as what sits on its disks.
Say a homepage makes ten claims and you sort them. You might find one you can test, two an outside reviewer can test and seven that only the provider can know. A claim earns credit in proportion to how far an outsider could prove it wrong.
When the unchecked class carries most of the page, a false claim costs the provider nothing, and that lopsidedness is the reason to weigh claims by how checkable they are.
A claim nobody can test is an advert.
How you judge a VPN, in order of weight
1. A no-logs claim that names what it keeps. “No logs” isn’t one thing. It can mean nothing kept about the sites you visit, or nothing kept about when you connected and from where. In daily use you’ll see nothing, because the difference only shows on the day someone asks the provider for records or the provider leaks them. Read the policy for two lists: the data it keeps, then the data it doesn’t. Good ones use plain nouns such as connection times and payment details. A good answer fills both lists. With a bare slogan, connection times plus your home address could still link you to a session.
2. A dated, scoped outside check of that claim. An audit is a review by an independent firm that examines the setup and writes up what it found. Day to day it changes nothing you can see. It decides whether the list in the first criterion was ever tested. Look for the reviewer’s name and the dates examined. Check whether it reached the servers or stopped at paperwork. Then see whether the full report is public. A summary written by the provider doesn’t count. Without it, the claim has only the provider’s word behind it.
3. A tunnel design published for anyone to read. Few buyers look at this. The tunnel is the method that wraps and protects your traffic, and a published design lets many independent engineers hunt for flaws. You’ll notice nothing daily, but a flaw in a private design can stay hidden far longer. The page should name the method and state that its specification is open. A phrase such as “our own secure technology” with no description means nobody outside has examined it.
4. A dated history for the policy and the operator. Policies get rewritten when ownership or business plans change. A dated version trail shows you what the promise said last year. Look for a “last updated” date and earlier versions kept visible. A policy with no dates can change overnight and leave nothing to compare against.
What counts for less than the box claims
Three headline items dominate VPN adverts, and each changes little for this reader. The key length printed on the box comes first. A 256-bit key sounds strong, and it is, yet modern tunnels use keys far beyond any attempt to guess them. Vendors print it because one number is cheap to show and easy to compare. In earlier generations it could separate strong services from weak ones, and now it separates almost nobody.
The count of servers and countries comes second. More locations cost the provider rent and little else. A longer list says nothing about who operates the hardware or what it keeps. Ten thousand rented machines run by an unknown party are ten thousand things to trust.
Bundled extras come third. An ad blocker or a malware scanner pads out the feature list, and each is cheap to add. None of them answers any of the four criteria. I’d ignore every one of them.
Matching the order to the reader
Different readers push criteria up or down, and knowing how to judge a VPN means knowing which way. A person who connects a few times a year can let the third criterion drop, since each session is short and little is exposed, while the first still decides. An everyday user who signs in to accounts through it should put the audit second without discount, because more traffic means more to lose if the claim is false. A household with several devices should lift the dated history, since one policy change then reaches every phone and laptop at once. Whoever moves work files through it should treat the first criterion as a hard line, since a missing list outweighs every other strength. In every case the logs list keeps its first place.
What to walk away from
How to judge a VPN also includes knowing when to stop looking. Walk away from a no-logs claim with no list of what is kept. Without the list you can’t tell what the claim covers, and a provider that won’t write it down has chosen the vaguest answer. Nothing you do later can add the list back, because only the provider can write it. Walk away from a tunnel that only runs inside the provider’s own app, with no published design. If it fails or the provider changes terms, you can’t move to another client. A design nobody can read also stays closed to the outside review that the third criterion exists to invite.
An audit that examined only the policy text also counts here, since it tested the words and left the machines alone. So does a provider with no named operator or address of record. Nobody is then answerable for the claims, and you’d have nowhere to write when one proves false.
The two-minute check before you commit
Here is how to judge a VPN in two minutes. Start with the policy page ahead of the pricing page. Find the list of data kept and the list of data not kept. If either is missing, stop. Search next for an audit. Read its date, then who wrote it and what it covered. Then find a clear account of the tunnel design and an open specification. Last, check the policy’s “last updated” date and whether earlier versions are kept. A provider that fails the first step can’t be rescued by anything after it. One that fails only the last can still be worth a short trial.
To judge a VPN beyond its marketing claims, begin with what the provider says it keeps and whether anyone outside has checked. A missing list of kept data ends the search. Everything else on the page, from key lengths to server counts, can be added to any product for little cost. A check by an outsider can’t.
Questions readers keep asking
Is a longer encryption key a sign of a safer VPN?
Not in any way you’d notice. Modern services use keys long enough that guessing them is out of reach, so the number on the box separates no one. What decides safety is what the provider keeps and whether an outsider has checked it. A longer key answers a risk that rarely occurs.
Is a pricier VPN more trustworthy?
Judge by evidence and not by tier. A higher price buys bundled extras as often as it buys an audit. Compare what two providers show on the four criteria first, then pay for the one that shows more. If both show the same, take the cheaper, since nothing on the dearer page adds proof.
How long will my choice stay right?
The criteria last for years, while the audit date ages. A review describes the service on the days it examined, so a report from long ago says little about today. Recheck the policy’s dated history once a year. If it has changed since you signed up, treat the choice as open again.
