Virtual private networks (VPNs) have long been a household technology, but there are many uncertainties surrounding them. This is partly due to the fact that they can hide online activity that local or national governments consider illegal – up to and including, say, abstinence ID check for age verification. Consumers are not helped by the plethora of duds being sold in app stores right next to best VPNsespecially if they deliberately taking advantage of opportunities with people rushing to raise their online anonymity. If you’re about to decide to start using a VPN, you might be wondering if the services you’re looking at are safe.

Unfortunately, the hard answer is “it depends.” VPNs are technology that can be good or bad, just as they can be used for good or bad. There is nothing very dangerous about using a VPN – whether or not one is secure comes down to who built it and how they run it. The good news is that there are easy ways to tell if you’re using one of the good ones.

The question “Are VPNs really safe?” can also mean something else — “Is using a VPN enough to keep me safe online?” I will also check that, but to spoil the end: VPNs are important security tools, but they are not enough to protect against all digital threats by themselves. Also, to be clear, I’m talking here about commercial VPNs like Proton VPN and ExpressVPN, not commercial VPNs like NordLayer or Cisco AnyConnect.

What makes a VPN insecure?

There are two main things that make me call a VPN unsafe: negligence and malice. A careless VPN won’t protect against the dangers it’s supposed to avoid, leaving you more exposed than if you didn’t use a VPN at all. A malicious VPN is designed to make you unsafe so that the people behind it can make money.

A few ways that a negligent VPN can harm its users:

• Using outdated protocols with cracked encryption, such as PPTP, or homebrewed protocols with insufficient security. A weakly secured protocol can reveal your search activity.

• Leaks are allowed by using public DNS servers instead of setting up their own system to resolve requests. It risks revealing which websites VPN users have visited.

• Leaking the user’s real location by failing to block or manage IPv6.

• It leaves its servers in the hands of unvetted third parties, which may allow them to be hacked.

• Failure to include a kill switch, which puts users at risk of connecting to the wrong servers.

Some ways a VPN can be harmful:

• Making this money comes from in-app ads, especially if the ads have trackers.

• Harvest the user’s residential IP address and sell it as a proxy.

• Track user activity and sell it to advertisers.

• Planting malware on the user’s device.

I want to emphasize again that none of these risks are inherent in how a VPN works. VPNs don’t have to be dangerous in any way. There are a lot of good ones, which makes it even more important to pick the bad ones out of the lineup. In the next section, I will discuss how to do this.

How to tell if a VPN is secure

The process of checking a VPN starts before you buy it. Before you even consider downloading any VPN app, do your research and learn as much as you can. Read review sites like Engadget, but also try to get reports from regular users of social media and app stores. Be suspicious of five-star reviews that are light on details — the more positive reviews from actual users, the better.

While researching, look for any cases where the VPN has failed in its mission to protect customers. Does it hand over information to the police, despite having a no logs policy? Have any of its servers been breached by hackers in ways that put other users at risk? Is it useful in terms of important information, such as where it is based or who its parent company is?

You can also read the VPN’s privacy policy, as I do in my VPN reviews. A privacy policy is a legal document that can invite lawsuits if the provider does not care about it, so most companies prefer to plant vague holes. Read the policy and decide for yourself if it makes any unacceptable exceptions to “no logs ever.”

If the answer to all these questions is no, your next step is to download the VPN and give it a try. Every useful VPN has a refund guarantee within a certain period, so you can use that time to test the reasons below. If you want results, you can subscribe for a longer period; otherwise, you can cancel and get your money back. Here’s what to look for during a refund:

• Check which VPN protocols are available. The best protocols verified by experts are OpenVPN, IKEv2 and WireGuard. If the VPN uses a protocol other than these three, make sure it uses an unbreakable encryption cipher such as AES-256 or ChaCha20.

• Leak test. You can run a simple leak test using a website like ipleak.net or whatismyipaddress.com. Just check your normal IP address, connect to a VPN server, then check again. If the IP address you see is the same as before, the VPN is leaking.

• Look for the kill switch. A kill switch prevents you from accessing the internet while you are not connected to the associated VPN. This is critical to prevent some types of hacks that rely on fake servers to work. Most of the top VPNs have a kill switch or similar feature with a different name (such as Windscribe’s Firewall).

• See if the apps are open-source. A VPN that makes its services available for viewing on Github strongly declares that it is not hidden. Anonymity is an inalienable right for individuals, but VPN apps are not people – the more transparent the code, the better.

• Test its other security features. If the VPN has a blocker for ads, malware or trackers, see if it prevents banner ads from loading. Try connecting to a malware test site like www.ianfette.org or httpforever.com and check if the VPN is blocking it.

There is one more factor that usually means a secure VPN: paid subscriptions. I won’t say that all free VPNs are dangerous, but if a service claims to be always free without having to pay, you have to ask how it earns. VPNs that do not charge for subscriptions generally make their users a product, sell their data to advertisers or to be used as residential proxies.

Is a VPN enough to keep you safe online?

Another way in which VPNs are not completely secure is that they are not, by themselves, a total solution for cybersecurity. A VPN performs a specific task: it replaces your IP address with an unknown server and encrypts the communication with that server so that your real device cannot be seen. This means that you will not reveal your identity or location in the normal course of using the internet.

However, if you reveal the information otherwise, all bets are off. When you click on a sketchy link that downloads malware to your computer, that malware doesn’t care that your IP address is hidden – it’s already where it needs to be. Likewise, if you leak critical information in a social post, or privately give it to a phishing scammer, a VPN won’t help.

I put together a list of 12 cybersecurity habits that will keep you safe from almost all threats online. Getting a VPN is one of them, but there are 11 more, including strengthening your passwords, installing updates quickly and conditioning yourself to see social engineering hacks. Don’t fall into the trap of thinking you’re immune just because you’re using a VPN.

The most secure VPNs

It can be a lot of work to determine if a VPN is safe and reliable. If you want to pick one that you can use without having to open a federal lawsuit, check out my best VPN roundup or best free VPN list — or just use one of the suggestions in this section.

Proton VPNmy favorite VPN, mostly owned by the nonprofit Proton foundation, has open-sourced the entire product family and has never experienced a serious hack or breach. Despite some controversies surrounding its parent company, ExpressVPN remains safe; its servers were confiscated at least once and found to be uninformative.

NordVPN suffered a hack in 2018 and learned the right lessons from it, doubling the security of its server locations. Similarly, Surfshark was criticized for using a weak authentication method and eliminated it completely in 2022. Generally, a VPN that responds correctly to a security breach looks better than one that has never been attacked – sometimes strength is only known through difficulty.