Proton VPN is easy to describe in a sentence and harder to evaluate in a paragraph.
It ships a genuinely free tier, a materially more capable paid tier, and a security reputation built on a long list of technical claims: no-logs assurance, open-source clients, Secure Core routing, repeated third-party testing. Some of those claims have substantial independent support. Others remain bounded by scope, date, or Proton’s own description.
That gap is the actual subject of this review. Not “is Proton VPN good,” but something more specific: which parts of what Proton says can a reader check for themselves, and which parts are still resting on Proton’s own description. This review works through the product as it exists today (performance, streaming, torrenting, platforms, price) and then works through the assurance record on its own terms, distinguishing what has been independently tested from what hasn’t yet been.
Free and Plus get a dedicated section of their own, because that split determines what capabilities a reader actually gets.
Quick Verdict
Strong: Proton VPN has a standing free tier (not a trial, not a limited preview) and a repeated, multi-year pattern of third-party security and no-logs engagements. Current independent testing shows solid WireGuard performance and support for Netflix, Disney+, Prime Video, Hulu, and Max.
Bounded: Several claims that matter for trust aren’t fully closed out. Secure Core’s physical and administrative infrastructure control remains provider-described, with no independent verification located. Fondation Proton’s exact economic and voting control over Proton AG remains unresolved in the public record. And separately, the May 2026 Securitum no-logs engagement is real and publicly linked: but its complete original artifact wasn’t inspected end-to-end during this research cycle, so its full underlying scope and findings remain incomplete here. None of this means the claims are false. It means specific items haven’t been independently closed out yet, each for its own reason.
Who this fits: a reader whose trust threshold is satisfied by a consistent, repeated pattern of third-party engagement, even where specific individual claims remain open.
Who should check further first: a reader whose use case depends on one of the specific unresolved items (independently verified Secure Core infrastructure control, for example, or a fully resolved Foundation ownership structure) being closed before they’ll rely on Proton VPN for that purpose.
Before choosing between Free and Plus, it helps to know that Free is a real, standing product rather than a stripped preview. What paying adds is mostly control and capability, not a different privacy standard. That distinction is covered in full below.
Proton VPN at a Glance
| Metric | Proton VPN |
|---|---|
| Free plan | $0, standing plan, unlimited data, no ads, 1 connection |
| Paid price (monthly) | $9.99/month, observed on current US/direct routes |
| Paid price (annual, upfront) | $47.88 observed on current annual checkout |
| Introductory pricing | Varies by route: current 24-month offers observed at $71.76 and $83.76 for the first term, with other route-specific totals also recorded |
| Renewal | ~$83.88 every 12 months, common across observed US/USD 24-month routes |
| Refund | 30-day money-back guarantee on eligible direct purchases; app-store routes may follow different rules |
| Connections | 1 (Free) / 10 (paid) |
| Servers / countries / locations | ~20,522 servers / 191 locations / 148 countries, a dated provider snapshot rather than a fixed figure |
| Platforms | Windows, macOS, Linux (native and Snap), Android, iOS/iPadOS, Android TV, Apple TV (paid only), browser extension, router/manual |
| Protocols | WireGuard, OpenVPN (limited/manual on Apple platforms), Stealth, Smart Protocol |
| Independent performance | WireGuard: 1,475 Mbps local / 1,548 Mbps UK–US; OpenVPN: 449 Mbps; Stealth: 403 Mbps (TechRadar, 10 Gbps test environment; the tester flags the UK–US figure as a possible testing irregularity) |
| Streaming | Paid plans: current independent success with Netflix, Disney+, Prime Video, Hulu, and Max; BBC iPlayer operationally variable. Free carries no guaranteed streaming support |
| P2P | Supported on designated paid servers; not supported on Free |
| Port forwarding | Paid, on Windows/macOS/Linux, NAT-PMP based, dynamic rather than fixed |
| Split tunnelling | Paid, and platform-dependent (see Platform Fit) |
| Secure Core | Paid multihop routing; infrastructure ownership is provider-described |
| Stealth | Available on supported platforms; not a plan differentiator |
| Support | Standard positioning on Free vs. priority/live-chat positioning on paid; no independently measured service-quality data exists |
Figures reflect current, route- and date-bound evidence rather than fixed values, particularly for pricing and server counts.
What Proton VPN Actually Is Today
Proton VPN is better understood as three layers than as one product.
Proton Free is a standing, no-cost VPN: unlimited data, no ads, one connection, and a provider-assigned server drawn from a small set of free-tier countries. It isn’t a trial and it doesn’t expire.
VPN Plus is the paid standalone VPN: ten simultaneous connections, full control over which country, city, or server to connect to, and access to a longer list of paid capabilities: Secure Core, NetShield, streaming support, P2P, port forwarding, and split tunnelling where the platform allows it.
The wider Proton ecosystem: Mail, Calendar, Drive, Pass, Wallet, and bundles like Proton Unlimited: shares an account and a bill with VPN Plus. That’s a commercial convenience. It isn’t evidence of a shared technical backend, and this review treats it that way throughout.
Two things worth knowing before the metrics get more specific: platform support varies more than the headline platform list suggests, and the assurance record behind Proton’s privacy claims is made up of several distinct kinds of evidence rather than one blanket audit. Both get their own treatment below.
Independent Performance and Speed
The most recent independent performance data comes from TechRadar, tested in a 10 Gbps environment. On WireGuard, Proton VPN reached 1,475 Mbps on a local connection and 1,548 Mbps on a UK–US route. TechRadar itself flags the long-distance figure as higher than expected and possibly a testing irregularity, worth treating as a flagged data point rather than a stable benchmark. OpenVPN reached 449 Mbps in the same round of testing, and the Stealth protocol reached 403 Mbps.
These numbers describe one tester’s environment on specific protocols. They aren’t a universal speed guarantee, and there’s no independent data isolating Free-tier performance from paid, or measuring the effect of Proton’s VPN Accelerator feature on real-world throughput.
In TechRadar’s test environment, WireGuard produced the highest Proton VPN throughput of the protocols reported. The gap between WireGuard and Stealth’s throughput is real and protocol-specific in that one test, the evidence doesn’t establish a fixed, universal performance cost for using Stealth beyond that single test environment.
Streaming and Torrenting
Streaming. Current independent testing supports Proton VPN working with Netflix across multiple regional libraries, Disney+, Prime Video, Hulu, and Max. BBC iPlayer is less consistent: recent independent tests report both successful and unstable results depending on server and timing, making iPlayer access operationally variable rather than reliable. None of this streaming support is guaranteed on the Free plan. Proton doesn’t say it deliberately blocks streaming on Free, but it also doesn’t promise it works there.
Torrenting and P2P. P2P is supported on designated servers on paid plans. Free carries no supported P2P entitlement, and Proton’s own documentation describes a mechanism that blocks BitTorrent traffic on free servers, that’s a capability restriction, not evidence that Proton logs what free users do.
Port forwarding. Available on paid plans on Windows, macOS, and Linux, using NAT-PMP, and dynamic rather than a fixed static port. It requires a P2P-capable server and doesn’t work on connections behind NAT Type 2 / moderate NAT.
Is Proton VPN Safe? A Repeated Assurance Record
Proton’s privacy claims rest on more than one piece of evidence, and each is worth reading on its own terms rather than folding into a single “audited” label.
- 2019 — SEC Consult reviewed the Windows app’s source code. The engagement found two Medium- and two Low-severity issues; two were fixed and retested, two were accepted. This is historical and version-specific, it speaks to app security posture in 2019, not the current app.
- 2021 — Securitum ran a penetration test across Proton’s Android, iOS, Windows, macOS, and Linux apps, returning one Low-severity finding and nine recommendations. Also historical.
- 2022–2026 — annual no-logs engagements, run by Securitum, now five years running. Each engagement has its own scope and its own conclusion. Five consecutive engagements is a meaningful pattern of ongoing scrutiny; it isn’t the same thing as five separate full security audits.
- September 2025 — an onsite infrastructure and no-logs review, also by Securitum, examined Proton’s production environment directly, including bare-metal server observation and change-control processes. This was scoped to what was reviewed at that time and doesn’t automatically extend to later infrastructure changes.
- May 2026 — the latest Securitum no-logs engagement. Covered in the next section.
- Public source code and a bug bounty program. Proton’s main apps have publicly viewable source repositories, and an active Bugcrowd program handles vulnerability disclosure. Source visibility lets outside researchers inspect the code; it doesn’t by itself prove that the app a person downloads matches that published source exactly. An open bug bounty is a disclosure channel, not proof that no undiscovered issues exist.
Taken together, this is a genuinely repeated pattern of third-party engagement across distinct evidence classes, not a one-time press release, and not nothing. It’s also not a single, closed-out certification, and the distinction between those two readings matters more than a simple count of engagements would suggest.
What the Evidence Doesn’t Yet Close
Here’s where precision matters, because “assured” and “fully verified” are doing different jobs in this review.
The 2026 engagement. Proton has published a conclusion from Securitum’s most recent no-logs review, conducted on-site over three days in May 2026 by two senior consultants, roughly six person-days of work, with a high-level objective of checking Proton’s infrastructure for signs of activity logging. The engagement itself, its dates, and its published conclusion are all established and publicly linked. What isn’t established is the complete underlying detail: the exact servers and data samples examined, the full list of exclusions, and the complete findings behind that conclusion. The original report was publicly linked but could not be inspected end-to-end during this research cycle. That’s a limitation of what could be verified in this review, not a claim that the engagement’s scope was merely asserted by Proton’s marketing.
Secure Core, Proton’s paid multihop feature, is the clearest single illustration of this pattern. Secure Core routes traffic through infrastructure Proton describes as owned and operated by Proton before traffic exits through the selected destination, a coherent design aimed at a defined threat model: a reader worried about a compromised or monitored exit network. But “Proton says it owns and operates these servers” is a company statement. Nothing in the available evidence shows an independent party physically verifying who controls that hardware. That’s a gap in verification, not evidence that Secure Core is unsafe: but it’s a gap worth naming plainly for a reader whose threat model depends on it.
The same shape shows up elsewhere: published source code doesn’t confirm that the binary a person actually installs matches that source line-for-line, and there’s no independent, public assessment of the Stealth or Smart Protocol systems specifically.
None of this is a reason to distrust Proton VPN outright. It’s a reason to be specific about what “checked” actually covers, and to let that specificity guide the rest of this review.
Readers who want the full technical breakdown of the assurance record and the no-logs evidence specifically can find it at Is Proton VPN Safe?.
Who Owns Proton VPN?
Proton VPN is operated by Proton AG, a Swiss company (ProtonVPN AG merged into Proton AG in 2019). Proton describes Fondation Proton, a registered Swiss foundation, as its “primary shareholder”, but that’s Proton’s own description of the relationship, not an independently confirmed statement of exactly how much economic or voting control the Foundation holds.
Public filings show some structure: a Foundation president with individual signing authority, another board member without one. Public records also establish registered shares with privileged voting rights and non-voting participation certificates, while the exact holder identities and voting allocation remain unresolved. The precise ownership and voting split isn’t fully resolved in the public record available for this review.
This matters for the same reason Secure Core does. Proton’s foundation-backed, mission-driven identity is a real and well-documented part of its public story, but it’s a narrative supported by partial evidence rather than a fully verified governance structure. That doesn’t undercut the mission, it means “foundation-owned” shouldn’t be read as a stronger technical or legal guarantee than the current evidence actually supports.
Readers who want the full ownership breakdown can find it at Who Owns Proton?.
Does Proton VPN Fit You? Free vs Plus
This is the most immediately practical decision in the review.
What Free actually gives you: a real, standing VPN and not a trial, not a limited preview. Unlimited data, no ads, one device connection at a time, and a provider-chosen server from a small set of free countries. A requirement of “encrypt my connection on one device, without a data cap, without paying” is genuinely covered by Free.
What paying for Plus adds: mostly control and capacity, not a different privacy standard. The core VPN and the no-logs policy are not different privacy products on Free and Plus; paying primarily expands control, concurrency and access to additional capabilities. What that additional access includes:
- Ten simultaneous connections instead of one
- The ability to choose your own country, city, or server instead of a provider-assigned one
- Supported streaming access
- P2P and torrenting on dedicated servers
- Port forwarding (on supported platforms)
- Secure Core multihop routing
- NetShield ad, malware, and tracker blocking
- Split tunnelling, where the platform supports it
Plus becomes the relevant tier when the reader requires a capability not included on Free. One requirement is enough to make that decision, there’s no need to accumulate several before paying makes sense.
One current wrinkle worth flagging: Proton’s VPN Accelerator, a feature meant to improve long-distance connection speeds, is described in Proton’s own support documentation as available to all users by default, while a separate current Proton-controlled page describes it as a premium feature. That’s a live inconsistency in Proton’s own materials that this review can’t resolve, so it shouldn’t be treated as a clean way to distinguish Free from Plus.
Whether Plus is worth its price for a given reader, beyond capability fit, is a separate question this review doesn’t attempt to settle: see Is Proton VPN Worth It? for that analysis.
Platform Fit
Proton VPN’s feature set is not delivered identically across platforms, and the specific gaps are worth knowing before choosing a device or workflow to rely on it for.
macOS. Split tunnelling exists but remains paid, experimental, and exclusion-only. Meaning apps are excluded from the VPN rather than selectively included. It doesn’t work with WebKit-based apps, and it only works over WireGuard or Stealth.
Linux. The native GUI/CLI package supports include/exclude split tunnelling and the fuller Proton protocol set. The Snap package, by contrast, is missing Proton Protocols, Smart Protocol, Stealth, split tunnelling, and ARM device support. Which package gets installed materially changes what a Linux user gets.
Apple TV. Requires a paid subscription (there’s no free path) and needs tvOS 17 or later.
Other Apple-platform notes. IKEv2 has been removed from iOS and is being phased out on macOS; native OpenVPN has been removed from Apple’s apps, though manual configuration remains possible. Certain Apple-service DNS requests may bypass the VPN tunnel under some conditions.
Port forwarding, as noted earlier, is limited to Windows, macOS, and Linux. It isn’t available on mobile, TV platforms, or the browser extension.
These gaps matter specifically to a reader relying on macOS split tunnelling for a particular workflow, installing via Snap on Linux, or planning to use Proton VPN on an Apple TV. Outside those specific requirements, the platform differences are worth knowing but don’t change the underlying trust or capability picture.
Proton VPN Pricing and Plans
Free is $0, standing, with the entitlements described above.
On current direct-purchase routes, VPN Plus runs $9.99 a month, or $47.88 upfront for an annual plan. Longer 24-month commitments show real variation depending on which route or promotional page a reader lands on, current examples include $71.76 and $83.76 for the first 24 months, with other route-specific totals also observed. There’s no single, fixed long-term price across all of Proton’s current offers, so it’s worth checking the live price on the route actually being used rather than treating any one figure as universal.
After an introductory term, renewal commonly lands around $83.88 every 12 months on the US/USD routes captured for this review, again, something to confirm at checkout rather than assume.
A 30-day money-back guarantee applies to eligible direct purchases; purchases made through Apple’s or Google’s app stores may follow different refund rules set by those platforms.
For a reader considering Proton Unlimited or one of the multi-account bundles instead of VPN Plus on its own, sharing an account and a bill with Proton’s other products (Mail, Drive, Pass, and so on) is a commercial arrangement. It doesn’t indicate that those products share technical infrastructure.
Bundle value depends entirely on whether a reader would actually use the other Proton products. Is Proton Unlimited Worth It? covers that decision on its own terms.
Who Should Use Proton VPN, and Who Shouldn’t
Free is likely to cover the requirement for a reader who wants a straightforward, no-cost way to encrypt their connection on a single device, doesn’t need to pick a server location, and doesn’t need streaming, P2P, or Secure Core.
Plus is the relevant tier for a reader who needs more than one connection, wants control over server location, needs supported streaming or P2P access, or wants Secure Core or split tunnelling for a specific workflow.
A platform limitation may get in the way for a reader who specifically needs macOS split tunnelling, is installing Linux via Snap rather than the native package, or wants Apple TV support without paying.
Further verification is worth seeking out before relying on Proton VPN for a reader whose use case genuinely depends on independently verified Secure Core infrastructure control, confirmed binary-to-source correspondence, or fully resolved Foundation ownership and voting control. Proton’s assurance record is real and repeated, but it doesn’t close those specific items out, and paying for Plus doesn’t change that. Whoever holds that standard of proof, for whatever reason, should treat it seriously rather than assume the assurance pattern alone resolves it.
For a reader whose evidence threshold is satisfied by a credible provider that has repeatedly invited outside scrutiny (even with a few specific claims still open) Proton VPN’s pattern of assurance activity is a reasonable basis for trust.
Conclusion
Proton VPN’s assurance record is genuinely substantial: a historical Windows source/security assessment, a historical multi-platform penetration test, five consecutive annual no-logs engagements, a scoped onsite infrastructure/no-logs review, public source repositories, and an active bug bounty program. Read together, that’s the record of a company that keeps inviting outside scrutiny rather than making a single claim and moving on.
It isn’t the same as a fully closed case. The most recent no-logs engagement’s complete scope wasn’t reviewable in detail here. Secure Core’s physical infrastructure control rests on Proton’s own description. The exact split of ownership and voting control behind Fondation Proton isn’t fully public. None of these gaps are evidence against Proton, they are points the current public evidence record does not independently close.
Where that leaves the decision: a reader whose trust threshold is satisfied by a repeated, multi-year pattern of third-party engagement gets more of that pattern here than a single-audit claim would suggest. A reader whose bar requires the specific remaining claims (Secure Core’s infrastructure control chief among them) to be independently closed before relying on a provider hasn’t had that bar met yet, and a higher-tier plan doesn’t change that.
Once the trust question is settled on its own terms, the rest of the decision is more mechanical: Free can cover a narrow single-device use case; Plus adds real capability once a specific paid feature is needed; and a small number of platform quirks (macOS split tunnelling, Linux Snap, Apple TV) are worth checking against the reader’s own setup before committing.
The STACK View
It’s tempting to treat “has this been audited?” as the question that settles trust in a VPN. Proton VPN’s record shows why that question is the wrong size.
Repeated assurance activity: five consecutive years of no-logs engagements, a historical Windows source/security assessment, a historical multi-platform penetration test, a scoped infrastructure review, public source code, an active bug bounty. This tells you something real about a company’s institutional behavior. It shows a pattern of choosing to invite outside scrutiny on a recurring basis rather than making a claim once and leaving it there. That pattern is evidence, and it’s reasonable to weigh it.
But institutional behavior and scoped verification answer different questions. A five-year pattern of engagement tells you Proton keeps showing up for review. It doesn’t tell you that every claim behind Secure Core, or the full underlying detail of the most recent engagement, or the exact structure of Foundation control, has been independently confirmed. Each of those sits in its own, separately bounded piece of evidence, and the boundary of what was actually tested is where confidence stops traveling, no matter how consistent the pattern around it looks.
The more useful question, then, isn’t “has this been audited.” It’s “what exactly was tested, and does that scope reach the specific thing I’m relying on.” For some important claims (especially the no-logs policy within assessed scope and the historical client-security work) the public evidence provides meaningful independent support. For other claims, such as physical control of Secure Core infrastructure, that support stops earlier. Reading Proton’s record well means holding both of those at once, rather than collapsing a genuinely repeated pattern into a single word like “audited” that promises more than any one engagement actually covers.
FAQs
Is Proton VPN free? Yes. Proton VPN Free is a standing, no-cost plan with unlimited data, no ads, and one device connection, it isn’t a time-limited trial.
Is Proton VPN safe? Proton VPN has a repeated, multi-year record of third-party security and no-logs engagements, along with public source code for its main apps. Some specific claims, including Secure Core’s physical/administrative control, remain provider-described rather than independently verified. Separately, the latest 2026 no-logs engagement is established and publicly linked, but its complete original artifact was not inspected end-to-end during this research cycle.
Has Proton VPN been audited? Proton VPN has undergone several distinct types of independent review: a 2019 historical Windows source/security assessment, a 2021 historical multi-platform penetration test, annual no-logs engagements from 2022–2026, and a scoped onsite infrastructure/no-logs review in 2025. These are separate evidence classes with different scopes rather than one single audit.
Does Proton VPN keep logs? Proton states it doesn’t log traffic content, session data, IP addresses, or connection timestamps, and its annual third-party no-logs engagements have repeatedly supported that claim within their tested scope. The complete underlying detail of the most recent, May 2026 engagement wasn’t fully reviewable for this article.
Is Proton VPN good for Netflix and streaming? On paid plans, yes, current independent testing shows it working with Netflix, Disney+, Prime Video, Hulu, and Max. BBC iPlayer access is operationally variable. Free carries no guaranteed streaming support.
Can I torrent with Proton VPN? Yes, on paid plans, using designated P2P-supported servers. Free doesn’t include P2P support and blocks BitTorrent traffic on its free servers.
What’s the difference between Proton VPN Free and Plus? Free covers one device with unlimited data and a provider-chosen server. Plus adds ten connections, choice of server location, supported streaming, P2P, port forwarding, Secure Core, NetShield, and split tunnelling where the platform supports it.
Is Proton VPN owned by a nonprofit? Proton describes Fondation Proton, a Swiss foundation, as its “primary shareholder,” but the exact economic and voting control the Foundation holds isn’t fully established in public records. It’s more accurate to say Proton has foundation involvement than to describe it as fully nonprofit-owned.
What’s the difference between Proton VPN and Proton Unlimited? VPN Plus is the standalone paid VPN. Proton Unlimited is a broader bundle that adds paid Mail, Calendar, Drive, Pass, and Wallet entitlements under one account and bill. Sharing a bill doesn’t mean the products share technical infrastructure.