How to Evaluate a Free VPN Without Trusting the Advert

Nothing on a pricing page tells you who can watch your traffic. That answer lives in ownership records, retention tables and the settings of the client you actually install, and reading them properly takes an afternoon. A badge that says anonymous names no observer, so there is nothing to check. The five passes below turn the advert into claims you can test one at a time.

Who actually runs the exit

Begin with the legal entity and the country whose courts can compel it. A contact page that offers only a web form is not a contact route; you want a postal address or a registration number you can look up. Named volunteers and a reseller behind a mailbox are both plausible arrangements, but they fail differently when a payment dispute or a takedown arrives. Write down which one you are dealing with before anything gets installed.

Then classify the deployment you are joining. A commercial promotional exit, a volunteer node from a public directory and an employer gateway that costs you nothing are three different bargains, and the party deciding who may connect is not the same in each.

Classification predicts the failure you will meet: an ad-funded service can throttle or inject, a volunteer node can vanish overnight, and a work gateway may log everything by policy. None of those outcomes appears in a server count. Deciding which risk you can live with is the actual selection step.

Four data categories worth demanding

Ask for the policy to be split four ways: browsing activity, connection metadata, account records and diagnostics. A page that promises no logs without those divisions has not told you what it keeps. Connection metadata is the part most operators retain, because an abuse complaint arrives with an address and a timestamp attached. An operator that admits keeping it for a stated period is easier to assess than one that denies everything. Read the retention window for each category and the process that follows a legal request.

Audit claims need the same treatment. Read the scope, the auditor and the date, then ask what the report covers: a review of a client application says little about how a server is configured, and a report from several years ago describes a service that has changed since. If those details are missing, treat the badge as marketing.

Maintenance you can see from outside

Software that stopped receiving updates is a security problem whatever protocol is printed on it. Look for a release channel with dated entries and a documented way to report a vulnerability, because both are cheap to publish and awkward to fake for years.

A protocol label describes one component of the path, not the party at the other end. WireGuard can be current and still terminate at an operator who keeps a detailed connection log, and the same is true of OpenVPN or anything else. Judge the client build you are told to install and the update path behind it, then judge the operator as a separate question. The label tells you how bytes are wrapped, not who unwraps them.

Prove the route and the kill switch

Install the profile in the client you will really use, connect it, and look at what the machine believes about its own traffic. On Linux, three commands answer most of the question:

curl -s https://ifconfig.me
ip route get 1.1.1.1
wg show

The first prints the address a remote site sees, which should be the exit you picked; the second shows dev wg0 when the default route is captured; the third reports a handshake measured in seconds. A route still pointing at eth0, or a handshake hours old, means the tunnel is not carrying what you assume.

Repeat the address lookup after bringing the interface down with sudo wg-quick down wg0. If the request times out, traffic was blocked while the tunnel was absent, which is what a kill switch should do; if it returns your home ISP address, nothing was protected. Check the client route coverage as well, because a split tunnel that excludes the destinations you care about is a different product from the one advertised. Both answers belong in your notes, next to the output that produced them.

Secrets, gaps and a one-sentence decision

A profile file or an account credential is a key to a network position, so handle it like any other secret. Do not paste it into a support forum, do not reuse the password elsewhere, and revoke it when you stop using the service. If the documentation never explains who funds the service or how long records are kept, write that down as an open question. An unexplained gap is a fact about the operator, not a reason to invent a generous explanation.

The EFF's guide to choosing a VPN asks the same questions from the user's side and is a better starting point than a comparison table. When the passes are done, try to state your choice in one sentence: who runs it, what they retain, and what you tested. If that sentence needs a claim you could not verify, the decision is not finished. A free tool does not delete a privacy problem; at best it hands the problem to an operator you picked with your eyes open. Keep the notes, because a policy can change long before you notice.