How to choose a VPN in 2026: an engineer's checklist

VPN marketing is some of the most fear-driven on the internet. This guide is the opposite: what a VPN (a service that routes your internet traffic through an encrypted tunnel so your network or internet provider can't inspect it) actually does, what to check before paying, and a short shortlist. Last checked: July 2026.

First, the honest part: do you even need one?

A VPN genuinely helps when you: use public wifi a lot (cafés, airports, hotels); want your browsing hidden from your internet provider; need to appear in another country (for work testing, travel, or streaming); or live somewhere with restricted internet.

A VPN does not make you anonymous, does not stop websites tracking you with cookies, and does not "secure your bank account" — your bank already encrypts its connection. Anyone who claims otherwise is selling fear.

The checklist that actually matters

1. Independently audited no-logs policy. "We keep no logs" is marketing until an outside auditor has verified it. Look for a named audit firm and a recent date.
2. Modern protocol (WireGuard or equivalent). WireGuard is the current-generation tunnel technology — noticeably faster than the older OpenVPN. All serious providers offer it, sometimes under a brand name.
3. A kill switch. If the VPN connection drops, this blocks all traffic instead of silently exposing you. Non-negotiable for public-wifi use.
4. Device limit that fits your household, and apps for every platform you use.
5. Jurisdiction, if privacy is your main motive: where the company is legally based determines which governments can compel it.
6. A real refund window (30 days is standard) so you can test speeds on your connection — speed depends on your location more than any review can predict.

Ignore: "military-grade encryption" (everyone uses the same standard), server-count bragging, and lifetime deals (a subscription business selling lifetime access is a red flag, not a bargain).

Our shortlist for US / Canada / EU users

NordVPN — the mainstream default: audited no-logs, WireGuard-based protocol, kill switch, large network. Usually mid-priced; watch the renewal price, which is higher than the intro offer.

Surfshark — the value pick: similar checklist coverage with unlimited devices per account, which quietly makes it the family option. Younger company than the other two.

Proton VPN — the privacy-first pick: from the Swiss team behind Proton Mail (an encrypted email service), with a rare genuinely useful free tier, open-source apps and regular audits. Smaller network; you pay a little more for the trust.

All three run 30-day refund windows — test on your own connection during that window and keep whichever is fastest for you. That test beats every review, including this one.

Links on this page are plain links today. If some become affiliate links later, the note at the top of the page and our disclosure will say so.