Choosing a VPN is genuinely confusing. Every provider claims to be the fastest, most private, and most secure. Review sites publish 30-point feature comparisons. Marketing copy talks about military-grade encryption and advanced protocols without explaining what any of it means.
Here are the 7 criteria that actually matter, in order of importance, and how to evaluate each one.
1. No-logs policy with independent verification
This is the most important criterion. A VPN that logs your traffic defeats the entire purpose.
Every VPN claims a no-logs policy. What separates credible claims from marketing is independent verification.
What to look for: An audit conducted by a recognized third-party firm (Deloitte, PwC, KPMG, Cure53) that specifically examined the server infrastructure, not just the privacy policy text. Multiple audits over time are more convincing than one. Court-tested track records are more convincing than audits.
Current audit leaders: NordVPN (6 audits, Deloitte), ProtonVPN (KPMG), Surfshark (Cure53), Mullvad (Cure53 + police raid).
2. Jurisdiction
Where the VPN company is incorporated determines what laws apply and what data can be legally compelled.
Strong jurisdictions: Panama, Switzerland, Iceland. No mandatory data retention, outside major intelligence alliances.
Acceptable jurisdictions: British Virgin Islands, Romania, Gibraltar. Favorable laws, limited alliance obligations.
Weaker jurisdictions: US, UK, Australia. Mandatory retention requirements, broad surveillance authority, intelligence-sharing agreements.
Jurisdiction matters most as a long-term protection. A US VPN with a current no-logs policy could be served with a National Security Letter requiring them to start logging, without being allowed to disclose it. Panama and Switzerland don’t face this.
3. Technical infrastructure: RAM-only servers
A RAM-only (diskless) server wipes all data on reboot. Even if a server is physically seized, there’s nothing to recover. This is the technical implementation of a no-logs policy.
Who has it: NordVPN (full network), ExpressVPN (TrustedServer), Surfshark, ProtonVPN (Secure Core).
This criterion is less important than audit and jurisdiction for most users, but it’s a meaningful signal of investment in privacy infrastructure.
4. Speed and protocols
All major VPNs are fast enough for streaming and general use. The difference matters at the margins.
Use WireGuard or its implementation (NordLynx, Lightway) for best speed. These protocols deliver 30-50% more throughput than OpenVPN with significantly less battery impact on mobile.
Red flags: providers that don’t offer WireGuard or a WireGuard equivalent in 2026 are behind the curve.
5. Streaming reliability
If streaming geo-restriction is your use case, test whether the VPN actually works with your target platforms. Netflix, BBC iPlayer, Disney+, and Hulu all use different detection methods, and providers vary in how actively they maintain compatibility.
Our database scores streaming on: Netflix (by region), Disney+, BBC iPlayer, Amazon Prime, Hulu, HBO Max, Peacock. NordVPN and ExpressVPN score 5/5 (Excellent). Surfshark scores 4.5/5. CyberGhost 4/5.
6. Price and value
Price matters, but it’s not a primary privacy signal. Some cheap VPNs are trustworthy (Mullvad, Surfshark). Some expensive ones are not the best value (ExpressVPN).
The relevant price points:
- Free: ProtonVPN Free (no cap, limited servers), Windscribe (10GB/month)
- Budget ($2-4/month on annual plans): Surfshark, PIA, CyberGhost
- Mid-range ($4-5/month): NordVPN, ProtonVPN
- Premium ($7-9/month): ExpressVPN (hard to justify vs NordVPN)
A 60-day money-back guarantee (NordVPN, CyberGhost) gives you real time to test before committing.
7. Ownership and transparency
Who owns the VPN company matters for long-term trust.
Independent providers: Mullvad, ProtonVPN (Proton AG), IVPN, Windscribe. No corporate parent with conflicting interests.
Kape Technologies portfolio: ExpressVPN, CyberGhost, Private Internet Access, ZenMate. One company, formerly in adware. Products are solid but the ownership structure adds opacity.
Nord Security: NordVPN, Surfshark, Atlas VPN. Lithuanian parent company, EU jurisdiction at the corporate level even though NordVPN is Panamanian.
Ziff Davis: IPVanish, StrongVPN. Also owns PCMag and Mashable. Conflict of interest in reviews.
What doesn’t matter as much as the marketing suggests
Number of servers: 1,000 servers and 10,000 servers both provide effective VPN service. Marginal relevance beyond a certain point.
Number of countries: You realistically use servers in 3-5 countries. Coverage of 100 countries versus 50 makes almost no practical difference for most users.
“Military-grade encryption”: AES-256 is used by every reputable VPN. This phrase is marketing, not differentiation.
Speed claims: “10Gbps servers” means the servers have 10Gbps uplinks, not that you’ll get that speed on your connection. Irrelevant for individual users.
The quick decision framework
Privacy-first user: Mullvad or ProtonVPN. Trade streaming capability for maximum anonymity.
Best all-round: NordVPN. Leads on audits, jurisdiction, streaming, features. Reasonable price.
Budget: Surfshark (unlimited devices, good streaming). Or ProtonVPN Free (no cost, no cap).
Streaming focus: NordVPN for best platform coverage. CyberGhost for simplest streaming interface.
Get NordVPN | Try ProtonVPN Free
Use our quiz to get a personalized recommendation based on your specific needs, or see the full comparison table to filter by the criteria that matter to you.
The only criteria that truly matter are: verified no-logs policy, jurisdiction, and technical infrastructure. Speed, streaming, and price matter secondarily. Server counts and "military-grade" claims don't matter at all. NordVPN leads on the criteria that count. ProtonVPN is the right choice if privacy is the only priority.
The five-minute decision tree
All the criteria above compress into a sequence most readers can walk in five minutes. First fork: what’s the primary job? Privacy-first leads to jurisdiction and audits (Proton, Mullvad, NordVPN); streaming-first leads to the streaming column (NordVPN, Surfshark); budget-first leads to value-per-device (Surfshark, PIA); a specific country or platform leads to the dedicated guide for it. Second fork: how many devices? Above ten, the unlimited-device providers take the shortlist. Third fork: any hard requirement (port forwarding, obfuscation for a strict country, a free tier to start on)? Each eliminates cleanly.
What remains after three forks is usually two names, and the tiebreaker is never another spec: it’s the trial. Both 30-day windows, your devices, your evening hours, your platforms. The table predicts; the week decides.
The mistakes this guide exists to prevent
Four patterns account for most VPN buyer’s remorse. Buying from an ad rather than a comparison (the loudest marketing budgets belong to the middling products). Buying a five-year deal from an unknown brand (the lifetime-deal economics our budget guide dismantles). Choosing on raw server count (a vanity metric; placement and capacity beat totals). And skipping the week-one test, then discovering at month eleven that the kill switch never worked on the laptop that mattered. Each mistake has the same antidote: the criteria above, applied in order, with the refund window treated as part of the purchase rather than an afterthought.
(This guide pairs with the methodology page: the criteria here are the same ones our comparison table scores, so the decision tree above can be walked directly down the table’s columns whenever the shortlist needs numbers.)
One reassurance to close the anxiety this genre creates: among the providers this site actually recommends, there is no catastrophic wrong answer, only mismatches of emphasis. The difference between a good choice and the perfect one is a few percent of speed or a dollar a month; the difference between either and an ad-driven impulse buy is the entire article you just read.
Keep reading: Best VPN in 2026: Our Full Ranking After Testing 48 Providers and How We Test and Score VPNs at VPN Picker.