Every VPN advertises "no logs". Four have survived court cases, police raids and server seizures without producing anything. Another twelve pass independent no-logs audits. Everything else is a promise.
Proven in court or by raids: Private Internet Access, OVPN, Mullvad, Windscribe. Independently audited no-log policies: Proton VPN, IVPN, Obscura, NordVPN, Surfshark, ExpressVPN, hide.me, Mozilla VPN, TunnelBear, CyberGhost, VyprVPN, Norton VPN. For real anonymity, no VPN works - use Tor. For cheap self-control, run WireGuard on your own server.
"Best VPN" is not a thing. What is best depends on what you are protecting yourself from - tap a situation and the page highlights what fits:
Pick a situation to highlight what fits - nothing is hidden, only highlighted.
Hide my IP
Any audited provider works. For occasional use, a free tier of an audited provider (Proton, Windscribe) beats every "free VPN" app.
Privacy from the VPN provider too
Only the court-proven ones (PIA, OVPN, Mullvad, Windscribe), Obscura's can't-log design, or self-hosted setups - where you are the only one who could log.
Anonymity - nobody should learn who you are
No VPN does this. A VPN shifts trust from your ISP to the provider. Use Tor.
Circumvent state censorship
Purpose-built tools (Psiphon, Snowflake bridges), self-hosted obfuscation (Amnezia: AmneziaWG / XRay REALITY), or Proton's Stealth. Plain WireGuard and most commercial VPNs get blocked.
Four evidence levels - everything else is marketing
A no-logs policy is a paragraph on a marketing page. It becomes fact only when it is tested. Four levels exist, in descending strength:
Court-tested
A court or law enforcement demanded user data and the provider had nothing to hand over. Documented in rulings or court filings. The strongest proof that exists.
Raid-tested
Police or authorities physically seized servers - and found no user logs. Same strength, dramatic delivery.
Independently audited
A security firm examines infrastructure or the no-log policy and publishes a report. Solid, but: paid by the provider, a snapshot in time, and scope matters. Read the report, not the press release.
Policy only
"We don't log" in the privacy policy. Worth exactly the paper it isn't printed on. IPVanish and PureVPN advertised "zero logs" while handing connection logs to US agencies.
Filter providers
Filter
Proven in court, raids and seizures
These four had their no-logs claim tested by force - and passed. That is more than any marketing claim can ever be.
The best-tested no-logs claim in the industry: two US court cases (2016, 2018) where PIA had nothing to hand over, RAM-only servers, two Deloitte no-logs audits. The community default for port forwarding.
US courts 2016 + 2018: no logs produced · Deloitte audits 2018 + 2022
Diskless servers boot from signed RAM images with syslogs disabled - logs cannot even temporarily exist. A Swedish court rejected a data demand in 2020 because OVPN could not produce it.
Swedish court order rejected, Sep 2020 · diskless RAM-only design
Swedish police raided Mullvad in April 2023 and left with nothing. Numbered accounts, cash or Monero accepted, flat €5 forever, open-source apps. DAITA cover traffic and post-quantum WireGuard defend against traffic analysis - features no other provider ships.
Servers seized in Ukraine (2021) and the Netherlands (2026) contained no user logs; a Greek criminal case against its co-founder collapsed (2025) for the same reason. Three seizures, zero logs produced.
Swiss, open source, audited by Securitum, with the only no-ads free tier that has unlimited data - and Stealth obfuscation that works where protocols are blocked. One honest caveat: a Swiss court forced it to log one user's IP in 2021.
Securitum audits 2023 + 2024 · free tier without limits · Stealth for censorship
Gibraltar-based, eight independent security audits since 2019, published transparency reports, signed warrant canary, accepts Bitcoin and Monero. No multi-year pricing games - the flat price is the price.
8 audits since 2019 · signed warrant canary · transparency reports
The architecture is the proof: a two-party design where the exit hop is run by Mullvad and Obscura itself never sees your traffic - "can't log" instead of "won't log". Cure53 audited the macOS app and the protocol in 2025. The catch: it is a US startup under New York law.
Deloitte audited the no-log policy twice (2023, 2024). The 2018 third-party datacenter breach - disclosed 19 months late - is the counterweight on its record, and renewal pricing is the community's standing complaint.
Deloitte no-log audits 2023 + 2024 · breach disclosure was late
Deloitte issued an ISAE 3000 "reasonable assurance" opinion on its no-log configuration in 2025 - the strictest audit form seen in this industry. Shares ownership with NordVPN since 2022.
BVI-based, Cure53 audited the Lightway protocol, KPMG reviewed the privacy policy. Ownership history (Kape, ex-adware) and a former UAE surveillance operative as CIO keep it off the top tier.
From the Firefox maker: Mullvad's WireGuard network behind a friendlier app, Cure53-audited, fully open source. The honest catch: it rides Mullvad's infrastructure, so Mullvad direct is the stronger choice - and Mozilla's privacy notice documents connection timestamps.
The most regular auditor in the industry: Cure53 has audited TunnelBear's apps and infrastructure every year since 2017. Free tier is a modest 2 GB - and the community credits it with unusually clean IPs.
Cure53 annual audits 2017-2022 (6 rounds)
Anonymous payment: No · Open source: Partly · Free tier: 2 GB/month
VerSprite assessed the backend infrastructure three times (2024, 2025). The parent (Gen Digital) also owns HideMyAss - the 2011 logging scandal is part of the same corporate family.
Same parent (Gen Digital) as HideMyAss, caught logging in 2011
Community picks: no audit, no court test - vetted for years
The honest geheimtipps. These have no audit and no court case, so they carry the policy only badge - they are listed because the privacy community has used, stress-tested and argued about them for a decade, and because omitting them would hide real options behind an arbitrary line. Treat a track record as reputation, never as proof.
The community's long-running pick: open-source Eddie client, Monero payments, persistent port forwarding, and a no-logs stance kept since 2010. No audit has ever been published - policy-only evidence, listed for its track record, never as proof.
Policy only · no published audit · community-vetted since 2010
Small Swedish operator, RAM-only servers, open-source clients, Monero accepted. Acquired by consumer-security company Malwarebytes in 2024 - a track record worth watching, not proof of anything.
Policy only · RAM-only design · Malwarebytes-owned since 2024
Free does not have to mean spyware. These are either freemium tiers of audited providers (limits are honest data caps) or donation-funded nonprofits. What none of them are: anonymous.
Donation-funded Seattle collective, no accounts, no IP logging, signed warrant canary. US-based - fine for IP privacy, not for anonymity. The tech stack is shared with CalyxVPN.
Nonprofit collective · signed warrant canary · open source
Anonymous payment: No · Open source: Yes · Free tier: no account, no limits
The Calyx Institute (NY nonprofit) runs a free, account-less VPN for research and education. Same profile as Riseup: no logs claimed, no audit published.
501(c)(3) nonprofit · no accounts · open source
Anonymous payment: No · Open source: Yes · Free tier: no account, no limits
The only real anonymity tool. Three volunteer relays, no single operator sees both ends, no logs exist to subpoena. Slow by design - use it for anonymity, not for streaming.
Nonprofit · volunteer relay network · nothing to subpoena
Anonymous payment: No · Open source: Yes · Free tier: anonymity, not a VPN
Free WireGuard-based wifi protection from Cloudflare. Unusually honest about what it is: not anonymity - Cloudflare sees your traffic, you just share an exit IP range.
Free, no account · explicitly not an anonymity tool
Anonymous payment: No · Open source: Partly · Free tier: wifi safety, not anonymity
Academic volunteer-relay project (University of Tsukuba). Real circumvention value, but relays are strangers and an aggregated log infrastructure exists. Not for privacy.
Free tiers of Proton VPN (unlimited data, 1 device), Windscribe (10 GB/month), hide.me (8 locations) and Mozilla VPN's Firefox built-in (50 GB/month) appear in the tables above - they are the only free options backed by an audit.
Censorship tools: free, effective, honest about logging
If your problem is a state firewall, these are the tools people actually use. They optimize for reaching the open internet, not for privacy: Psiphon logs usage metadata by documented policy, Lantern's audit claim is unverifiable, Snowflake is a bridge into Tor. Pick by threat: censorship first, privacy second - never the reverse.
Free, no account, built for censored countries - and honest about logging: protocol, session duration, byte counts and coarse location are kept up to 90 days by documented policy. Use it to get around a firewall, not for privacy.
Logs metadata up to 90 days by policy · open source · ad-supported
Anonymous payment: No · Open source: Yes · Free tier: censorship circumvention, no account
US 501(c)(3) circumvention tool with a warrant canary and "no-logs" claims - but the FAQ's "independently audited" points to no published report, and its pre-2025 reputation was a logging proxy. Claims unverified.
Policy only · claimed audit unpublished · warrant canary
Anonymous payment: No · Open source: Yes · Free tier: daily data allowance; unlimited in censored regions
Tor's pluggable transport: volunteer browser proxies carry censored users into the Tor network. Not a VPN, no logs to subpoena - volunteers only ever see encrypted traffic, and throughput is modest.
Volunteer bridges · part of the Tor network · free
Anonymous payment: No · Open source: Yes · Free tier: browser-based Tor bridge
A $5 VPS with WireGuard gives you IP privacy with no provider in between. Honest limits: your traffic is attributable to one IP you paid for - self-hosting is privacy from providers, not anonymity. And you are your own support department.
One app deploys obfuscated WireGuard (AmneziaWG) or XRay REALITY on your own VPS - the strongest self-hosted setup against censorship. Audited by 7ASecurity three times.
Friendly GUI for your own Shadowsocks server, audited repeatedly (Cure53, ROS). The Shadowsocks fingerprint is known to censors - XRay REALITY resists better.
Cure53 + ROS audits 2018-2024 · open source, now a nonprofit foundation
Anonymous payment: No · Open source: Yes · Free tier: free and open source
ssh -D 1080 on any server you can SSH into: a free SOCKS5 proxy for your browser. TCP only, and you are still the attributable owner.
Zero cost, zero extra software · browser-only
Anonymous payment: No · Open source: Yes · Free tier: browser-only IP change
One attributable IP you pay for - no anonymity
TCP only - QUIC and some apps bypass it
FreeOpen source
Tailscale, ZeroTier, NetBird and friends solve a different problem: connecting your own devices. Identities are known to the operator - access control, not privacy.
Decentralized VPNs - distributed trust is still trust
dVPNs route traffic through other users' or rented nodes. The architecture is real, but the exit node sees your traffic just like a commercial VPN server - it is just harder to subpoena. None of these make you anonymous.
The only serious metadata-privacy architecture: a 5-hop Sphinx mixnet with zero-knowledge credentials. You pay in latency; the 2-hop mode is just a VPN.
22,000+ volunteer nodes, residential IPs from $2.59 - good value. But every exit sees your traffic, and the entity structure behind the network is a puzzle.
Token-based multi-hop market. Its own FAQ is the most honest in the category: "nodes can monitor traffic", "you are not anonymous by default". Development has been quiet since ~2022.
Honest self-disclosure in FAQ · ConsenSys audit 2019 (contracts only)
Who owns whom - the map the review sites won't draw
A third of this page's providers share four parent companies - and some of those companies also own the "independent" review sites that rank VPNs. Ownership does not make a no-logs claim false (the evidence badges above do that job), but it explains why affiliate-funded rankings never mention it.
Kape Technologies plc
Formerly Crossrider, an ad-injection SDK widely classified as adware. Also owns the review sites vpnMentor and WizCase.
OVPN was acquired by Pango in May 2023 - the no-logs operator now sits inside the same holding as Betternet and Hotspot Shield, plus the review sites Comparitech and ProPrivacy.
Fifteen years of the same test - two very different outcomes
Same pressure, two outcomes: raids, seizures and court orders against the green entries found nothing. The red entries advertised "no logs" - and produced them.
No-logs heldLogs produced
2026
WindscribeNo-logs held
Dutch authorities seized a server, allegedly without a warrant; no user data exposed.
Six checks that separate evidence from marketing - usable on any provider's website in ten minutes:
"100% no logs" with zero proof The stronger the wording, the weaker the evidence usually is. Look for: audit reports with scope, court outcomes, transparency reports. Nothing found = policy only.
"Free, unlimited, 100M+ installs" Audits of popular free Android VPNs (IMC 2016, NDSS 2026) found ad injection, tracker embedding, traffic leaks and data sales. A free VPN sees 100% of your traffic - someone pays for that.
Check who owns it Kape Technologies alone owns PIA, ExpressVPN, CyberGhost and ZenMate - plus VPN review sites. Gen Digital owns Norton, Avast and HideMyAss. The logo is not the company.
"Anonymous signup" that needs email + card Your payment method is the strongest identifier a VPN can hold. True anonymity needs numbered accounts + cash/crypto (only Mullvad offers both at scale).
Warrant canary missing or quietly removed A signed canary statement is weak evidence, but its disappearance is a loud signal. Proxy.sh removed theirs in 2016, hinting at a gag order.
The client app is the soft spot TunnelCrack (2023) and TunnelVision (2024) showed most VPN clients leak traffic via routing tricks. A perfect no-log policy cannot save a leaky client - keep it updated.
Frequently asked questions
What does "no logs" actually mean?
Strictly: no record of which user connected where, when, with which IP - activity, session and connection logs. No honest provider is fully "logless": they keep billing records (you paid them), crash reports if you consent, and aggregate server health metrics. The claim that matters is narrower and stronger: no record that connects you to what you did.
Can a no-logs claim ever be verified?
Not absolutely - but four evidence levels come close: a court case where nothing could be produced beats a police raid, which beats an independent audit, which beats any policy text. Every provider on this page is labeled with the highest level it has actually passed.
Which VPNs have actually proven they keep no logs?
Four have survived real-world tests: Private Internet Access (US courts 2016 and 2018), OVPN (Swedish court 2020), Mullvad (police raid 2023, nothing seized) and Windscribe (seized servers in Ukraine 2021 and the Netherlands 2026, court case dropped in Greece 2025). Twelve more have published independent audits - listed in the audited section with auditor and year.
Are paid audits trustworthy?
More than policies, less than court. Three things decide an audit's value: scope (infrastructure vs. a PDF review), depth (a weekend pentest vs. a weeks-long engagement) and whether the report is published in full. All audit links on this page go to the reports themselves - read the scope section, not the press release.
Is a free VPN ever safe?
As freemium of an audited provider, yes: Proton VPN Free (unlimited data, 1 device), Windscribe Free (10 GB/month), hide.me Free (8 locations), Mozilla's Firefox built-in (50 GB/month). Their limits are enforced by data caps, not by selling your data. Random "free VPN" apps from app stores are the exact opposite - see the timeline above.
Is a self-hosted VPN better?
For privacy from providers: yes, and it costs ~$5/month. For anonymity: no - your VPS IP is attributable to you, your host knows who you are, and one IP is trivially blocked by censors. Self-hosting removes the middleman, not the trail.
Does the jurisdiction (Five Eyes etc.) really matter?
Less than the evidence. A "privacy-friendly" registration address in Panama or the BVI means nothing if the company actually operates from elsewhere. What matters: where the servers sit, what the operator must hand over under real court orders - and the track record above is the only test that has actually happened.
What about decentralized VPNs (dVPNs)?
They distribute trust - they don't remove it. An unaudited exit node you don't control sees your traffic exactly like a commercial VPN server, but nobody is liable and quality varies wildly. NymVPN is the interesting exception architecturally (a mixnet hides the metadata), and it costs latency for that.
Methodology
Who gets listed
Commercial providers are listed only with verifiable no-logs evidence: court or seizure outcomes, or published independent audits with named auditors. One documented exception: the community tier (AirVPN, AzireVPN) carries the "policy only" badge because the privacy community has vetted them for a decade - labeled honestly rather than omitted. Free, censorship, self-hosted and decentralized entries are tools, not providers; each carries its own evidence level and caveats.
Where the facts come from
Facts come from primary sources: operator policy and audit pages, court filings and reporting (TorrentFreak, Ars Technica), regulatory documents (FTC), peer-reviewed studies (IMC 2016, NDSS 2026, TunnelCrack 2023, TunnelVision 2024) and archived community discussions linked per quote. Every link on this page goes to the source itself. Fact set: 2026-11.
No affiliate links, no funding
This page accepts no affiliate links, no sponsored placements, no payments, no tracking companies. Links to providers go directly to their pages or to the evidence itself. If a provider offers us money to change a word, that fact will be published here.
Freshness
Fact set: 2026-11. Material changes (new audits, court outcomes, incidents) trigger an update and a changelog entry. This page has no reason to exist other than the evidence being current.
Changelog
2026-11 — Relaunch: added Obscura, Mozilla VPN, AirVPN, AzireVPN and the censorship tools (Psiphon, Lantern, Snowflake); ownership map; two-sided evidence timeline; community voices with permalinks; all facts re-verified against primary sources.