The Best Free & Paid No-Logs VPNs

It’s almost impossible to tell whether a VPN that calls itself no-logs actually collects no logs. Sadly, many VPNs claim to not keep logs just to convince you to buy their product.

The best way to find out if a VPN is truly no-logs is to pick apart its privacy policy and terms of service, evaluate its server infrastructure and jurisdiction, and find out whether its servers have been seized in the past.

That’s why we’ve spent over 50 hours collecting, analyzing, and assessing the very best no-log VPNs to find out which are the most private and won’t collect identifiable data.

In the table below, you can compare the top four no-logs VPNs based on their logging policies, real-world history, jurisdiction, and more:

In the rest of this article, we’ll explain what no-logs VPN actually means, reveal which VPNs log your data, and why VPN services collect logs in the first place.

We’ve also collected data on the privacy policies of 70 VPNs to find out which collect your IP address, DNS requests, and more.

In our research, we only found five VPNs with genuine zero-logging policies that had been certified by real-world events, such as a subpoena or server seizure.

When choosing the best three, we considered which had regular third-party audits of their logging policies, which had diskless servers, and whether the VPN jurisdiction was privacy-friendly.

Here’s an in-depth table showing the exact data that each of these no-logs VPNs records:

You can see the full results of our tests in our detailed results table.

There are many high-quality VPNs that claim to be no-logs, even backed up with in-depth audit results and extensive online resources on digital privacy. We assessed over 62 of these VPNs when choosing our recommendations.

However, there are very few VPNs that have been actually verified by real-world cases, such as law enforcement seizing servers or hackers exposing customer data.

Some of these VPNs haven’t made the list simply because they’ve avoided these circumstances.

Here’s some of the most private VPNs that haven’t been proven no-logs in real-world cases, but still have extremely strong no-logging policies, anonymous payment methods, and AES-256 encryption.

NordVPN

What we do like:

NordVPN’s privacy policy is regularly audited by a third party to prove its validity. It’s also implemented diskless servers, which make sure that no data is saved onto a physical server and is instead deleted permanently.

NordVPN is based in Panama, a privacy-first nation. It publishes regular transparency reports, and it also offers Bitcoin as an anonymous payment method.

What we don’t like:

NordVPN takes your email address and payment data upon signup if you use a credit card, which is common among VPNs and can be avoided by providing a fake email address. It also logs your connection timestamp for 15 minutes after a session ends.

NordVPN’s Threat Protection feature makes sure you don’t save any harmful malware onto your device, but the “scanned files are stored and used to improve NordVPN.”

You can disable this feature, and files aren’t tied to any specific user, but we’d prefer these files to be deleted immediately after being scanned for malware.

IVPN

What we do like:

IVPN doesn’t require an email for signup, instead you receive a random identifier. You can pay using cash or cryptocurrencies.

It’s based in privacy-friendly Gibraltar, is transparent in its ownership, and it publishes a regular warrant canary and independent audit to verify its no-logs policy. All of IVPN’s code is also open-source and available on GitHub to scrutinize.

What we don’t like:

IVPN doesn’t have diskless servers and the no-logs policy hasn’t been tested in a real-world case, so we can’t be 100% sure it’s truthful. It’s also got a relatively small server network of only 29 countries.

Additionally, IVPN automatically saves device information on mobile for crash logs.

Mullvad VPN

What we do like:

Mullvad doesn’t ask for your email address when you sign up – similar to IVPN, it gives you a unique account number. Mullvad’s server network, including VPN and private DNS servers, are all completely diskless.

It doesn’t save any activity logs of its users and offers PGP email communication.

Mullvad also offers anonymous payment methods, such as cryptocurrencies and cash, so you won’t be traced by your credit card details. The VPN service offers multi-hop servers, SOCKS5, and an automatic kill switch.

What we don’t like:

Mullvad is based in the EU, which means it has to adhere to General Data Protection Regulation law (GDPR). It also hasn’t completed a third-party audit on its privacy policy or implemented transparency reports.

Unfortunately, you can never really know when a VPN is recording your data. There always has to be an element of trust when using a service that could have access to your credit card information, browsing history, and IP address.

However, we’ve identified the best VPN services that claim to be no-logs and put them through our rigorous testing methodology to determine whether they are truly no-logs, and whether they are worth a subscription.

In the table below, you can compare how the top VPNs performed in each of our testing categories:

Here’s a more detailed explanation of our methodology and review process:

1. Real-World Case: 30%

Real-world cases are the most reliable way to tell if a VPN is lying about its logging policy. It’s also an efficient way of assessing whether the security of a VPN’s server infrastructure and software is adequate.

Unfortunately, it’s only when a server has been seized by a third party, hacked, or requested in legal proceedings and information is leaked, that we can know if the server ever stored information about its users.

2. Privacy Policy: 30%

Our experts analyzed and dissected the privacy policies of 70 VPNs in order to identify which were actually no-logs, and which were claiming to be while storing information.

All the no-logs VPNs we recommend truly do not store any logs, by which we specifically mean: no activity or connection logs.

However, this doesn’t mean absolutely no information is kept about the user. Our definition of no-logs includes VPNs that store personal information (an email address, username, password, and any payment information provided) and aggregated anonymous logs.

Personal information is included because virtually all VPNs collect this information in order to open an account or issue a refund to a user. Whereas, aggregated and anonymous logs cannot be used to identify any single user, meaning your data is safe.

3. Logging Policy Audit: 10%

Besides real-world cases that prove a VPN’s no-logs policy, there’s also verification through independent audits performed by third-parties, such as Deloitte and Cure53.

It’s important to differentiate between server or software audits and a logging policy audit. The latter is what we want a VPN to do in order to prove it’s following a no-logs policy.

In comparison, a software or server infrastructure audit only analyzes a small section of the service and can’t fully determine whether a VPN is no-logs.

4. Diskless Servers: 20%

Diskless servers are incredibly rare among VPNs because they cost a lot of money and require a considerable amount of time to set up.

But they are the best way to ensure that your data isn’t saved onto a hard drive, which could then be exposed.

With RAM servers, when a session or process is terminated, any data associated with it is permanently deleted. This way, it’s almost impossible for government agents or anyone else to seize the server and retrieve information like they could with a physical VPN server.

Basically, it’s almost a guarantee that the no-logs policy is being adhered to as it’s hardwired into the servers.

5. Jurisdiction: 10%

Where a VPN is incorporated will affect its legal obligation to log and store data, or even share it with governmental authorities.

For example, a VPN based in the US could be compelled by the government to record user data. The US is part of the Five Eyes international intelligence sharing alliance, which puts your data at risk of being passed from the US to another country’s authorities.

In contrast, a VPN based in the British Virgin Islands benefits from having complete sovereignty over its data privacy legislation.

However, a watertight no-logs policy that’s been independently audited and verified in a real-world case can overrule a bad jurisdiction.

A secure, no-logs VPN will boost your online privacy. But a VPN that logs your connection data and has a poor technical infrastructure will put your data at risk of leaks and could even be sold to advertisers.

Read on for a shortlist of VPNs that log your data and that you should absolutely avoid. We also have a detailed table showing all the user data logged by the top VPNs.

1. Hola Free VPN: A Dangerous Proxy That Logs Your Data

Despite VPN being in the name, Hola Free VPN is actually an insecure peer-to-peer proxy network that doesn’t provide any encryption whatsoever.

Hola Free VPN’s privacy policy also states that it may log your activity logs and connection logs, which is more than enough information to identify you and your online activity.

Even worse, Hola VPN doesn’t even specify for how long it’ll store the information collected. It might be for months or even years.

2. Yoga VPN: Unsafe VPN that Has a Vague Privacy Policy

Yoga VPN is simply one of the worst VPNs we’ve reviewed. Its privacy policy is extremely short and vague.

Ironically, Yoga VPN’s privacy policy used to be hosted on a website called Pastebin. It’s a site popular with hackers for sharing stolen data, as you don’t need to create an account to share documents.

The privacy policy is now hosted on Yoga VPN’s own website, but it’s still the exact same text and even in the same font.

Overall, we don’t recommend downloading Yoga VPN. Beyond its questionable privacy policy, it’s also based in Hong Kong and has links to the Chinese government.

3. SkyVPN: Invasive Logging Policy & Has Links to China

SkyVPN logs your original IP address, new IP address, websites you visit, device information, location information, a list of apps on your device, and “other technical information about your device.”

Not only is the logging policy somewhat vague on what information it collects, while also admitting to the fact it collects way too much information to be anonymous, it also doesn’t clarify for how long it actually stores that data.

Lastly, it’s based in Hong Kong and has hidden links to Chinese ownership. Our extensive research into free VPN ownership in China flagged SkyVPN as a Chinese entity, but it was extremely difficult to find this information.

A no-logs or zero-logs VPN is a provider that doesn’t log any identifiable data that can be used to track your online activity.

The no-logs claim – or a ‘no-logging policy’ — can be misleading, as it implies that absolutely no data is stored at all. But all VPN services have to collect at least some amount of data to provide customer support, maintain device limits, collect subscription payments, and issue refunds.

Moreover, some VPNs claim to be no-logs but implement cookies in their website that track your browsing activity (such as when you click buttons, purchase a subscription, or log in).

In short, each VPN that defines itself as no-logs actually has a different interpretation of what that actually means.

We explain what VPN logs are, and which types of logs actually matter, in the video below:

This is why you should always read through a VPN’s privacy policy and terms of service before buying a subscription to make sure you’re aware of its real logging practices.

As an example, we’ll go through NordVPN’s website and compare it to the privacy policy. NordVPN markets itself as a “zero-log VPN service” on its website.

But in reading NordVPN’s privacy policy, we’ve found it does store some sensitive data — as most VPNs will do. Importantly, it’s specified that NordVPN saves your username and a timestamp of the last session status.

This would be worrying if it were stored for a long time. However, NordVPN’s privacy policy clarifies that this data is promptly deleted within 15 minutes of your session ending.

If you’re an average VPN user in a country with minimal internet restrictions, you should have no worries about this information being almost immediately deleted. The chance of it being leaked is low.

However, it does show the fine line between what VPNs claim to be no-logs and what they actually do log. In this case, NordVPN defines itself as no-logs because even though it does collect some data, it is deleted after a session is terminated.

Types of VPN Logs

VPN logs are records that VPN providers keep about who is using the service and how the service is used.

For example, a timestamp of when you connected to a server, your original IP address, your new IP address, and the URLs you visit, can give someone a full picture of what you’re doing online.

Since a VPN can have access to everything you do online, the less data it saves the better it is for your privacy. Ideally, as much data as possible will be deleted immediately to maintain as much anonymity as possible.

We recommend VPNs that only keep a minimal amount of logs. Some logging is acceptable, for example if it’s aggregated. But other types are completely unacceptable, like if a VPN saves your originating IP address and URLs visited for a long period of time.

Independent No-Logs Audits

The problem with no-logs VPN policies is that they are virtually impossible to prove from the outside. That’s why some VPNs hire external auditors to pick apart their no-logging policies and server infrastructure.

In theory, a third-party checking whether a server keeps logs will prevent bias and manipulation of audit results. But VPNs can manipulate results in an audit by only showing a specific server that’s been wiped clean while the rest are full of stored data.

There’s also no guarantee that a server free of sensitive information over the two-week audit period will not start collecting data after the audit is concluded.

Even if a VPN carries out an extensive third-party audit, which provides major vulnerabilities to fix, the VPN can refuse to release it to the public if the results are negative.

In short, an external audit shows a VPN’s strong commitment to transparency and a private logging policy. But it doesn’t guarantee that an entire server network is completely free of sensitive information.

The best way to prove that is to have servers seized by law enforcement and raided for data. If no data is found on the randomly-seized servers, at a time when the VPN was unprepared for an investigation, then you can be sure that VPN’s servers are not storing data.

Diskless VPN Servers

When you connect to a typical VPN server, any data you transmit is stored inside the server on physical hard drives until it’s manually erased.

If the servers are seized by law enforcement or hacked, and the data hadn’t been erased, they could have access to any data kept inside.

To prevent this vulnerability, some VPNs use RAM-only or diskless server networks that erase data automatically on a regular basis or when a server is being seized.

RAM (or Random Access Memory) is a type of short-term computer memory that needs a constant source of electricity to keep the information. If the server was shut down or rebooted, it instantly deletes all the information stored inside.

A diskless network is much more private than a hard drive server network. However, they’re very rare in VPNs. Only a select few have the resources to implement this advanced server infrastructure.

Customer Service Providers & Payment Processors

Beyond the VPN service collecting data from its servers, there’s also third-party customer service providers (such as Zendesk) and payment companies (e.g. Stripe or PayPal) that a VPN might use.

Live chat customer support services in particular might log your IP address, email address, and device information during your conversation. This will likely be addressed in a VPN’s privacy policy if it’s a high-quality service — but isn’t always easy to find.

Some VPNs, such as Mullvad and IVPN, offer PGP keys to encrypt your email communications with customer service.

A payment company that handles online subscription payments might also have access to your full name, address, and other billing information. This isn’t necessarily bad, as many financial institutions that process these transactions are regulated by national financial authorities.

It’s also necessary for these companies to take this information in case you want to request a refund at the end of a money-back guarantee period.

To help shed light on this murky aspect of the VPN industry, we fact-checked the logging policies of 70 of the most popular VPN services on the market.

Our research revealed that the majority of VPNs record some form of user data:

• 39% log connection timestamps
• 26% store original IP address
• 10% record browsing activity data
• 6% log server IP address

The following table lists all 69 VPNs we’ve analyzed and the specific types of data they log. If you’re searching for a specific VPN, use Ctrl+F to find the provider you’re looking for.

Aggregated – Aggregated data has been collected in a group and shows trends in total, never on an individual basis. For example, some VPNs collect aggregated server bandwidth data to make sure servers aren’t overloaded.

Anonymized – Anonymized or de-identified data is encrypted to make sure any third-parties wouldn’t be able to use the data.

Vague – This means a VPN provider hasn’t specified in its Privacy Policy whether this datapoint is collected.