How to Choose a VPN: 12 Criteria and a Checklist for Comparing Services

“Recommend a decent VPN.” It is the most common question I hear, and also the most meaningless one — because “decent” depends on the task, the provider, the number of devices, and your tolerance for surprises. The person asking expects a name. But six months from now that name may mean nothing: the infrastructure has moved, protocols have become outdated, support has been cut. Same service, different quality.

So how to choose a VPN in 2026 is not a question about names, but about criteria: twelve of them, the set that someone who understands how this industry works can use to evaluate a service in half an hour, plus ways to check every point before you pay a cent. We will also cover the red flags.

And first, the most important thing you should know about me. I work for a VPN service. That means I have a direct interest in you choosing us, and any list of criteria written by someone in my position is, by definition, tailored to their own product — I will be honest about that instead of pretending otherwise. So I can offer only one thing: every one of these twelve points can be checked from the outside, by yourself, without trusting my words. Check us too. If we do not pass, you are right.

Criteria 1–3: protocols, infrastructure, bandwidth

Start with the technical side: if this part fails, I do not think the rest matters much.

1. Protocols and resistance to blocking

The first question is which protocols are supported and which of them work on your network. The classics — OpenVPN, IKEv2, WireGuard — are excellent for speed and vulnerable to traffic analysis because their handshakes can be recognized by characteristic patterns. For someone behind a filtering ISP, impressive speed-test numbers mean little if the tunnel drops after three minutes. You need traffic masking: VLESS with XTLS-Reality, obfuscated WireGuard, or transports over TLS. A service relying only on the classics will eventually fail, and support cannot fix that. A good sign is several protocols with the ability to switch between them. A bad sign is a promise that it “works everywhere.”

2. Infrastructure: owned or rented

Some services own their servers and address space; others rent capacity from hosting providers and resell someone else’s infrastructure. The second model is cheaper to launch and less resilient because when a hoster’s subnet is restricted — and this often happens to whole batches of addresses rather than one at a time — a reseller can lose half its nodes at once. There is another issue. Owned infrastructure means control over both the hardware and what runs on it. Rented infrastructure means there is another party in the chain with access to the hypervisor. I do not know how much that should worry you, but you should know it.

3. Bandwidth and address reserves

Here is a popular misconception worth burying: “They have two thousand servers, so they must be good.” Not necessarily, and I say that as someone who once thought the same. Server counts are easy to inflate by slicing virtual machines more finely. More important are bandwidth per node and the reserve of free IP addresses, as well as how quickly the service introduces new addresses when old ones are blocked. That is the real measure of resilience, and nobody publishes it — including, I admit, us. You can assess it indirectly: look at how the service behaved during recent blocking waves. Were addresses replaced? Was there a status update? How long did the outage last?

Criteria 4–6: logs, jurisdiction, audits

Next comes trust — the part I do not like. It is almost impossible to verify independently. Almost.

4. Logging policy

Everyone says “no logs.” The question is not whether those words appear, but what they actually mean. Technical logs are necessary for any service, otherwise infrastructure cannot be maintained, and when I see “we record absolutely nothing,” I want to ask a few questions. The important part is the depth: is the combination of “user — time — resource” stored, or only load information about a node? See our article about no-logs policies for how to read one. A statement without evidence is worth exactly as much as any other statement.

5. Jurisdiction

Where is the company registered, and which laws require it to respond to requests? There is plenty of speculation and little concrete information. Honestly, jurisdiction matters, but less than people often think, and I regularly get criticized for saying so. Much more important is what data technically exists: if it does not exist, there is nothing to request regardless of the country where the company operates; if it does exist, jurisdiction determines how it may have to be handed over. Still, check where the service is registered and what its privacy policy says. The absence of this information is already an answer.

6. Independent audit

The only way to turn a promise into evidence is for an external team to receive access to the infrastructure and check whether reality matches the claims. I look at four things: who performed the audit, when it was done, what was checked, and whether the full report was published or only a press release. An audit from three years ago tells you little. Still, the existence of an audit means something. See our article about independent security audits.

[Image: a twelve-point checklist card formatted for saving on a phone]

Criteria 7–9: devices, platforms, clients

This is an everyday but underestimated group. Problems here usually become visible after payment.

7. Number of simultaneous devices

Count honestly. Phone, laptop, tablet, work computer, TV, your partner’s second phone, a console — suddenly you have seven or eight, and that is an ordinary household, not a gadget collector. I got nine myself. Five devices may be enough for one person, but not for a family. Also check how the limit is calculated: by active sessions or by registered devices. The second is noticeably stricter because replacing a phone can consume a slot.

8. Platform coverage

Windows and Android are everywhere. Differences start with macOS, iOS, Linux, routers, TVs and consoles. Pay particular attention to routers; this is my personal favorite. A VPN on a router covers every device at home, including devices where you cannot install a client no matter how hard you try — speakers, consoles, TVs with strange firmware — so the “how do I connect this one?” question disappears. Support for Keenetic, OpenWrt or MikroTik is a sign of maturity.

9. Client quality

This is subjective, but there are objective criteria. Can the app choose a node automatically? Is there a Kill Switch and split tunneling? Does the server list update through the subscription? I consider the last point underrated: a service where you have to manually obtain a key whenever the infrastructure changes will cost you time every time something breaks, and something always breaks on Friday evening. Clients are listed in the downloads section — if there is no such section, that is already a signal.

Criteria 10–12: support, payment, additional features

10. Support and response time

The most underestimated of the twelve criteria. And, in my experience, the most revealing. When everything is calm, support is unnecessary: everything works and nobody has questions. It becomes critical precisely when a blocking wave hits and half the users suddenly cannot establish a tunnel. That is when you find out whether there are real people behind the service or a contact form that replies four days later with “thank you for contacting us.” It is easy to test: ask a question before buying, time the response, and see whether a person answers or a template does. This is the only one of the twelve points that can be tested completely free and before any payment.

11. Payment, renewal and refunds

Three things. Which payment methods are available — for Russian users this is a particular pain point. Whether automatic renewal is enabled and how to disable it. Whether there is a refund period. Unclear refund terms are a reason to be cautious; and an automatic renewal that turns itself on and can only be disabled by emailing support is, in my view, a direct sign of disrespect. Here I am speaking not as an expert, but as an annoyed customer.

12. Dedicated IP and business features

Not everyone needs them. But if you do, you need them immediately. A shared address used by hundreds of people eventually ends up on blocklists, and you start living in a world of CAPTCHAs: prove you are not a robot, select the traffic lights, now select the buses. A dedicated IP solves that; see the separate article for when it makes sense. For companies, the list is broader: connecting offices, remote access, monitoring and access control. If there is no business offering, the service is not suitable for corporate tasks, however good it may be for home use.

How to check all of this before paying

Now for the most useful part. Most criteria can be checked for free before you take out your card.

There is one more test that takes a minute and tells you more than the entire website: connect during the trial and run a VPN leak test. A service that leaks DNS out of the box deserves attention for exactly that reason. Test us the same way.

Red flags

These are signs where, personally, I would not investigate further.

• No contacts — no real support, company details or terms, only a “leave your email” form.
• “Lifetime subscription” — the service’s costs grow every month while the payment happened once, so the arithmetic simply does not add up.
• Aggressive free plan — traffic costs money, and if you are not paying, somebody else is; the question is how. Here is an analysis of the mechanics.
• “You will never be blocked” — that does not happen; it is a race, and an honest service says so directly.
• Reviews only on the company website — not a single mention elsewhere, which is strange for a working product.
• No trial period and no refund — a confident service lets you try it.
• A 90% discount with a countdown timer — the other side is that the non-discounted price may never have been real.

[Image: red-flag icons with short labels — lifetime subscription, no contacts, promise of 100% availability]

12-point checklist

Print it or copy it somewhere — I prefer the latter. Fill it out for a service in half an hour; comparing services side by side is easy.

1. Protocols. Are there protocols resistant to filtering, and can you switch between them?
2. Infrastructure. Owned servers and addresses, or resale of someone else’s capacity?
3. Bandwidth and IP reserves. Peak-hour speed and how often addresses are replaced.
4. Logs. What exactly is recorded, how long is it stored, and is it explained clearly?
5. Jurisdiction. Where is the company registered, and are its details and terms provided?
6. Audit. Was one performed, by whom, when, and is the report published?
7. Devices. How many simultaneous devices, and how is the limit calculated?
8. Platforms. Are all your systems covered, and are routers supported?
9. Clients. Kill Switch, exclusions, and subscription-based configuration instead of manual keys.
10. Support. Contact channel, response time, real person or template?
11. Payment. Methods, automatic renewal and refund terms.
12. Additional features. Dedicated IP and business functions if you need them.

Keep it simple: put a plus, minus or question mark next to every point. More than three minuses among the first six means move on. Lots of question marks mean the service does a poor job explaining itself, and that is information too — quite telling information.

[Image: blank comparison matrix for three services and twelve criteria — a template for filling in yourself]

How to run a trial

Most people waste the trial period: they connect, open a website and are happy. You should test something else — here is my plan.

1. Day one — install the clients on all the devices you use and see how easy the process is.
2. Check for leaks on every device and in every browser — do this once at the beginning without fail.
3. Test different networks — home Wi-Fi, mobile internet and work. Behavior can differ significantly, and each operator has its own specifics.
4. Test during peak hours — in the evening, when everyone is home. Speed at 3 p.m. tells you little.
5. Configure exclusions for banks and government services; if this is impossible, you have found a limitation you will have to live with every day.
6. Contact support with a real question and time the response.
7. Give yourself a week of normal use — simply use the service and note what annoys you.

Fourteen days is a reasonable period to do this without rushing, one week is the minimum, and three days honestly tell you almost nothing: in three days you may not experience a single outage, while, in my experience, a service is judged precisely by how it behaves when something goes wrong.

What matters most

If I had to reduce the twelve criteria to three, I would keep these: working protocols, owned infrastructure and live support. The rest matters, but is secondary. Or rather, it matters differently to different people: someone who only watches video does not need an audit, while a company connecting a warehouse to an office does not care about the number of personal devices. So which VPN to choose depends on the task, and you should run the checklist against that task.

And finally, the part I find most uncomfortable. No checklist can replace two weeks of real-world use on your provider and your devices. A service that works perfectly for your neighbor may not connect for you because the operator is different. There is a separate article about choosing a VPN for Russia.

Test HubHide yourself against this checklist: fourteen days free, no card required. Ask questions about any point in support — we will answer specifically; that is criterion number ten in action.

Frequently Asked Questions

How do I choose a reliable VPN?

Start with three things: whether the service supports protocols resistant to traffic filtering, whether it has its own infrastructure, and how quickly support responds. These points can be checked before payment through the website, a direct question and the trial period. The remaining criteria can then be matched to your specific needs.

What should I look for when choosing a VPN?

Look at protocols, infrastructure, address reserves, logging policy, jurisdiction, audits, device limits, platform coverage, client quality, support, payment terms and additional features such as a dedicated IP. There are twelve points, and each can be checked in a couple of minutes. Server count is not on the list — that is marketing.

What is a no-logs policy?

It is a service’s statement that it does not store data about your connections and the resources you visit. The statement itself guarantees nothing: it carries more weight when an independent audit has checked the infrastructure and published a report. Read the policy in full and look for specifics rather than slogans.

How many devices should a VPN support?

Count yours: phones, computers, tablet, TV, console — usually there are more than you expect. Around five is a comfortable minimum for one person; a family is better served by ten or an unlimited plan. Also check whether the limit applies to simultaneous sessions or registered devices — the latter is stricter.