Alternative VPN Choices for You
Swiss-based Proton Technologies AG has now also introduced a Virtual Private Network (VPN) service. Given the deservedly good reputation of ProtonMail, it is not surprising that expectations for ProtonVPN are very high. Read on to find out if ProtonVPN lives up to these expectations!
|Bare metal or virtual servers
Below are the key features of the ProtonVPN Plus plan. The features vary by plan, however. See the pricing table above for more details.
- No IP logs and last login time is overwritten on each new connection
- Five simultaneous connections
- Servers in 14 countries
- Secure Core server network
- Tor through VPN
- Peer-to-peer (P2P) torrenting permitted on all servers for paid users
- Domain Name System (DNS) leak protection
- Kill switch (mobile apps also)
- Transparency report and warrant canary
Server locations are primarily in Europe and North America, but there are also servers in East Asia and Australia.
Secure Core is a feature that aims to protect users against traffic correlation attacks.
A traffic correlation attack is performed by monitoring internet traffic as it enters and exits a VPN server. If a user always connects to a VPN server at the same time as a user of that VPN service visits a monitored website, then it is fairly easy to identify that individual as a visitor to that website.
It is worth pointing out to the more paranoid out there that such attacks are highly targeted. Someone powerful has to be looking very carefully for you specifically.
Secure Core helps protect against this by first routing your VPN connection through a Secure Core server. This makes it all but impossible to perform traffic analysis on the second (exit) server.
In theory, traffic analysis could still be performed on the initial Secure Core server. However, ProtonVPN has taken steps to make this very difficult. For a start, the Secure Core servers are located only in countries with very strong privacy laws.
They are also owned and operated exclusively by ProtonVPN, and protected by a very high standard of physical security. “Finally, Secure Core servers are connected to the internet using our own dedicated network with IP addresses that are owned and operated by our own Local Internet Registry (LIR).”
Although ProtonVPN claims its Secure Core feature as “unique,” it is similar in principle to the “double-hop” VPN setup offered by the likes of NordVPN
. The fact that it uses its own dedicated network with IP addresses that are owned and operated by its own LIR, however, does make Secure Core a step-up from its rivals.
As ProtonVPN itself points out, “there is no such thing as 100% security.” However, this does indeed sound a very secure setup!
Tor Through VPN
This feature allows you to use ProtonVPN with the Tor network in Tor through VPN configuration. Most usefully, it allows you to connect to Tor Hidden services dark web sites using your regular browser.
It also means that your entire internet connection benefits from Tor through VPN. As I discuss in Using VPN and Tor Together, however, this is not a secure setup. If you want to do Tor through VPN, it is much safer to simply use the Tor browser while connected to your VPN service.
ProtonVPN does run its own Tor servers, so malicious Tor exit nodes shouldn't be an issue. However, the Tor Browser is hardened in ways that your regular browser isn’t. It will also reset your Tor routing every ten minutes by default, while ProtonVPN’s setup requires a static route that is inherently easier to trace.
Interestingly, although advertised on the website and offered as an option in the software, there is no documentation on this feature available anywhere on the ProtonVPN website.
Speed and Performance
All tests were performed using our server-based scientific speed test system. Our system tests ProtonVPNs UK, US, Australian, and Hong Kong-based servers. The graph below shows average download speeds across those four servers.
While speeds are not mind-blowing they are certainly good enough for streaming in HD. Also, burst speeds on the UK server (tested with a local UK test server) fared extremely well averaging 91.8 Mbps.
It is interesting to note that during our testing using the double-hop Secure Core feature had only a very modest impact on speed performance. With such a small speed penalty, there is little reason not to use it!
We were also impressed by speeds to the nearest VPN server to us. Although advertised as “slow,” the speeds do beat a large number of VPN providers on the market. Speed is one of the factors why BestVPN.com have included Proton in our best free VPNs list.
|BestVPN.com SpeedTest (max/burst)
|BestVPN.com SpeedTest (average)
|IPv4 leak detected?
|WebRTC leak detected?
We detected no regular IPV6 or DNS leaks (either IPv4 or IPv6), but the Windows and Android apps leaked our IPv6 address via WebRTC. This did not occur with your macOS client. We did not run any tests using your new iOS app.
I found ProtonVPN was blocked by US Netflix. The ProtonVPN FAQ states that BBC iPlayer is available using the service, but I found it blocked.
12 month Plan
$4.00 per month
1 month Plan
$11.58 per month
ProtonVPN offers four separate plans. Prices start from completely free, going up to $30 per month if paid monthly. Paying annually nets you a 20% discount. Existing ProtonMail users with paid-for accounts can claim a 20% discount (which is cumulative with the annual discount).
For most people who are willing to pay for a VPN, the sweet spot is likely to be the Plus plan. This provides access to all ProtonVPN servers at the highest speeds available. It also provides access to all ProtonVPN’s advanced features.
Even for ProtonMail users, the Visionary plan only really makes sense for businesses or individuals who wish to support the Proton project above and beyond the call of duty.
This ProtonVPN review will, therefore, concentrate on the Plus plan, although we have run some speed tests using their free version. Users can access servers located in Japan, the Netherlands, and the United States.
ProtonVPN offers an extremely generous 60-day money-back guarantee. Although not advertised on the website, when we downloaded the Windows software we were offered a seven-day free trial of the Plus plan.
Payment can be made via credit/debit card or PayPal. ProtonVPN uses a third-party payment processor for these, so doesn't keep any payment information itself.
It is also possible to pay using Bitcoin. Although not well advertised, Proton has stated that it also accepts payment in cash or via direct bank transfer if you contact support.
Accepting anonymous payment in cash or properly mixed Bitcoin is great, but please do remember that ProtonVPN will always know your real IP address regardless of how anonymously you pay.
Ease of Use
Custom apps are available for Windows, macOS, Android, and iOS. Manual setup guides are also available for Windows (OpenVPN GUI), Mac (Tunnelblick), Linux, iOS (Open VPN Connect), and Android (OpenVPN for Android and Open VPN Connect). Custom DD-WRT router OpenVPN files are also supplied.
It should also be noted that the supplied OpenVPN config files should be usable on most platforms that support an OpenVPN client.
ProtonVPN for Windows
The Windows client looks very professional. The main page features a funky map, but more usefully also lists all available servers. Each server shows load percentage, which can be handy for picking a fast server.
Alternatively, click Quick Connect to let the software choose the fastest server for you. You can also click on a country to let the software auto-select a server at that location.
Servers that support Secure Core, Tor, and different pricing plans are clearly labeled. When you're connected, a nice graph displays your connection speeds and bandwidth usage.
The client supports DNS leak protection and a VPN kill switch. As already noted, though we detected an IPv6 leak via WebRTC. You should therefore manually disable WebRTC in your browser, or disable IPv6 in Windows.
The kill switch is firewall-based. This is the best kind of kill switch because it makes it impossible for your PC to connect to the internet outside the VPN connection. Please see A Complete Guide to IP Leaks for more details. It is also possible to choose between the OpenVPN UDP and TCP protocols, although port selection is not available. Alternatively, IKEv2 is supported.
Overall, we would say that this is a very smart-looking piece of software that includes all the most important things I want from a VPN client.
||Yes - 7 days
|Live chat support
The first line of support is a well-presented FAQ. This is not extensive but does appear to address many common questions and issues that people may have.
If the FAQ doesn't answer your questions, you can email the support team. A response to my easy question took about four hours. Our difficult question was answered the next day. Although the response to my difficult question was vague, it did link to a webpage that by-and-large provided the answer I needed.
Privacy and Security
"Data we retain from ProtonVPN sessions: Each time a user connects to ProtonVPN, we only store a timestamp of the last successful login attempt. While it is stored indefinitely, this gets overwritten each time you log in... We retain this limited information to know how many devices are being connected and ensure users do not make excessive number of connections."
Proton has also clarified to us that, by default, IPs are not logged (although it is possible to turn on IP logging if you wish). This makes ProtonVPN pretty darn close to being a fully no-logs VPN service.
ProtonVPN is based in Switzerland. On the one hand, this is a country that has famously strong privacy laws, is not subject to EU legislation, and is not a member of the Five Eyes (or even Fourteen Eyes) US-led spying alliance.
On the other hand, Switzerland has passed some alarming new surveillance laws. These require Internet Service Providers (ISPs) and telecoms operators to store detailed metadata connection logs for 12 months. What isn't clear (because the wording of the laws themselves isn't clear) is whether these logging requirements apply to email and VPN services.
A statement by Proton, updated in 2017, says:
“We appreciate that the Swiss government has recognized the leading role that Proton Technologies AG plays in developing the cybersecurity tools of the future, along with the role that we play in the economic re-orientation of Geneva, and Switzerland as a whole towards the high tech sector, and sought a meeting with us to discuss how to ensure both security and privacy in the digital age.
"As a participant in these discussions, we can confirm unequivocally that upon implementation, the provisions regarding data retention introduced by the BÜPF will exempt companies like ProtonMail and ProtonVPN which are not major telecommunications operators.”
This sounds great, and may well indeed be the case. However, it does mean taking Proton’s word on a promise made to it behind closed doors. Whatever the practical implementation of the new laws will be, the letter of the law remains worryingly vague.
ProtonVPN publishes a transparency report and operates a warrant canary. A transparency report is nice, but still requires trust in Proton to report all incidences. We are also a little skeptical about the real value of warrant canaries, but I understand that many people find them reassuring.
According to ProtonMail’s similar transparency report, Proton has complied with a couple of requests for data that weren't backed up with a valid court order. In both cases, the circumstances appear to justify such a decision. It seems that ProtonMail was able to supply very little information anyway.
At the end of the day, using any VPN requires that you trust your VPN provider. ProtonMail has established a formidable reputation in this regard, so there is every reason to believe that ProtonVPN is sincere in its privacy claims.
ProtonVPN now supports both OpenVPN and IKEv2 in its apps. IKEv2 is believed to be a secure VPN protocol but is not as "battle-tested" as OpenVPN is. It is, however, much faster. For the OpenVPN data channel, ProtonVPN uses an AES-256-CBC cipher with HMAC SHA-512 hash authentication.
ProtonVPN now supports both OpenVPN and IKEv2 in its apps. IKEv2 is believed to be a secure VPN protocol but is not as "battle-tested" as OpenVPN. It is, however, much faster. ProtonVPN uses the following OpebVPN settings:
Data channel: AES-256-CBC cipher with HMAC SHA-512 hash authentication.
Control channel: ProtonVPN supports a number of cipher suites, the weakest of which is an AES-256 cipher with RSA-2048 handshake encryption and HMAC SHA-1 hash authentication. Perfect forward secrecy is provided by a Diffie Hellman key exchange, although we do not know the key size used for this).
This is a secure setup and stronger control channel cipher suits are also supported.
Want to know more? Please check out my VPN Encryption Guide.
After ProtonMail, pretty much everyone was expecting something special with ProtonVPN. By-and-large, Proton has delivered. ProtonVPN is a very polished privacy-focused VPN service that is secure and very fast when connected to a nearby server.
The Secure Core network is not quite as innovative as ProtonVPN would have us believe but is nevertheless very well executed. We are impressed by how little impact jumping through an extra VPN server has on speed performance.
At present, ProtonVPN doesn't offer any obfuscation technology to evade VPN blocks. It is, however, is an excellent and highly competitive premium VPN service. Free users are limited to just three server locations, but with no data limits and speed results that are better than most paid-for services, this may be all many VPN ever need!