How to choose a VPN
Pick from the facts a provider publishes about itself. A table of stars would only hide which fact you actually needed.
Jurisdiction
Jurisdiction is the country whose laws and courts the company answers to. Providers state it on an about page or a support article. Among the five on our compare page, the published answers are Panama for NordVPN (their parent company, Nord Security, is in the Netherlands), the British Virgin Islands for ExpressVPN, the Netherlands for Surfshark, Romania for CyberGhost, and Switzerland for Proton VPN.
A country is one fact. It tells you which rulebook applies if a court asks the company for data. It is not a score, and a privacy-friendly law does not by itself prove the product keeps its promises.
Logging policy and independent audits
A logging policy says what the company records about your use: connection times, addresses, bandwidth, or the sites you open. "No logs" means they claim not to keep records that could reconstruct your activity. Read the policy for the nouns. A page that says "we don't log" and then lists connection timestamps is telling you both things.
An independent audit is a report from an outside firm the company hired to test some part of that claim: the apps, the server setup, or the logging systems. Read the date and the scope. An audit from several years ago does not describe the product after later changes, and an audit of the apps is not an audit of the logging systems.
Protocols
A protocol is the method the app uses to build the tunnel. The names you will see most often are WireGuard, OpenVPN, and IKEv2. Some companies add their own, built on one of those: NordVPN publishes NordLynx, ExpressVPN publishes Lightway. The provider's download or features page lists what their apps include.
WireGuard is the usual default in current apps because it is simpler and often quicker to connect. OpenVPN is older and still widely supported, including on routers. If one protocol will not connect on a locked-down network, switching to another inside the app is a reasonable first try. A protocol that wins a lab test is not a promise about your home connection.
Device support
Device support is the list of systems with an app or a setup guide: Windows, macOS, Linux, Android, iPhone, a router, a TV. Check your actual devices, including the odd one. A TV or a game console often has no app and needs the VPN on the router instead. Router setup counts against the simultaneous-device cap at some providers and not in the way people expect, so read that note on their site if the router matters to you.
Simultaneous devices
This number is how many devices can be connected at the same time on one subscription. It is separate from how many devices you may install the app on. A plan that allows 10 connections will refuse an 11th until you disconnect one. The compare page lists the published cap for each of the five providers. ExpressVPN's cap depends on the plan you buy.
Money-back guarantee
A money-back guarantee is a published number of days during which you can ask for a refund of the first purchase. Read the exceptions on the same page. They usually include: first purchase only, renewals excluded, and app-store purchases handled by Apple or Google rather than the VPN company. CyberGhost publishes two windows, depending on the length of the plan. If you are buying to answer one question, such as whether a streaming service works, ask for the refund inside the window if the answer is no.
Price
VPN prices move, and the same plan can show a different intro rate by country. The figure in large type is often a per-month split of a long plan that you pay up front. Find the renewal price next to it. That is the amount the plan charges when the first term ends. Monthly plans cost more per month and are easier to leave. We do not print prices here, because a number copied onto this page would go stale.
A way to decide
Write down the two things you actually need, for example iPhone plus a Windows laptop, or a refund long enough to test one streaming service. Check those rows on the compare page, then open the provider's site and confirm the row still matches. Stop there. You do not need a winner across every column.