The renewal charge is the one that hurts. You buy a VPN at $2.49 or $3.49 or $4.49 a month, you forget about it, and twelve or twenty-seven months later your card is charged an amount you never agreed to in any meaningful sense. On TechRadar’s figures (published 28 July 2026, page read 17 September 2026), the renewal price of a 1-year plan is between 1.3x and 2.6x the first-term price: ExpressVPN 1.34x, Surfshark 1.55x, Proton VPN 1.75x, NordVPN 2.58x. That is the single most reliable prediction anyone can make about this category.
The second thing that hurts is discovering the refund policy does not apply to that charge. TechRadar’s summary is blunt: “30-day money-back guarantees often only apply to first-time purchases and are void during certain promotional offers.” Surfshark’s Terms of Service say it in the company’s own words — “the 30-day money-back guarantee applies only to the initial purchase; all recurring payments are non-refundable” (read 17 September 2026). NordVPN’s support article says a renewal payment “is not refundable”. ExpressVPN’s Terms say the guarantee “applies to new Subscribers only” and excludes “renewal purchases”. So the expensive charge is also the uncancellable one, and TechRadar notes that “many VPN providers trigger automatic renewal charges 7 to 14 days before your subscription technically expires.”
Then there is the thing you actually bought it for. TechRadar’s analysis of nearly 30,000 Google Play reviews found billing and pricing drew roughly 60% negative sentiment, versus 41% for privacy and security comments and 35% across the dataset as a whole. Privacy and security scepticism is not hypothetical either: in 2021, Consumer Reports found that “12 out of 16 of the VPNs we looked at either inaccurately represented their products and technology, or made hyperbolic or overly broad claims”, and that “Half of the VPNs we looked at did not have current, publicly available third-party security audits.”
This comparison ranks five paid VPNs on what they log, what they charge you the second time, and whether the thing works on a hotel Wi-Fi network at 11pm. Ownership matters here too and we say so where it applies: Surfshark and Nord Security merged under one holding company in 2022, and Kape Technologies — formerly Crossrider, delisted from the London Stock Exchange in May 2023 and taken private by Unikmind Holdings, owned by Teddy Sagi — owns ExpressVPN, CyberGhost, Private Internet Access and ZenMate. Every price below was re-read on 17 September 2026 on the US/USD storefront. Re-check before you buy.
Mullvad’s homepage, captured 17 September 2026. It is the only provider here whose advertised price is also its renewal price.
1. Why VPN Buyers Get Burned (In Their Own Words)
The advertised price is an introductory price, and the gap is enormous. NordVPN’s 2-year Complete plan advertises $4.49/month and renews at $219.48 a year, which is $18.29 a month, 4.1x the advertised rate (nordvpn.com/pricing, 17 September 2026). ExpressVPN Basic runs $83.72 for 28 months then $99.95 a year, a jump from $2.99 to $8.33 a month.
“billed 184,35 euros for a one year subscription, almost double of what I was paying” — 1-star Trustpilot reviewer, NordVPN, 13 September 2026
“Of course every time they renewed my subscription they used old prices and never told me about it.” — a Play Store review of ExpressVPN quoted by TechRadar, 28 July 2026
Nobody tells you clearly, and some providers do not publish the renewal figure at all. Surfshark advertises $2.49/month and says only that after two years “you will be charged the applicable renewal price” — no dollar figure appears on any Surfshark page we could read.
“There was no prior notice of the renewal, and the new fee is 60% higher” — 1-star Trustpilot reviewer, NordVPN, 28 August 2026
“SurfShark charged me without any notice” — 1-star Trustpilot reviewer, Surfshark, 7 September 2026
Cancelling stops the next charge but does not undo the last one. Surfshark’s help centre states plainly that “Cancelling your subscription’s auto-renewal does not automatically grant a refund”. Proton goes further: its terms say “If you do not want your plan to renew, you need to downgrade your plan before the end of your subscription period” — there is no simple cancel action.
“refused to refund me for what was nearly 10 months left” — 1-star Trustpilot reviewer, Surfshark, 15 September 2026
“I canceled in June 2023 and they are still billing me today.” — 1-star Trustpilot reviewer, ExpressVPN, 3 August 2026
The VPN breaks the sites you need, and you end up turning it off. Netflix’s own help page (read 17 September 2026) returns “You seem to be using a VPN or proxy. Please turn off any of these services and try again,” and states VPNs are not supported for Live events or on its ad-supported experience. Banking sites are the other common casualty.
“Almost every day I’ll have to turn off VPN to visit a banking site or someplace online.” — 4-star Trustpilot reviewer, ExpressVPN, 15 September 2026
“With their recent updates, many of the websites I use — and even one of my email accounts — will not work while I’m supposedly ‘secured.’” — 3-star Trustpilot reviewer, NordVPN, 16 September 2026
On flaky networks — hotels, airports, trains — the connection is the product, and it drops. This is the failure mode that matters most for working from untrusted Wi-Fi, because a tunnel that silently fails is worse than no tunnel at all.
“Should have kept ExpressVPN, Nord only works when it wants to. on a slower wifi connection it takes forever to connect, sometimes it doesnt connect at all. I enter an elevator, lose internet, reconnect to the wifi and it shows protected but it isn’t, still shows my company portal.” — Google Play reviewer, NordVPN, 1 September 2026
“Constant disconnects across 7 devices, different network connections, and 5 different physical locations” — 1-star Trustpilot reviewer, Surfshark, 15 September 2026
Support is templated, and there is no phone number. Trustpilot records that NordVPN “Replied to 99% of negative reviews” and “Typically replies within 24 hours”, which is genuinely good practice — but reply volume is not resolution.
“Email support sends generic nonsense” — 1-star Trustpilot reviewer, ExpressVPN, 8 September 2026
“EIGHT days goes by and NO support, NO recommendations.” — 1-star Trustpilot reviewer, Proton VPN, 27 August 2026
2. How We Ranked Them
Seven criteria, weighted: capability depth (2x), value for money (1.5x), billing fairness (1.5x), trust and security (1x), ease of getting started (1x), free tier (0.75x) and support and docs (0.75x).
Billing fairness carries the same weight as value for money on purpose. A cheap first term attached to an opaque renewal is not value. Under billing fairness we score whether the renewal price is published in the vendor’s own currency on the vendor’s own page, whether the refund guarantee covers renewals, and whether auto-renewal is default-on. Trust and security scores only what an independent third party has verified: we name the auditor, the report date and the scope, and we never treat a vendor’s own claim, an industry-body membership or a self-administered trust seal as an audit. Where a product is technically strong but scores badly overall, we say which criterion did the damage.
Every price, rating, review count and quoted policy line in this article was re-read on 17 September 2026 on the US/USD storefront. VPN pricing is localised by IP and moves during campaigns; Trustpilot counts move daily. Treat every number here as a dated snapshot.
3. Mullvad: The price you see is the price you renew at
Mullvad charges one flat rate for every billing term, and signup requires no email, username or password.
Mullvad wins because it removed the mechanisms the other four get complaints about. There is exactly one plan at EUR 5 per month, and the billing periods offered — one month, one year, one decade — all cost the same per month. The pricing page says: “It’s one flat monthly rate for ultimate flexibility.” There is no discounted first term, so there is no renewal uplift, and no auto-renewal or cancellation clause appears anywhere in the Terms of Service. An account holds prepaid time. When it runs out, it runs out. TechRadar records that Mullvad “axed all recurring subscriptions in 2022 to better preserve users’ privacy.”
Signup requires no email, no username and no password: one click generates an account number, and that number plus the time remaining on it is what Mullvad’s no-logging policy says the account consists of. Payment can be cash in an envelope (EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD, NZD), Monero, Bitcoin, card, PayPal, Swish and several European bank rails, with a standing 10% discount for cryptocurrency. Asked whether it runs sales, the pricing page answers: “Nope. Not for Christmas or any other holiday or event that you can think of.” That structure was stress-tested: per Wikipedia, on 18 April 2023 Swedish police arrived at Mullvad’s Gothenburg office with a search warrant for customer data and left with nothing after Mullvad demonstrated none existed.
The audit trail is recent and frequent — a 2026 Android app security assessment by Leviathan Security Group (1 June 2026), a GotaTun audit by Assured (6 March 2026), an X41 D-Sec audit of account and payment services (21 January 2026), a web app audit by Assured (October 2025), an NCC Group Android assessment (March 2025) and Cure53’s fourth infrastructure audit (June 2024). No formal security certification was found on any first-party page; Mullvad’s Google MASA result is an assessment that resulted in a pass, not a certification. Data is processed in the EU/EEA only. There is no liability cap in the Terms, only an as-is disclaimer.
Now the costs. There is no free tier and no free trial, the 14-day money-back guarantee excludes cash, crypto, App Store purchases and vouchers and must be requested by email with proof, and the device cap is a hard five with no seats, no admin console and no business plan. Port forwarding was removed in 2023. OpenVPN was removed from the app, with the changelog recording a 15 January 2026 deprecation, so legacy routers that only speak OpenVPN are out. Mullvad makes no streaming-unblocking claim anywhere and publishes help articles titled “Watching Netflix with split tunneling” and “Playing games on Steam with split tunneling” — the documented approach is to route streaming outside the tunnel. And in July 2026 co-founder and co-owner Daniel Berntsson personally donated SEK 5 million (£385,000, $519,000) to the Swedish populist party Örebropartiet, reported by The Register on 21 July 2026; Mullvad’s own statement says “It was a private donation from Daniel the individual” and that the company “does not condone it, nor condemn it. It most likely was a bad idea.” Neither Mullvad’s statement nor The Register’s report mentions any refund or exit offer. A 695-point Hacker News thread followed. One customer’s reaction: “What you seem to be missing in your comment, is that some of that money I paid, found its way to support an organisation that has extreme racist views.”
The Good (Pros)
The Bad (Cons)
#1 · Price you see is the price you renew at
Flat 5 euros a month, no discounted first term
No email at signup, cash and Monero accepted, and a 2023 police search that obtained no customer data. It makes no streaming claim and caps you at five devices.
Visit Mullvad
4. Proton VPN: The best privacy evidence, attached to a 55.7% renewal jump
Proton publishes a downloadable no-logs audit naming its auditors, alongside a transparency report showing 59 of 59 law-enforcement orders denied in 2025.
Proton VPN publishes the most legible privacy evidence in this group. The 2025 no-logs audit is a downloadable PDF that names its auditors — Martin Matyja and Maciej Szymczak of Securitum, Zürich — and describes “six person-days of focused technical evaluation” on site from 18 to 20 August 2025. Its conclusion: “Securitum attests that the Proton VPN service, as configured at the time of the audit, fully complies with the privacy commitments outlined in its No-Logs policy.” Four annual audits are independently verifiable (2022-2025), with Proton stating a fifth was completed in 2026. The real-world corroboration is stronger still: Proton’s transparency report (last modified 6 January 2026) records 59 total legal orders for Proton VPN in 2025 and 59 denied. Do not confuse that with Proton Mail, which reports 9,301 orders received and 8,313 complied with for the same year — different service, different technical capabilities.
Read the audit’s own caveats. Securitum states it was “a guided review process, where Securitum auditors observed live systems as demonstrated by Proton’s senior engineers”, conducted on “a representative sample of production servers”, and explicitly excluded the CI/CD pipeline, source code review, binary analysis and “ancillary Proton systems, such as accounting or account management platforms”. That last exclusion matters, because Proton’s general account privacy policy says “IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service” — the account layer the VPN audit did not cover. Proton also runs on bare-metal servers it owns outright and publicly argues against RAM-only servers, a documented design tradeoff rivals market against.
The free tier is the best in this comparison and the reason Proton’s free-tier score is unmatched: no credit card required, unlimited data, one device, servers in 10 randomly selected countries, and on Android no account at all. Securitum documented the one exception — free servers perform live, on-the-fly identification of BitTorrent traffic to block it, with nothing written to persistent storage.
The billing is where it falls short of Mullvad. VPN Plus is advertised at $4.49/month and disclosed, in Proton’s own words, as “Billed at $53.88 for the first 12 months, then renews at $83.88 every 12 months” — a 55.7% jump to an effective $6.99/month. The 2-year deal at $3.49/month lands on the identical $83.88 renewal. Proton Unlimited is the honest one: $119.88 first year, $119.88 on renewal. The 30-day refund window runs from the initial purchase and, verbatim, “Refunds can only be requested once per user”, with cash and bank transfer payments non-refundable and a clause stating that relying on a chargeback waives your refund right. And the reputational number is ugly: Trustpilot shows 2.2 out of 5 from 990 reviews, against 4.7 from 1.31M on Google Play and 4.6 from 107K on the App Store. Trustpilot’s own summary of 200 recent reviews says customers “frequently complain about extremely slow connection speeds, constant video buffering, and unexpected technical disconnections” — this is not purely a billing artefact.
The Good (Pros)
The Bad (Cons)
#2 · Best privacy evidence
A named, downloadable no-logs audit and a free tier with no data cap
Fully open-source clients on hardware Proton owns, under a Swiss non-profit foundation. VPN Plus renews at $83.88 a year after a $53.88 first term.
Visit Proton VPN
5. NordVPN: Six no-logs audits, and the worst renewal multiple we measured
NordVPN has been independently audited six times, most recently by Deloitte Lithuania under ISAE 3000 in late 2025.
On capability and audit pedigree NordVPN is near the top. Its no-logs policy has been independently verified six times, most recently by Deloitte Lithuania in a reasonable assurance engagement under ISAE 3000 (Revised) conducted between 10 November and 12 December 2025, with the report issued 12 December 2025 and scope covering standard VPN, Double VPN, obfuscated servers and Onion Over VPN. The no-logs promise is written into the contract, not just the marketing: the Additional Terms state Nord “guarantees a strict no-logs policy”. Servers are RAM-only, the Linux client (CLI and GUI) is open source, and the Windows app ships roughly every two weeks — 8.11 on 10 September 2026, 8.10 on 27 August, 8.9 on 13 August.
Three caveats on that record. The audit report is not public: “Because of the technical nature of the report, we don’t publish excerpts publicly. Users can read the full report by logging in to their Nord Account” — you cannot read the evidence before paying. NordVPN holds no security certification it publicises; the words “ISO 27001”, “SOC 2” and “certified” do not appear on its Trust Center, and an ISAE 3000 attestation and a self-administered VPN Trust Seal are not certifications. And NordVPN’s own self-reporting is stale: on 17 September 2026 its servers page still said the policy “has been audited and approved four times”, its Trust Center implied five and its February 2026 blog post said six. Three live pages, three numbers.
The pricing is why it ranks third. The 2-year Complete plan advertises $4.49/month, bills $121.23 for 27 months, and then renews at $219.48 a year — $18.29 a month, 4.1x the advertised rate. Basic renews at $139.08 (3.3x), Complete Max at $301.08 (3.9x). A 2-year plan does not renew at the 2-year rate; it converts to a 1-year subscription at full annual price. The struck-through “savings” are not prices anyone paid: NordVPN’s own footnote defines them as the annual renewal rate projected across the intro term, so “Save 75%” is a discount against a future price. The card is charged “up to 14 days before the renewal” per the pricing footnote, while NordVPN’s public Trustpilot replies say a notice email goes out 30 days ahead. And the money-back guarantee, per NordVPN’s support article, “applies only to your initial subscription purchase. Once your subscription renews, it’s no longer eligible for a refund.” App Store purchases are outside Nord’s refund process entirely.
Two more things buyers miss. Complete Max costs $81.60 more per year than Complete and buys exactly one extra feature, Dedicated IP — which is also the feature that weakens your anonymity, because the Privacy Notice admits “if you purchase a dedicated IP address, your email and information related to your account will be linked to that IP address.” And consumer plans contractually prohibit business use: the Terms require you to represent that you are “acting as a consumer and not on behalf of … any business, trade, profession, or other commercial activity”. For balance, a NordVPN spokesperson told TechRadar: “Our auto-renewal practices are clear and straightforward. We are and always have been very clear about the recurring nature of our services, and we also send charge reminders to customers with long-term recurring subscriptions.”
The Good (Pros)
The Bad (Cons)
#3 · Longest audit record
Six independent no-logs audits, the latest by Deloitte
RAM-only servers, an open-source Linux client and the no-logs promise written into the contract. Terms renew at $139.08 to $301.08 a year, and renewals are not refundable.
Visit NordVPN
6. Surfshark: Unlimited devices, undisclosed renewal price
Surfshark writes unlimited simultaneous connections into its Terms of Service rather than only its marketing.
Surfshark’s headline strength is real and contractual rather than promotional. Its Terms of Service call unlimited simultaneous connections “one of the core premises of Surfshark”, with two qualifications: Antivirus is capped at five simultaneous connections, and a fair usage policy reserves the right to act against abuse. That applies on the cheapest tier. Starter is one up-front charge of $67.23 covering 27 months at an advertised $2.49/month, which covers an entire household’s laptops, phones, routers and TVs with no seat counting. There is no bandwidth meter either: Surfshark’s FAQ states it “does not apply any speed, data, or bandwidth limitations, although VPN encryption can cause up to 20-30% decrease in speeds.”
The privacy record is decent without being the strongest here. Deloitte performed an ISAE 3000 no-logs assurance engagement published 16 June 2025 and updated 26 November 2025, covering standard, static and multiport servers plus configuration and deployment — Surfshark’s second Deloitte engagement after 2023. Cure53 audited the infrastructure and the new Dausos protocol in 2026, and SecuRing ran infrastructure and application assessments in 2025. The only third-party certifications and seals the Trust Center lists are Google MASA for the Android app, AV-Test certification for Surfshark Antivirus (June 2025), and the VPN Trust Initiative seal. ISO 27001 and SOC 2 Type II are not claimed anywhere on it. The privacy policy says connection details including a user ID and/or IP address are held for the duration of a session and “automatically deleted within 15 minutes after your session ends” — a short correlation window, not zero retention. Note also the jurisdiction split: the contracting entity is Surfshark B.V. in Amsterdam, but the Terms are “governed by the laws of the British Virgin Islands”.
The billing is what drops it to fourth, and the specific failure is disclosure. Surfshark publishes no renewal price in dollars on any of its own pages — the pricing page says only that after two years “you will be charged the applicable renewal price”, while also stating “The 2-year plan is billed once at the beginning of your subscription and then annually after it expires.” Security.org, last updated 17 August 2026, puts the renewals at $79/year for Starter, $99 for One and $119 for One+; that is a third-party figure Surfshark does not confirm. Renewal is automatic by default, and the Terms are explicit that “all recurring payments are non-refundable”, with further exclusions for anonymous Dedicated IP, the Alternative Number feature, prepaid and gift cards. The 7-day free trial requires a payment method and caps you at three devices — the one place the unlimited promise does not apply. Liability is capped at what you paid, which can be $67.23. Trustpilot shows 4.3 from 31,310 reviews with 9% at one star, and the recent one-star reviews are dominated by cancellation and refund complaints. A Surfshark spokesperson told TechRadar that “public reviews naturally tend to overrepresent moments of friction.”
The Good (Pros)
The Bad (Cons)
#4 · Unlimited devices, contractually
Every device in the house on one subscription
Unlimited connections written into the Terms, from $67.23 for 27 months. It publishes no dollar renewal price anywhere, and recurring payments are non-refundable.
Visit Surfshark
7. ExpressVPN: The deepest audit trail, and the billing behaviour that is now in court
ExpressVPN publishes 27 audits dated 2018 to 2026 across KPMG, PwC, Cure53, F-Secure and Praetorian.
ExpressVPN publishes more third-party assurance than anyone here: 27 audits dated 2018 to 2026 across KPMG, PwC Switzerland, Cure53, F-Secure and Praetorian. The most recent no-logs engagement was KPMG under ISAE (UK) 3000 Type 1, as of 28 February 2025 and published 25 June 2025, which ExpressVPN says gave “reasonable assurance that our systems functioned as designed”. Type 1 tests control design at a point in time, not operating effectiveness over a period, and Engadget’s reporting confirms it did not stress-test the whole system. TrustedServer, the RAM-only architecture, was audited by Cure53 in May 2022 and covered by KPMG in 2025. The transparency report for January to June 2026 shows 137 government and law enforcement requests, 1,361,382 DMCA requests and 3 warrants, with no user data disclosed. Two precedents back it up: a Turkish server seized in 2016 yielded no logs, and in 2022 ExpressVPN pulled its India servers rather than comply with a data retention directive. It holds ISO/IEC 27001, ISO 9001 and ISO 18295-1 and -2 (scope undisclosed), runs a YesWeHack bug bounty, and is the only provider here with a documented counterexample: a bug in the Windows app between 19 May 2022 and 7 February 2024 — roughly 21 months — exposed the domains visited by split-tunneling users.
The billing is the reason it ranks last despite that record. As of 17 September 2026, expressvpn.com/order shows exactly one billing term: 28 months. Basic is $83.72 then $99.95 a year ($2.99 to $8.33 a month, a 179% increase); Advanced $111.72 then $119.95; Express Pro $167.72 then $199.95 ($5.99 to $16.66 a month). No 1-month or 12-month plan is displayed on the site at all. Auto-renewal is on by default per the Terms. The 30-day guarantee “applies to new Subscribers only” and excludes “renewal purchases”, and ExpressVPN’s own support pages add that it is “for first-time users only” and that in-app purchasers through Google Play or the App Store “do not have access to the ExpressVPN 30-day money-back guarantee”. Trustpilot sits at 4.4 from 29,017 reviews, with 7% at one star clustering on exactly this behaviour. On 17 July 2025, Wittels McInturff Palikovic filed a $50 million class action (case 1:25-cv-08121, N.D. Ill.) alleging ExpressVPN “uses deceptive auto-renewal practices to trap consumers into recurring paid subscriptions without providing clear and conspicuous disclosures” and uses “dark patterns”, “confusing interfaces, repeated confirmation requests, and ineffective cancellation mechanisms”. These are allegations that have not been proven in court, and the current procedural status is unknown. ExpressVPN told TechRadar its focus is on making the experience “easier to understand, manage, and resolve when customers need help.”
Ownership is the other thing to weigh. ExpressVPN was acquired by Kape Technologies on 13 September 2021 for $936 million. Kape was formerly Crossrider, whose SDK monetization options, per Wikipedia, “were used by major ad injectors which used man-in-the-browser to change or add advertisements to what users saw”; Kape also owns CyberGhost, Private Internet Access and ZenMate. The highest-scoring Hacker News thread about ExpressVPN is about exactly this: “Who owns Express VPN, Nord, Surfshark? VPN relationships explained”, 673 points, 427 comments. The company also deprecated its own router firmware — asked directly, its page answers “No. ExpressVPN has moved to an app-first approach” — while its setup documentation still lists Asus, Linksys and Netgear router guides.
The Good (Pros)
The Bad (Cons)
#5 · Deepest audit trail
27 published audits, and two real-world tests of the no-logs claim
A 2016 Turkish server seizure that yielded no logs, and withdrawal from India in 2022. The $2.99 rate is a 28-month teaser that becomes $99.95 a year, and renewals are excluded from the guarantee.
Visit ExpressVPN
Scored Comparison Chart
The chart shows a category where capability and billing fairness pull in opposite directions. Mullvad (7.22) and Proton VPN (7.09) sit at the top not because they out-feature the field — they do not — but because billing fairness and value for money together carry 3x weight against capability’s 2x. Mullvad’s flat EUR 5 scores the maximum available on billing fairness simply by having nothing to disclose, and Proton’s free tier is the only one in the group that earns real points on the 0.75x free-tier criterion.
The three products that a pure feature checklist would rank highest all land in the 5.74 to 6.06 band, and in every case the criterion that pushed them down is billing fairness. NordVPN (6.06) has the strongest audit history of any consumer VPN here — six independent no-logs verifications — and the worst renewal multiple we measured, up to 4.1x the advertised monthly rate, on a guarantee its own support article says does not cover renewals. Surfshark (6.00) matches Mullvad on device flexibility and beats it on servers, then loses ground for publishing no renewal price at all. ExpressVPN (5.74) has 27 audits, zero disclosed user records under warrant and the broadest device support, and ranks last because its 179% renewal increase is excluded from its own refund guarantee and is the subject of an unproven class action.
Read the support and trust bars against the reputation numbers rather than instead of them. NordVPN’s Trustpilot 4.2 from 50,450 reviews comes with Trustpilot’s own labels — paid subscription, and “Asks customers to review” — while Proton VPN’s 2.2 from 990 sits beside 4.7 from 1.31M on Google Play. Those two pools measure different populations, and neither settles the question on its own.
Seven criteria, five providers. The three biggest brands score 3 on billing fairness; the two that do not run promotional first terms score 9.5 and 4.
Pros and Cons Matrix: Who Solves Which Pain Point
| Pain point | Mullvad | Proton VPN | NordVPN | Surfshark | ExpressVPN |
|---|---|---|---|---|---|
| Renewal price equals advertised price | ✓ Flat EUR 5 | ✗ 55.7% jump | ✗ Up to 4.1x | ⚠ Not published | ✗ 179% jump |
| Refund covers a renewal charge | ⚠ 14 days, narrow | ✗ Initial purchase only | ✗ Renewals excluded | ✗ Recurring non-refundable | ✗ New subscribers only |
| No auto-renewal surprise | ✓ Prepaid time only | ⚠ Must downgrade | ✗ Charged 14 days early | ⚠ Auto by default | ✗ Auto by default |
| Streaming and site access | ✗ No unblocking claim | ⚠ Mixed user reports | ⚠ Users report breakage | ⚠ Users turn it off | ⚠ Banking sites break |
| Household and team device count | ✗ Hard 5 devices | ⚠ 10, business tiers | ⚠ 10, consumer only | ✓ Unlimited devices | ✓ Up to 14 devices |
| Independent privacy evidence | ✓ Frequent audits, police test | ✓ Named audit, 59/59 denied | ⚠ Six audits, report private | ⚠ Two Deloitte audits | ⚠ 27 audits, past DNS bug |
Pricing at a Glance
| Provider | Free tier | Cheapest paid | Top tier | Trial | Refunds | Rating (reviews) |
|---|---|---|---|---|---|---|
| Mullvad | None | EUR 5/mo flat, all terms | Same single plan | None | 14 days; no cash, crypto, App Store, vouchers | 3.5/5 Trustpilot (187) |
| Proton VPN | Yes, unlimited data, 1 device, no card | VPN Plus $3.49/mo 2yr, renews $83.88/yr | Proton Unlimited $119.88/yr | Free tier acts as trial | 30 days from initial purchase, once per user | 2.2/5 Trustpilot (990); 4.7 Play (1.31M) |
| NordVPN | None | Basic $3.49/mo 27mo, renews $139.08/yr | Complete Max renews $301.08/yr | Limited trial exists, terms unpublished | 30 days, initial purchase only | 4.2/5 Trustpilot (50,450); 4.66 App Store (702,001) |
| Surfshark | None | Starter $67.23/27mo, renewal unpublished | One+ $121.23/27mo | 7 days, card required, 3 devices | 30 days initial only; recurring non-refundable | 4.3/5 Trustpilot (31,310); 4.5 Capterra (61) |
| ExpressVPN | None | Basic $83.72/28mo, renews $99.95/yr | Express Pro renews $199.95/yr | 3 days, iOS and Android only, payment method required | 30 days, new subscribers only | 4.4/5 Trustpilot (29,017); 4.7 App Store (419,000) |
Which One Should You Actually Pick?
Buy Mullvad if privacy is the actual reason you are buying. No email at signup, cash or Monero accepted, one flat EUR 5 whatever term you choose, and a 2023 police visit that produced nothing. The caveat: it will not get you Netflix, and its own help centre tells you to route streaming outside the tunnel.
Buy Proton VPN if you want strong privacy evidence plus a free tier to test on. A named, downloadable Securitum audit, 59 of 59 legal orders denied in 2025, open-source clients, and a free plan with unlimited data and no card. The caveat: VPN Plus renews at $83.88 a year regardless of which promotional term you bought, and its Trustpilot reviewers complain about speed as much as billing.
Buy NordVPN if you want the longest audit record and will diary the renewal date. Six independent no-logs verifications, RAM-only servers, biweekly Windows releases, 10 devices. The caveat: set a calendar reminder for month 26, because the renewal is $139.08 to $301.08 a year and it is not refundable.
Buy Surfshark if you need to cover an entire household on one cheap subscription. Unlimited connections written into the Terms, $67.23 for 27 months, no bandwidth metering. The caveat: you are agreeing to a renewal price the company does not publish anywhere, and every recurring payment is non-refundable.
Buy ExpressVPN if device breadth and audit volume matter more than the second-year price. 27 audits, ISO 27001, zero disclosures under warrant, and apps for Apple TV, Switch, Synology and Quest. The caveat: the 28-month term is the only option on the site, it renews at up to $199.95 a year outside the guarantee, and the auto-renewal behaviour is the subject of an unproven class action.
Final Verdict
Mullvad takes first place by removing the problem rather than managing it. There is no introductory rate to expire, no auto-renewal clause to cancel, no tier to be upsold into, and no identity on file to leak. That is a structural answer to the pain point that produced most of the quotes in section 1, and it is worth more under our weighting than the feature checklist Mullvad conspicuously does not have. It is also, genuinely, the wrong purchase for a lot of people: five devices, no streaming claim, no trial, no team management, and an owner whose July 2026 political donation cost the company customers it has not offered to refund.
Proton VPN is the better default for most buyers who want privacy proof without giving up usability, and the free tier means you can test the tunnel on the networks you actually use before paying anything. But be clear-eyed about the renewal: $53.88 becomes $83.88, and the 2-year deal lands on the same number. NordVPN, Surfshark and ExpressVPN are all capable products with real audit trails, and all three rank below those two for the same reason — the price on the page is not the price you will pay, and the guarantee that makes the purchase feel safe does not extend to the charge that actually stings.
One last thing that applies whichever you choose. Privacy Guides’ advice (read 17 September 2026) is “Don’t rely on a ‘no log’ policy” and warns that “Using a VPN will not keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.” As disclosed in August 2023, the TunnelCrack researchers, testing more than 66 VPNs across five platforms, found that “every VPN product is vulnerable on at least one device”. As disclosed in May 2024, TunnelVision (CVE-2024-3661) showed an attacker who controls the local network’s DHCP server could force traffic off the tunnel while the client still showed as connected. Vendors have shipped patches since, and no re-test was conducted here. A VPN is a tool for a specific threat model, not a security blanket.
Pick Mullvad if: you want the advertised price to be the renewal price, you pay in cash or Monero, five devices is enough, and you accept that streaming is explicitly not part of the deal.
Think twice if: you need Netflix, more than five devices, admin controls for a team, a free trial, OpenVPN for a legacy router, or you object to where the co-owner’s money went in July 2026. In those cases Proton VPN’s free tier is the cheapest way to find out what you actually need.
Disclosure: TrackerTools has no affiliate relationship with any provider in this comparison, and the links above are plain nofollow links. That matters in this category, because most VPN ‘best of’ lists are affiliate-funded and rank by commission. Every price, renewal price, audit, refund term and quotation was verified against the providers’ own pricing pages, terms of service, published audit reports, transparency reports and Trustpilot on 17 September 2026. Screenshots were taken with any element displaying a visitor’s own IP address or ISP removed before capture. The class action referred to in the ExpressVPN section contains allegations that have not been proven in court.
