Douglas Crawford

Douglas Crawford

June 14, 2018

The mark of a good VPN is that it uses strong technical security to keep you safe on the internet. This means that it uses strong encryption, does not leak your real IP address to websites that you visit, and that that it provides a kill switch to prevent accidental exposure of your details.

Before looking in detail at these aspects of VPN security, let’s first check out which VPNs our experts agree are best for technical security, and why…

And here is a more detailed look.

Best Secure VPN Services: Summary

Editor's Choice Award

Private Internet Access

4.9/5

  • ProsPROS
  • No logs – proven in court!
  • Cheap
  • Accepts Bitcoin
  • Great OpenVPN encryption
  • Client features kill switch and full DNS leak protection
  • ConsCONS
  • No free trial or money back guarantee
  • US-based company
  • Apple users not so impressed

PIA is based in the US, so is not a provider for the more NSA-phobic out there. However, it keeps no logs, which is a claim that it proved in court! And although optional, its security can be first rate.

OpenVPN Encryption
Cipher
AES-256-CBC
Data hash auth
HMAC SHA256
Control hash auth
HMAC SHA356
Handshake
RSA-4096
Forward Secrecy
DHE
Logs & Legal
Connection
none
Traffic
None
Country
US

At maximum settings, OpenVPN encryption uses an AES-256 cipher with HMAC SHA256 for authorization and an RSA 4096 handshake for the data channel, and an AES-256 cipher with HMAC SHA384 authentication for the control channel. Perfect Forward Secrecy is delivered with a Diffie Hellman exchange (DHE)  for RSA handshakes (or ECDHE+ECDSA for ECC handshakes).

PIA’s desktop software supports multiple security options, a kill switch, DNS leak protection, and port forwarding. Up to 5 simultaneous connections are permitted. Its Android client is almost as good, and PIA boasts excellent connection speeds. PIA has servers located in 29 other countries.


2nd Place

NordVPN

4.8/5

  • ProsPROS
  • No logs
  • Based in Panama (great for privacy)
  • Six simultaneous connections
  • Great customer service
  • Servers in 58 countries
  • P2P: yes
  • ConsCONS
  • Not much

NordVPN is undoubtedly a very fully-featured service. The fact that it is based in Panama and keeps    no logs at all is also a big draw for those who care about privacy. Its software looks good, and works well.    Speed performance is now very impressive. NordVPN uses the following OpenVPN settings:

Data channel: an AES-256-CBC cipher with HMAC SHA256 hash authentication.

Control channel: an AES-256-CBC cipher with an RSA-2048 handshake and HMAC SHA256 data authentication. Perfect Forward Secrecy (PFS) is provided by a DHE-4096 key exchange.

OpenVPN Encryption
Cipher
AES-256-CBC
Data Auth
HMAC SHA256
Handshake
RSA-2048
Forward Secrecy
DHE-4096
Logs & Legal
Connection
None
Traffic
None
Country
Panama

And a three-day free trial, plus a    30-day money-back guarantee give you plenty of opportunity to ensure that everything works for you as it should.

NordVPN permits torrenting, works with    all major streaming services (including US Netflix and BBC iPlayer), and has servers in 58 countries. It even throws in a full smart DNS service for free! What you get with NordVPN is a very fully featured, privacy-friendly VPN service that is also very fast.


3rd Place

CyberGhost

4.8/5

  • ProsPROS
  • More than 800 servers & global coverage
  • Use up to 5 devices at once
  • Accepts Bitcoin
  • No logs policy
  • Guaranteed security and encryption
  • ConsCONS
  • Limited customer support
  • New service (less established)
  • Based in Canada

CyberGhost‘s software is easy-to-use while also being very fully featured. It uses very strong encryption, and 5 simultaneous connections is generous. Being based in Romania and keeping no meaningful logs is also a big draw.

CyberGhost’s great logging policy, decent local (burst) speeds, and fully featured software are a winning combination. And with a 7-day free premium trial plus 30-day no-quibble money back guarantee, there is zero reason not to give it a whirl.

OpenVPN Encryption
Cipher
AES-256 CBC
Data Auth
HMAC SHA256
Handshake
RSA-4096
Control Auth
HMAC SHA384
Forward Secrecy
ECDH-4096
Logs & Legal
Connection
None
Traffic
None
Country
Good

The OpenVPN encryption used by CyberGhost is as strong as it gets. Data channel used an AES-256-CBC cipher with SHA256 hash authentication and Control channel uses an AES-256 cipher, RSA-4096 key encryption and SHA384 hash authentication. Perfect forward secrecy is provided by an ECDH-4096 key exchange.

CyberGhost‘s software is easy-to-use while also being very fully featured. It uses very strong encryption, and   5 simultaneous connections is generous. Being based in Romania and keeping no meaningful logs is also a big draw. Like ExpressVPN, some minimal statistics are kept, but with no time stamp or IPs recorded, these present no threat to users’ privacy.

CyberGhost’s great logging policy, decent local (burst) speeds, and fully featured software are a winning combination. And with a 7-day free premium trial plus 30-day no-quibble money back guarantee, there is zero reason not to give it a whirl.


4th Place

ExpressVPN

4.7/5

Best Secure VPN Services

  • ProsPROS
  • 30-day money-back guarantee
  • No meaningful logs
  • Servers in 94 countries
  • Great customer service
  • Superb OpenVPN encryption
  • ConsCONS
  • A bit pricey

ExpressVPN’s focus on providing a great customer-focused experience has always impressed us. Central to this is 24/7 live chat support, a genuinely no-quibbles 30-day money-back guarantee, and easy-to-use apps for all major platforms.

OpenVPN Encryption
Cipher
AES-256
Data Auth
HMAC SHA-512
Handshake
RSA-4096
Forward Secrecy
ECDH
Logs & Legal
Connection
minimal
Traffic
None
Country
BVI

ExpressVPN matches this with truly excellent technical security. It uses an AES-256 cipher with RSA-4096 handshake and SHA-512 HMAC hash authentication. Perfect forward secrecy is provided courtesy of Elliptic Curve Diffie–Hellman (ECDH) key exchanges for data channel encryption.

This is great. In addition, unlike most iOS apps, the ExpressVPN iOS app uses OpenVPN. Add in full Domain Name System (DNS) leak and Web Real-Time Communication (WebRTC) leak protection, along with a firewall-based kill switch, and it is clear that ExpressVPN offers exceptional VPN security.

Additional features: three simultaneous connections, “stealth” servers in Hong Kong, free Smart DNS, .onion web address.

Visit ExpressVPN »

30-day money-back guarantee

5th place

AirVPN

4.3/5

AirVPN

  • ProsPROS
  • No logs at all
  • VPN through Tor
  • SSL and SSH tunneling
  • Accepts Bitcoin
  • Peer-to-peer (P2P): yes
  • ConsCONS
  • Very techy
  • Customer support could be better

AirVPN is at the top of the game when it comes fast, secure VPN technology, but its tech-heavy focus and rather brusque support manner alienates many would-be users.

OpenVPN Encryption
Cipher
AES-256
Data Auth
HMAC SHA1
Handshake
RSA-4096
Control Auth
HMAC SHA384
Forward Secrecy
DHE-4096
Logs & Legal
Connection
None
Traffic
None
Country
Italy

OpenVPN uses AES-256 with RSA-4096 handshake, HMAC SHA1 data channel authentication, HMAC SHA384 control authentication, and DHE-4096 for perfect forward secrecy. It allows users to connect completely anonymously to its servers via the Tor network, and can hide OpenVPN communications inside a Secure Shell (SSH) and Secure Sockets Layer (SSL) tunnel.

The open source desktop client disables IPv6, and its “network lock” feature acts as a kill switch and prevents DNS leaks. WebRTC leaks are blocked by both the network lock function and at the server level. This protects users from WebRTC leaks, even when using the generic OpenVPN app. Furthermore, AirVPN runs its own bare metal servers.

Additional features: real-time user and server statistics, three-day free trial, three simultaneous connections.

Visit AirVPN »


Note that this article is aimed at more advanced VPN users and assumes that you have some understanding of what VPNs are and what they can do. If you don’t, then worry not! Please check out our excellent VPNs for Beginners guide for a comprehensive introduction to this subject.

Encryption and VPN protocols

Below is a summary, but for a much more detailed (but accessible) look at this subject, please check out VPN Encryption: The Complete Guide.

A VPN encrypts your data as it travels between your device and a VPN server. In theory, this means that no-one can see it. but not all encryption is created equal.

In order to connect securely, VPN software on your device negotiates an encrypted connection with the VPN server. The mechanism used to do this is called the VPN protocol, which uses a suite of authentication and encryption algorithms to ensure the connection is secure.

VPN protocols

The only VPN protocols you are likely to encounter are:

PPTP

A widely supported VPN protocol that is no longer considered secure. There is very little to reason to use it these days, and it should therefore be avoided.

L2TP(/IPsec)

A widely supported protocol. It’s not secure against the NSA but is suitable for general use. That said, why bother when IKEv2 and OpenVPN are available?

IKEv2

A new standard that is fast and is widely considered very secure. Because of this, it is quickly gaining popularity with VPN services, but it is not mature or been battle-tested in the way that OpenVPN has.

Mobile users, in particular, may prefer IKEv2 thanks to its improved ability to reconnect when an internet connection is interrupted (such as when switching between networks or between WiFi and mobile connections).

OpenVPN

An open source protocol that is widely regarded as the most secure and versatile VPN protocol available. We generally always recommend using OpenVPN whenever possible (although IKEv2 is also a good option).

Our OpenVPN wncryption tables

When assessing the encryption used by VPN providers we focus on OpenVPN encryption. This is because:

  1. OpenVPN is the only VPN protocol we know to be fully secure. IKEv2 is also considered secure, but this is largely theoretical.
  2. Just about every VPN service offers OpenVPN. This allows us to compare like for like across VPNs.
  3. The care a provider takes over the details of its OpenVPN encryption is a strong indicator of the care it takes over security in general. And with OpenVPN, the devil is in the detail!
OpenVPN Encryption
Cipher
AES-256-CGM
Control hash auth
HMAC SHA-1
Handshake
RSA-4096
Forward Secrecy
DHE-4096
Logs & Legal
Connection
none
Traffic
None
Country
Sweden

We do not expect readers to understand complex cryptographic terminology. We have therefore developed simple “traffic light” table that aims to convey all the information you need to know without dumbing the subject down.

The table breaks up all elements that make up the OpenVPN protocol into their component parts and then rates them on how cryptographically secure they are. A red light means the element is not secure, a green light means the element is secure, and a star means the element is more secure than is strictly necessary.

If all lights are at least green, the OpenVPN encryption is good. Stars mean the encryption is future-proofed.

If you do want to more fully understand all the terms used and their significance, they are explained in VPN Encryption: The Complete Guide.

How important is strong encryption for VPNs really?

The care a VPN provider takes over its encryption is a strong indicator of how good it is. After all, why should we trust a provider who is lazy or incompetent when it comes to getting such a key aspect of its service right?

Strong encryption should defeat any and all attempts to decrypt your data. If you are an individual target of particular interest to the authorities, theywill subpoena your VPN provider for any logs long before they think about trying to decrypt your data. This is why the jurisdiction a VPN service operates under and the logs it keeps are more important for your privacy than the encryption it uses.

For full discussion on this subject, please see 5 Best No logs VPNs.

IP leaks

The second key element to a VPN’s technical security is ensuring that no IP leaks occur. When using a VPN, no website you visit should be able to see your real IP address, or one belonging to your ISP that can be traced back to you.

But it happens. And when it does, we call it an IP leak. When you first sign-up for a VPN service you should visit ipleak.net before and after connecting to the VPN. You should also do this every now and again when using the service.

If you see any of the same IP addresses before and after then you have an IP leak (you can ignore Private Use RFC IPs, as these are local IPs only. They cannot be used to identify an individual, and so do not constitute an IP leak).

The example above shows a bad case of IPv6 leaks. The IPv4 DNS result correctly shows that I am connected to a VPN server in the US, but the website can see my real UK IPv6 address via both a regular DNS leak and WebRTC. Fail!

A note on WebRTC

WebRTC leaks are a browser “feature,” and so are not really the fault of VPN services. They are also hard for VPN providers to prevent, as most fixes work at the browser level (manually disabling WebRTC or using a browser add-on to contain leaks).

But it can be done using sophisticated firewall rules. We understand that fixing the WebRTC issue is not easy, but in our opinion, a VPN service should never allow its users to access the internet thinking their IP address is hidden when it isn’t.

For an in-depth look at IP leaks, including our own guide to preventing WebRTC leaks, please check out A Complete Guide to IP Leaks. Needless to say, none of the providers listed in this article showed any signs of IP leaks when we tested them.

Kill switches

For various reasons, VPN connections sometimes drop, and this can happen to even the best VPN. A good VPN provider, however, ensures that if and when this happens you will not continue connecting to the internet and exposing your real IP address for all the world to see.

Kill switches shut down your internet connection when your VPN is not connected. They can be either reactive or firewall based. Reactive kill switches detect that the connection to the VPN server has dropped, then shut down your internet connection to prevent leaks.

There is a danger, however, that an IP leak could occur during the micro-seconds it takes to detect the VPN dropout and to shut down your internet connection.

Firewall-based kill switches solve this problem by simply routing all internet connections through the VPN interface. If the VPN is not running then no traffic can enter or leave your device. Firewall-based kill-switches are therefore better than reactive ones, but any kill switch is better than none!

Now… firewall based kill switches themselves come in two types. The first kind is implemented in the client, and will therefore not work if the client crashes. The second kind modifies the Windows or macOS firewall rules so that even if the VPN software crashes, traffic will not be able to enter or exit your device.

The only problem with method this is that it could, at least in theory, cause conflicts if you use a third-party firewall.

Conclusion

Strong technical security is the mark of a good VPN. Lapses in security are a serious dereliction of duty on the part of a VPN provider.

A great deal of digital ink is expended on the subject of VPN encryption (much of it misleading). Strong encryption is important (why would you chose a provider that uses weak encryption?), but when it comes to privacy, being a ‘no logs’ provider is arguably just as vital.

Douglas Crawford
June 14th, 2018

I am a freelance writer, technology enthusiast, and lover of life who enjoys spinning words and sharing knowledge for a living. You can now follow me on Twitter - @douglasjcrawf.

15 responses to “5 Most Secure VPN Services 2018

  1. Hi Douglas & notsosafe,

    ExpressVPN is more secure(with better enryption?) than AirVPN? Do they offer unique OpenVPN certs/keys as well? Should I cancel/ditch AirVPN for ExpressVPN?

    notsosafe what VPN do you use?

    Thanks.

    1. Hi hmmmmm,

      ExpressVPN now offers slightly stronger encryption than AirVPN (stronger SHA hash authentication), although both are so strong that it really makes little difference. Be aware that ExpressVPN does keep some very connection minimal logs. With regard to shared OpenVPN certificates, I have changed my mind since I wrote these comments last September. A lengthy discussion with the guys at IVPN has convinced that use of shared certs is not a problem, and is, in fact, better for privacy than unique certs. A summary of IVPNs argument can be found here. Please note, however, that pre-shared keys _are_ a problem when it comes to L2TP/IPec.

  2. The user id is irrelevant, these companies will give one to anybody on this planet that throws money at them. It merely grants one access to the backbone, it’s what happens on that backbone, after they gain access.

    We came here to make people aware that these networks are not as secure as the public is lead to believe. Their network designs are inferior and they know it. If a key is shared, the tunnels have glass walls to an experienced user/organization. We will point you in the direction of a secure (real) vpn provider and invite you to do your own research.

    Have a nice day!

Leave a Reply

Your email address will not be published. Required fields are marked *