Ranked on documented facts, not sponsored placement - every provider page shows the evidence.
Short answer: One provider in our ranking needs no account at all - RiseupVPN, donation-funded and install-and-run. The model removes the users table entirely; the tradeoffs are no per-device billing, no recovery, and small networks.
providers on this page: 1 · independent audit on file: 0% · court-proven no-logs: 0 · open-source apps: 100%
quick picks
The most trustworthy free VPN on structural grounds: an anarchist Seattle collective that has run since 1999, funds itself by donations, asks no account registr
1 providers match this filter, and the count is honest about the market: account-free operation is rare because billing models require accounts. RiseupVPN is the working example - install, connect, donate if you can[1]. The subpoena drawer is empty by construction: there is no user to identify because no user record exists.
Between "full KYC" and "no account at all" sit three rungs. Email-only signup: a contactable identifier, the market default. The account number (Mullvad): a credential with no identity attached, billed via crypto, cash or voucher[2]. Install-and-run (RiseupVPN): no account record at all[1]. Each step down removes one link an authority or a breach could pull; the no-kyc hub maps the full chain including the app-store link.
No billing means no billing pressure, and the funding source becomes the honesty test. Riseup is a political collective with decades of mail-and-VPN history and an explicit donation model[1]; the Tor project survives on grants and donations[3]; Psiphon bridges censorship on foundation funding[5]. The pattern: account-free tools are almost all mission-funded, which is exactly why commercial products avoid them - you cannot upsell a user you never identified.
Support, for one thing: there is no ticket to file and no billing relationship to enforce a refund through[6]. Multi-device management exists (the app is the account) but per-user settings do not. And capacity is best-effort: donation-funded infrastructure scales on donations, which is why accountless services run smaller networks than commercial ones. Treat the model as a privacy tool, not a service contract - the streaming hub is where the account products play.
Threat model first: if you need a VPN that has nothing to give up about you, the model wins outright - pair it with the anonymous-payment hub if you also want the billing drawer empty. If you need streaming catalogs, obfuscation for censored networks or port forwarding, commercial accounts with evidence win (see the court-proven hub). And whichever way you go, the leak test remains free - the account model does not fix client-side leaks.
There is no signup and no users table - you install the app and it runs. No email, no password, no recovery, nothing that maps a person to a subscription. The provider cannot lose data it never had. {{stat: n}} providers match this filter; exactly one published provider in our ranking runs this model today.
RiseupVPN - you install the client and it connects; there is nothing to register, nothing to pay, funded by donations[1]. Outside our published ranking, the model appears in censorship tools (Psiphon runs without accounts for basic use[4]) and in the Tor network, which is the reference architecture for accountless trust[3].
Mullvad's model: the app generates a random number locally, the number is the credential, and no email or name ever touches the account[2]. It is not accountless - a billing ledger exists - but the account carries zero identity anchors. For most threat models it is functionally equivalent to no-account with better support.
No recovery (lose the install, there is nothing to recover), no per-user configuration, no billing relationship to complain through, and infrastructure funded by donations - which means capacity is best-effort. For a daily privacy tool with modest needs, those tradeoffs are often worth it; for streaming catalogs and support tickets, they are not.
The operator sees the IPs that connect to it - that is inherent to running a tunnel. What it cannot do is connect those sessions to a person, because no identity exists to connect to[6]. Logging behavior is a separate axis - the [no-logs hub](/best/no-logs-evidence/) ranks the evidence.
Because the model is economically narrow: no accounts means no recurring billing, which caps revenue and funds development through donations or adjacent products. Commercial incentives push the other way - every email is a remarketing asset. Expect the population to stay small[1][2], and treat new entrants with the usual evidence checks rather than enthusiasm.