Calyx VPN vs X-VPN: which wins in 2026?
Head-to-head on the facts that decide the purchase: real prices in the provider's own unit, minimum, KYC, proof, payment and terms - every number sourced in the linked reviews.
CalyxVPN is one of the very few genuinely free, genuinely anonymous VPNs - no account, no email, open-source client and server, run by a respected New York privacy nonprofit founded by the man who challenged the FBI's NSL gag order. But it is a small ideological service, not a product: one OpenVPN provider with no published gateway list, mediocre speeds, no streaming, no iOS, and - critically - a shaky uptime record. Users reported outages in late 2023, a certificate-breaking update in Dec 2024, an 'irreversible server outage' in mid-2025, continued connection failures in Aug 2025, and as of 2026-11-03 its Bitmask provider API returns 404 while the operator's homepage still advertises a free VPN; a third-party comparison claims the service went dark around January 2026. Treat it as a privacy community tool that may or may not be up when you need it, and verify connectivity before relying on it.
A heavyweight free-mobile VPN from a Singapore entity with real strengths on paper - no account required, an unusually deep protocol lineup, a self-published transparency report, a bug-bounty program, and a claimed Big-Four ISAE 3000 no-logs attestation - and real transparency gaps underneath. The no-logs audit is the weakest trust artifact this research encountered in a while: the auditor is never named and the report is locked behind an account login, which is the opposite of third-party verification, and two 2026 independent reviews (Security.org, Cloudwards) still describe the no-logs claims as unverified. The free tier's own marketing ('Unlimited Data and Speed', 'No Forced Ads') is contradicted by an independent 500 MB desktop lockout test and by community reports of data caps and ads, and the Play data-safety section's 'No data shared with third parties' sits awkwardly beside the operator's own policy disclosing AdMob, InMobi, Chartboost and Liftoff in the free version. Community sentiment is split between censorship-bypass gratitude and churn over trial-to-paid confusion; HN barely knows the brand exists. As a disposable school-firewall escape hatch it is what users say it is; as a privacy product, its central promise is unverifiable by anyone outside the operator's own accounts.
Short answer: X-VPN wins overall (5.1/10 vs 3.6/10). Facts checked 2026-11-08.
The facts
| Calyx VPN |  X-VPN | |
|---|---|---|
| Overall score (0-10) | 3.6 | 5.1 |
| Privacy & proof | ||
| Logging claim | We do not monitor your Internet usage or communications. | Privacy policy (last updated September 16, 2026): 'X-VPN is designed to not collect,… |
| Logging evidence | promise only (no proof) | promise only (no proof) |
| Audits | unknown | unnamed 'one of the Big Four auditing firms' (operator's own… moreunnamed 'one of the Big Four auditing firms' (operator's own wording; auditor not disclosed) 2026 |
| Jurisdiction | United States - The Calyx Institute, a New York 501(c)(3) no… moreUnited States - The Calyx Institute, a New York 501(c)(3) nonprofit founded 2010, HQ 254 36th Street Suite C660, Brooklyn, NY 11232 (privacy policy fetched 2026-11-03); a Five Eyes jurisdiction; the VPN is one program of the institute alongside CalyxOS and Tor activities | Singapore - LIGHTNINGLINK NETWORKS PTE. LTD. (own privacy po… moreSingapore - LIGHTNINGLINK NETWORKS PTE. LTD. (own privacy policy and both app-store listings; Play developer address 8 Marina View #43-01 Asia Square Tower 1, Singapore 018960). Note: 2026 reviews still describe the operator as 'Free Connected Ltd., a private company based in Hong Kong' (Security.org) and 'Based in Hong Kong' (Cloudwards), while the operator's own live documents say Singapore - the entity migration is documented but the current corporate history is not published |
| Owner | unknown | Free Connected Limited |
| Money | ||
| Intro price | $0 /mo | $2.99 /mo |
| Renewal price | not published | not published |
| Anonymous payment | bitcoin · fiat | btc, bch, eth · fiat |
| Account | ||
| Personal info | none - the VPN requires no account, no email and no payment;… morenone - the VPN requires no account, no email and no payment; Calyx memberships (which are donations to the nonprofit, not VPN access) can be paid by cash or Bitcoin with only a membership identifier retained | none |
| Kind | Free VPNs | Free VPNs |
| Facts checked | 2026-11-03 | 2026-11-03 |
Score breakdown
X-VPN leads on privacy & logging (+1), ownership & track record (+1), security (+1), censorship resistance (+3), honest value (+2.5), ease of use (+2).
Calyx VPN at a glance
++ What holds up
- Completely free with no accounts, no email and no data caps - one of the few free VPNs with no commercial catch
- Both client and server are 100% free and open source (GPL-3.0 Bitmask client; LEAP provider config public on GitHub/0xacab)
- Strong anonymity design: anonymous IP hosted by Calyx, anonymous DNS handling, cash/Bitcoin payment path for optional donations, operator retains no personal info for such payments
- Censorship circumvention via Bridges/pluggable transports (Internews-funded work with LEAP announced 2019)
- Operator credibility: 501(c)(3) with a unique legal pedigree - founder Nicholas Merrill was the first to constitutionally challenge an NSL; co-founded EFF's Canary Watch
- Kill switch (Android Always-On), split tunneling ('Exclude apps') and DNS/IPv6-leak protections are built into the client
-- What to watch
- Chronic reliability problems: outage reports Oct 2023 (r/Calyx), cert-update breakage Dec 2024 (r/CalyxOS), 'it never worked all that well' (r/CalyxOS 2025), and the provider API 404s as of 2026-11-03
- No public server list or location choice - third-party reviews describe a handful of gateways (New York only in 2021 testing); no country switching
- OpenVPN only - no WireGuard; TechRadar measured 5-10 Mbps from the UK in 2021 and PrivacyProof reports a small ~15-gateway network in 2026
- No iOS app and no Google Play listing anymore (Play URL 404s) - F-Droid/APK side-loading only
- US Five Eyes jurisdiction and no independent audit of the no-logging claim; warrant canary era ended with Canary Watch winding down in 2016
- Cannot unblock streaming (failed Netflix/Prime in TechRadar testing) and the whole service depends on donations to a small nonprofit
X-VPN at a glance
++ What holds up
- Genuinely accountless free tier on mobile: 'No Sign-Up Needed', 'no registration - connect instantly without sharing personal details' (operator pages + both store listings), with 26 manually selectable free regions including 13 US cities
- Deep circumvention story: 11-protocol lineup with the obfuscating Everest protocol and 'disguise technology', plus community reports of working where school/censorship blocks stop other free VPNs (r/X_VPN)
- Privacy infrastructure beyond the norm for a free app: self-published transparency report (law-enforcement and DMCA requests 2017-2026 with zero data provided), bug-bounty report, RAM-only server and private-DNS pages, GDPR Art 27 representatives in the EU and UK
- Payment options include CoinPayments crypto (BTC/BCH/ETH per Cloudwards) and gift cards; 30-day money-back guarantee on card/PayPal purchases
- Both app stores healthy at scale: Play 4.3 (881K reviews, 50M+ installs), App Store 4.7 (627K ratings); developer replies to Play reviews within a day
-- What to watch
- The headline no-logs audit cannot be checked: auditor unnamed ('one of the Big Four'), full report login-gated only, and both 2026 independent reviews reviewed before crediting it - Security.org: 'no way to know if the company is telling the truth'; Cloudwards: 'never been tested by a third-party audit or a court case'
- Free-tier marketing contradicted in testing and by users: 'Unlimited Data and Speed' / 'no data caps' (operator) vs Security.org's non-refreshing 500 MB Windows lockout, Cloudwards' 500 MB desktop tier, and r/X_VPN reports of a 300 MB non-paid cap and time/ads limits
- 'No Forced Ads - Mobile ads are optional and non-intrusive' (free-vpn page) vs Play 'Contains ads', a Play reviewer's popup complaints, and the policy's disclosed ad SDKs (AdMob, InMobi, Chartboost, Liftoff) - Chartboost's policy link points to loopme.com, a different adtech company
- Play data-safety declares 'No data shared with third parties' while the operator's own privacy policy integrates four advertising platforms and Firebase crash reporting in the free app
- Proprietary closed-source core (Everest) with a 'trust us' justification; the open-source Talaria claim is operator-asserted and its source code was not locatable in fetched material
- Jurisdiction history is murky: 2026 reviews still name 'Free Connected Ltd., Hong Kong' while live operator documents name LIGHTNINGLINK NETWORKS PTE. LTD., Singapore - the migration is visible only by comparing sources
- Performance is middling in independent tests: 40-60% download loss, poor upload and latency (Security.org); 'shockingly bad' upload speeds and 15-minute connection hangs (Cloudwards); Talaria protocol outages reported in the operator's own subreddit (Oct 2026)
FAQ
Which is cheaper, Calyx VPN or X-VPN?
Calyx VPN is cheaper at $0 /mo versus $2.99 /mo.
Which has better logging evidence, Calyx VPN or X-VPN?
Tie - both are at the same evidence level (policy-only).
Which renewal price is honest, Calyx VPN or X-VPN?
Calyx VPN is free - there is no renewal price to hide; the honest question is what the "free" is funded with. See the linked reviews.
Which needs less KYC, Calyx VPN or X-VPN?
At least one provider does not document its KYC policy - treat it as unknown, not as "no KYC".
Which has the longer track record?
Calyx VPN has the longer track record (since 2010).
Scores and facts: meta-reviews with dated sources - Calyx VPN · X-VPN. Method: how we verify. More: all providers compared · all head-to-heads.