Free apps - a few are fine, most are the product. We name the difference.
Short answer: One donation-funded provider (RiseupVPN) holds a full ranking slot here; the honest funnel tiers (Proton, Windscribe) rank on their commercial reviews. The "free unlimited" apps outside it documented their business model in FTC orders and breach databases.
providers on this page: 5 · independent audit on file: 0% · court-proven no-logs: 0 · open-source apps: 20%
quick picks
A free, fast, one-tap encryption tool that is deliberately NOT an anonymity VPN - judge it as such. Cloudflare's own docs say the quiet part: WARP collects…
The most trustworthy free VPN on structural grounds: an anarchist Seattle collective that has run since 1999, funds itself by donations, asks no account…
The rare VPN where no investigation is needed - the privacy policy is the evidence. Urban VPN's parent self-declares as a data broker and sells behavior…
The worst documented app in this comparison set: 100M+ installs, ownership in the Qihoo 360-linked shell network (TTP 2025), and a peer-reviewed NDSS 2026…
A 500M-install free VPN from the Qihoo 360-linked developer cluster (Innovative Connecting / Autumn Breeze / Lemon Clove, per TTP 2025 and OTF 2025)…
Only one provider holds a ranking slot on this page - the donation-funded collective. Proton VPN and Windscribe pass the same honesty bar but rank as commercial providers, because their free tiers are funded by paid plans; the quick picks above link their reviews. The filter excludes the "free unlimited" app tier deliberately, because that tier's business model is a matter of public enforcement record now: the FTC banned Avast from selling browsing data and priced the case at $16.5M[1], and Apple removed Onavo for the same behavior[2].
Hola turned ten million users into exit nodes and sold the capacity as Luminati - the business that became Bright Data[3]. The model's failure mode is structural: your IP performs other people's traffic, abuse lands on your line, and the "VPN" was the product being consumed. Any free product whose terms mention bandwidth sharing deserves that specific suspicion - the proxy hub covers the legitimate version of that market, which looks nothing like a consumer app.
UFO VPN's exposed 1.2TB database and SuperVPN's 10M-record leak are the empirical answer to "do free apps keep logs" - they kept everything: IPs, credentials, traffic records[4][5]. The breach was the audit nobody had to commission. It is also why our scoring gives zero credit to policy-only claims from this tier - the claims were tested, in public, and failed.
Card-required trials deserve their own warning: the trial converts automatically, the conversion bills at the standard rate, and the standard rate renews at the renewal rate - three prices hiding behind the word free. NymVPN's 7-day trial and AirVPN's EUR 2 3-day trial are the honest versions, priced and bounded. The dishonest version is the "free week" that costs a year - the free-trial hub maps which is which, and the calendar reminder remains the only reliable consumer technology against it.
RiseupVPN for principle (donations, no accounts)[6]; Proton's free tier for unlimited data on audited architecture; Windscribe for a real monthly allowance. All three publish their limits honestly. When the limits start pinching - travel weeks, streaming, a second device - the paid honest tier is cheaper than the data-side business of the alternatives: the cheapest hub starts at $2.19 renewals, and the finder narrows the field in five questions.
Something pays, always. The documented models: selling your browsing data (Avast via Jumpshot, banned by the FTC with a $16.5M settlement[1]), harvesting traffic for analytics (Facebook's Onavo, banned by Apple[2]), renting your bandwidth to others (Hola's users became its exit network, sold as Luminati[3]), or funding it honestly from paid plans and donations.
One ranked provider plus two honest funnel tiers. RiseupVPN: donation-funded, no accounts, nothing to sell[6]. Proton VPN's free tier: unlimited data, no ads, the same audited no-logs architecture as the paid product - the funnel is the business model. Windscribe: 10GB/month with a confirmed email. The "free unlimited" apps outside this ranking are the ones with the FTC cases and the breach databases[4].
SuperVPN leaked 10M user records in 2020 and the combined SuperVPN/GeckoVPN dataset resurfaced for sale later[5]; UFO VPN left 1.2TB with ~23M users open - all from products advertising "zero logs"[4]. These apps logged everything while promising the opposite, which is the pattern our scoring treats as disqualifying.
At Proton VPN, yes on architecture - same no-logs infrastructure, fewer countries and one device - funded by the paid plans it funnels toward. At operators whose free app is a separate product from their paid product, the free tier is the product and the paid tier is the escape hatch. The distinction is on every provider page's funding notes.
A contactable identifier (the email you confirm), the absence of streaming locations, speed caps, and in the worst cases the data-side business above. What it does not cost: money. For occasional travel and testing that trade is fine; as a daily driver, the paid honest tier starts at $2-6 (see the cheapest hub) and ends the tradeoffs.
Run the leak test - free clients most often fail DNS and WebRTC checks. Then check the developer against the incident timeline: if the same publisher appears with a breach or an FTC action, delete the app regardless of what its store page promises.