Methodology - How We Verify & Score VPNs
Evidence classes
| A | Primary sources: court records, audit reports, company filings, operator documents we fetched ourselves. |
|---|---|
| B | Serious press, academic research, and established independent review outlets. |
| C | Community reports (Reddit, forums) - paraphrased, linked, labeled as anecdote. |
| D | Our own measurements. Empty until the test phase completes; provider pages say so explicitly. |
Citations
Every source on a provider page is evidence-classed [A]-[D] and dated - the class badges render next to each source, and the strip above the source list counts them. Our newest dossiers additionally carry inline citations [n] per factual sentence; older reviews cite per section. Claims we could not verify are either dropped or explicitly marked unverified - the honest answer beats a plausible guess.
Scoring
Seven dimensions: privacy & logging, ownership & track record, security, censorship resistance, performance, honest value, ease. Weights differ per kind (a free app is judged harder on trust than a paid service). Sub-scores are derived by a fixed rulebook from documented facts - the same rules render below, and the code behind them is src/score.js. A provider is never rewarded for what we could not verify.
Weights per kind
| Kind | Privacy | Ownership | Security | Censorship | Performance | Honest | Ease |
|---|---|---|---|---|---|---|---|
| Commercial VPNs | 24% | 18% | 14% | 10% | 12% | 15% | 7% |
| Free VPNs | 28% | 20% | 15% | 6% | 10% | 14% | 7% |
| Decentralized VPNs | 24% | 16% | 14% | 13% | 12% | 13% | 8% |
| Proxies | 26% | 18% | 14% | 10% | 12% | 11% | 9% |
| Smart DNS | 10% | 14% | 8% | 8% | 20% | 20% | 20% |
| Self-hosted | 18% | 10% | 18% | 12% | 13% | 13% | 16% |
| Tools & networks | 20% | 12% | 16% | 16% | 12% | 12% | 12% |
| Browser relays | 24% | 16% | 14% | 10% | 12% | 12% | 12% |
Column heads are abbreviated; full dimension names are in the rulebook below. A missing dimension (e.g. performance before our own tests exist) is dropped and the rest re-normalized.
Performance is null until we test. The total re-normalizes over the known dimensions - no provider is penalized for our missing tests, and none is flattered either.
Affiliate blindness
Scoring paths never read affiliate fields; a source-level test enforces it on every run. See how we make money.
Corrections
Sources rot and facts change. Every page carries its check date; every correction with evidence is applied and logged on the change feed.