Proton VPN

Proton VPN is the VPN service from Proton AG, headquartered in Geneva and founded in 2014 by researchers at CERN. It belongs to the same ecosystem as Proton Mail and Proton Pass, sharing account, billing, and the same claim that Proton’s own servers should not be able to read your content.

Two things make Proton VPN interesting in the current market. First, the provider is headquartered in Switzerland. Second, the free tier is relatively generous, with no bandwidth cap, no advertising, and (by Proton’s own account) no data selling. Proton says the free tier is financed by revenue from paid plans.

How does Proton VPN work?

A VPN builds an encrypted tunnel between your device and a server run by the provider. Your internet service provider sees that you are connected to a Proton server, but not which pages you visit. The website you visit sees the IP address of the Proton server, not your own. That does not make you anonymous, though. Browser fingerprints, cookies, logged-in accounts, and trackers on the pages you visit continue to identify you regardless of your IP address. A VPN shifts the visibility of your traffic, it does not eliminate it.

Proton VPN supports WireGuard (default on every platform), OpenVPN (TCP and UDP), and IKEv2 on iOS and macOS. WireGuard is lean, modern, and the fastest option on most connections. OpenVPN is older, but often more reliable on restrictive networks.

On top of these, Proton offers Stealth, its own obfuscation protocol. Stealth wraps VPN traffic in a TLS tunnel over TCP to frustrate Deep Packet Inspection (DPI), which network operators use to detect and block VPN connections. For travel to countries that restrict VPNs or for corporate networks with aggressive filtering, it is the most practical choice.

Who is Proton VPN for?

• Individuals in the DACH region, who want to protect their traffic on public Wi-Fi, shield themselves from their internet provider, or bypass geo-blocking. The free tier is enough for occasional use on a single device. See: VPN and Password Manager: Which Ones Are Actually Worth Paying For?
• Freelancers and sole proprietors, who regularly work with client data on third-party networks (coworking spaces, cafés, hotels). A VPN is a useful transport layer that you set up once and then forget. See: Security setup for freelancers
• Small teams and SMEs in Switzerland, who already use Proton Mail or Proton Pass and want to consolidate their stack. Proton VPN Business adds central admin management, dedicated gateways, and SSO via SAML and SCIM. See: Security tools for founders
• Journalists, NGOs, and activist organizations, who work in regions with VPN blocks or need to shield their location from infrastructure in the destination country. Stealth, Secure Core, and Tor over VPN are included in the paid plans and cover that requirement profile.

Try Proton VPN →

Key features

Secure Core (multi-hop)

Secure Core routes your traffic through a second, hardened server before it reaches the exit node. The entry nodes are located exclusively in Switzerland, Iceland, or Sweden, three countries with comparatively strict privacy laws. Proton states that it operates the Swiss entry servers in a former military bunker with its own access and network management.

The practical effect of Secure Core is that even if authorities in the exit country log outgoing traffic, they see only the IP of the entry server in Switzerland, Iceland, or Sweden. Your own IP is known only to the entry node. This costs speed. Independent tests by CyberInsider and TechRadar report noticeably lower throughput than on standard servers, sometimes only a fraction depending on the entry/exit combination. Secure Core is therefore less useful for everyday traffic and better suited to concrete threat models such as investigative journalism or source contact in difficult regions.

Stealth protocol

Stealth is Proton’s answer to countries and networks that actively block VPNs. Instead of sending WireGuard or OpenVPN packets that DPI systems can recognize, Stealth wraps the traffic in a TLS tunnel over TCP so it looks like ordinary HTTPS from the outside. The option is available on every desktop and mobile platform.

There is no guarantee that Stealth gets through everywhere. It does give you a built-in fallback when the default protocols are blocked, without having to fall back on a third-party client such as Shadowsocks.

Kill switch

The kill switch blocks your internet traffic as soon as the VPN connection drops unexpectedly, preventing packets from leaving your device unprotected via your real IP. It is available on Windows, macOS, Linux, Android, and iOS. On Windows an “Advanced Kill Switch” extends the default mode by also blocking LAN traffic.

On Linux, Proton added a permanent kernel-level kill switch in early 2024, using nftables rules that apply even when the app itself is not running. That is relevant for devices meant to stay connected unattended, such as a home-office laptop or a small self-hosting machine. As of April 2026, community reports occasionally surface edge cases on Linux systems with specific network configurations, particularly after wake from suspend. For standard installations the kill switch runs reliably.

NetShield (DNS blocker)

NetShield is a DNS blocker that filters known ad, tracker, and malware domains on Proton’s servers. Because it works inside the VPN tunnel, it also blocks in-app trackers on smartphones that a browser-only ad blocker cannot reach.

Proton does not fully publish the sources of its blocklists, and no independent audit specifically covers blocklist quality. NetShield is therefore not a replacement for a dedicated DNS filtering solution like NextDNS or Pi-hole when your use case requires granular blocking rules. For everyday use the effect is still noticeable, and it works without any extra configuration.

Open-source clients and no-logs audits

All Proton VPN client apps are open source. This covers the clients for Windows, macOS, Linux, iOS, and Android, each with a public repository on GitHub. The server-side software is not open. Open clients allow external developers to understand the app’s behavior, but they do not change the fact that you have to trust the provider for the server-side behavior.

To close that trust gap on the server side, Proton VPN has its no-logs policy verified externally on a regular basis. Since 2022 this has been done by Securitum, a Polish security services firm that inspects server configuration, logging and monitoring behavior, and change-management processes in the production infrastructure on site. The most recent audit in September 2025 confirmed that no connection, session, or IP logs are collected. The report is public. All audits to date come from the same auditor, however, and a second, independent auditor would strengthen the claim.

Tor over VPN

Tor (The Onion Router) is an anonymization network in which your traffic passes through three randomly selected, volunteer-operated nodes, so that no single node knows both sender and destination at once. Proton VPN provides dedicated servers that forward your traffic directly into this network after the VPN exit (labeled “TOR” in the client). That lets you reach .onion addresses without installing the Tor Browser.

Scope of the free tier

Proton VPN’s free tier is usable indefinitely and not time-limited. You get unlimited bandwidth with no throttling and no ads, one simultaneously connected device, and access to servers in a small selection of countries (as of 2025 rotating between the US, the Netherlands, and Romania). Secure Core, Stealth, NetShield, Tor over VPN, and P2P servers remain reserved for the paid plans, as does the streaming-optimized network.

Proton states that the free tier is funded directly by revenue from paid plans. For anyone who only needs a VPN occasionally on a laptop, it is one of the more credible free options on the market.

What Proton VPN does not do

• No protection against local threats. A VPN encrypts traffic on its way to the server, it does not protect the device itself. Proton VPN does nothing against phishing, weak passwords, malware, or an unencrypted backup. The service does not replace a password manager, 2FA, or an endpoint protection tool.
• Not the fastest option on the market. In independent benchmarks from TechRadar, Cyberinsider, and Comparitech, Proton VPN lands in the upper mid-tier but not ahead of providers like NordVPN or Surfshark. You will notice the difference with 4K streaming or large downloads, while for normal browsing, video calls, or home-office work Proton is fast enough.
• Streaming is solid but not bullet-proof. Netflix US, BBC iPlayer, and Disney+ unblock on most exit servers. Occasionally individual services block an IP range until Proton rotates to another pool. Anyone who subscribes to a VPN primarily for streaming will see fewer outages with specialized providers.
• No browser extension as a proxy. If you want to route browser traffic separately from system traffic, you need either split tunneling in the app (available on Windows, Linux, and Android) or a third-party solution.
• Support runs primarily by email. Live chat is available to paid-plan customers during European business hours (9 AM to midnight CET); outside that window everything goes through email. Both Trustpilot reviews and comparison reviews show wait times ranging from a few hours to several days. For business teams that need around-the-clock reachability when something breaks, that is not enough.

What does Proton VPN cost?

Proton VPN is available in four variants.

• Free. The free version runs without a time limit on a single device, gives you access to servers in three countries, and contains none of the extra features from the paid plans.
• VPN Plus. The personal paid version provides the full Proton VPN feature set on up to ten devices, including Secure Core, Stealth, NetShield, streaming-optimized servers, P2P, and Tor over VPN.
• Proton Unlimited. The bundle version combines VPN Plus with Proton Mail, Drive, Pass, and Calendar, and is usually the more sensible option as soon as you use more than one Proton service.
• Proton for Business (VPN Essentials and Business). The team variants add central user management and an admin console, plus dedicated gateways as an add-on, SSO with Entra ID, Okta, and Google, and SCIM provisioning on the Business plan.

An annual subscription is noticeably cheaper than the monthly variant. Billing in CHF is available on the Swiss version of the Proton website. The 30-day money-back guarantee also applies to annual plans on a pro-rata basis.

Current prices on the Proton VPN pricing page.

How does Proton VPN compare?

If raw speed and streaming comfort are in the foreground, NordVPN is consistently ahead in independent benchmarks. If Swiss jurisdiction, open clients, multi-hop into Switzerland, or integration with Proton Mail and Pass matter more to you, Proton VPN is closer to your threat model.

Two further providers are regularly mentioned in this category but do not yet have their own NeoGuard guide. Mullvad (Sweden) has a flat monthly price, anonymous account numbers, and a pronounced privacy focus, but no free tier. Surfshark (Netherlands) allows an unlimited number of simultaneously connected devices and offers a broad server portfolio. We will expand this comparison once both have their own reviews.

Swiss relevance (and its limits)

Proton AG is headquartered in Geneva and falls primarily under Swiss law. Switzerland has no direct equivalent to the US CLOUD Act, and thanks to EU adequacy, data stored with Proton is treated as internal to the EU under GDPR. For companies operating under the nDSG, a VPN is rarely the critical channel (email and cloud storage are more likely to be), but as a transport layer on third-party networks it supports the requirement for “appropriate technical and organizational measures” under Art. 8 nDSG.

Two aspects are worth a closer look.

Has Proton ever been compelled to assist an investigation?

In 2021 it was reported that Proton had handed over the IP address of a French climate activist. The case went through the international mutual legal assistance treaty (MLAT) and a legally binding Swiss order that required Proton to log the IP of a specific account going forward from the time of the order (see Proton’s statement). The case affected Proton Mail only, not Proton VPN. No comparable case involving Proton VPN session data has been publicly documented to date.

The case still matters for a realistic view of Swiss law as a protective layer. It does not translate into blanket protection against European investigations, and when a sufficiently well-founded order arrives through a valid mutual legal assistance process, Swiss providers are not exempt either.

VÜPF amendment and possible relocation

A proposed amendment to the Swiss ordinance on the surveillance of post and telecommunications (VÜPF) would require providers with more than 5,000 users to retain metadata for six months and assist with decryption. Proton has publicly criticized the draft in sharp terms. CEO Andy Yen has called the current regulatory environment in Switzerland hostile to privacy-friendly services and has begun to relocate infrastructure, initially for the Lumo AI service to Germany and Norway.

As of April 2026, Proton VPN is still based in Switzerland, and no relocation of the core product has been announced or implemented. The point is relevant if you choose Proton solely because its servers are located in Switzerland. We will update this article as new developments emerge.

Tips for using Proton VPN

• Use WireGuard as the default. The protocol is faster and leaner than OpenVPN and runs reliably on every platform under Proton’s current configurations. Switch to OpenVPN only if a restrictive network is blocking WireGuard.
• Turn on Stealth if the tunnel will not come up. Hotels, corporate networks, and some countries filter WireGuard and OpenVPN at the port level. Stealth gets through in most of these cases because the traffic looks like HTTPS to outside systems.
• Keep the kill switch on permanently. Without an active kill switch, VPN protection only holds as long as the tunnel stands. On a laptop, the permanent mode is the better default, not a backup for exceptional cases.
• Use Secure Core selectively. The speed penalty is unnecessary for everyday traffic. For research, sensitive sessions, or source contact, the detour through Switzerland, Iceland, or Sweden is worth it.
• Check Proton Unlimited if you already use Mail or Pass. The bundle brings Mail, VPN, Drive, Pass, and Calendar under one subscription and one account and is usually cheaper than the sum of the individual plans.
• Try the Linux client before the annual plan. If Linux is your working machine, test stability, kill-switch behavior after suspend, and protocol options in day-to-day use before committing for a year. The 30-day money-back guarantee gives you enough time.