We would like to count page views and clicks with Google Analytics, which sets cookies in your
browser. It is how we learn which pages are worth writing. Nothing loads until you choose, and
declining costs you nothing on this site. What we collect.
Windows is where VPN apps are most capable and where the platform itself leaks most readily: Smart Multi-Homed Name Resolution sends DNS queries out every interface at once, and sleep-and-wake reconnects have a gap. The best Windows VPN closes both, has a kill switch that holds through a crash, and runs WireGuard natively. This page ranks on that, then on trust.
Private Internet Access67 Open-source Windows app with a Windows Filtering Platform kill switch that holds through crashes and sleep, built-in DNS leak protection, per-app split tunnelling, port forwarding, unlimited devices, and WireGuard.
Proton VPN81 Open-source, audited Windows app with a permanent kill switch, per-app split tunnelling, NetShield DNS blocking, WireGuard and Stealth.
NordVPN75 Mature Windows app with an 'Internet kill switch' that holds and an app-level one for specific programs, NordLynx speed, Threat Protection Pro blocking malware and trackers at download time, Meshnet, and the largest network.
Open-source apps, court-proven no-logs, unlimited devices; US-based and Kape-owned.
67
Owner
Kape Technologiesalso owns review sites
Jurisdiction
United States · Five Eyes
No-logs audit
Deloitte, 2022 (report not public)
Price
from $2.03/mo · renewal price unconfirmed
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Open-source Windows app with a Windows Filtering Platform kill switch that holds through crashes and sleep, built-in DNS leak protection, per-app split tunnelling, port forwarding, unlimited devices, and WireGuard. The provider's no-logs claim has held in US court. The most complete Windows feature set at the best long-term price.
Swiss, non-profit-controlled, open source, with the only free tier worth using.
81
Owner
Proton Foundation
Jurisdiction
Switzerland · Outside the alliances
No-logs audit
None — apps audited by Securitum, 2025
Price
from $4.49/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Open-source, audited Windows app with a permanent kill switch, per-app split tunnelling, NetShield DNS blocking, WireGuard and Stealth. Swiss non-profit ownership for software running with elevated privileges on your main machine.
Slightly slower than PIA and NordVPN on distant servers.
Privacy & trust
73
Features
98
Price & renewal
77
Streaming
84
Controlled by a Swiss non-profit foundation since 2024
All apps open source and independently audited
Free tier with no data cap and no ads
Renewal is higher than the intro price
Free tier cannot choose a country
Speeds trail NordVPN and ExpressVPN in most tests
Lab test pending — scored on public dataiOS app score 68/100 from 101,311 ratingsFull reviewVisit Proton VPN
The biggest network and the most features; renews at nearly triple the intro price.
75
Owner
Nord Security
Jurisdiction
Panama · Outside the alliances
No-logs audit
Deloitte, 2024 (report not public)
Price
from $3.39/mo · ~$7.53/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Mature Windows app with an 'Internet kill switch' that holds and an app-level one for specific programs, NordLynx speed, Threat Protection Pro blocking malware and trackers at download time, Meshnet, and the largest network. Four audits, Panama entity.
Not open source; renewal is steep.
Privacy & trust
65
Features
91
Price & renewal
62
Streaming
90
Largest server network in the market
NordLynx (WireGuard) is consistently fast
Four Deloitte no-logs audits since 2018
Two-year plan renews at roughly 3× the intro price
Sibling brand Surfshark is presented as a competitor
No port forwarding
Lab test pending — scored on public dataiOS app score 58/100 from 699,424 ratingsFull reviewVisit NordVPN
Flat €5 a month, no email required, accepts cash; the privacy benchmark.
66
Owner
Amagicom AB
Jurisdiction
Sweden · Fourteen Eyes
No-logs audit
None — apps audited by Cure53, 2024
Price
from $5.40/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Open-source Windows app, kill switch on by default and enforced with WFP rules, WireGuard only, DNS handled inside the tunnel, no account email. The app that has changed least in years because it did not need to.
Not a streaming VPN; no discounts.
Privacy & trust
65
Features
76
Price & renewal
83
Streaming
42
Account is a random number, no email or name
Same price forever, no intro-vs-renewal games
Accepts cash by post and Monero
Streaming unblocking is unreliable by design
Port forwarding removed in 2023
Smaller server network
Lab test pending — scored on public dataiOS app score 63/100 from 1,441 ratingsFull reviewVisit Mullvad
Polished apps and reliable unblocking; owned by Kape, which also owns three review sites.
71
Owner
Kape Technologiesalso owns review sites
Jurisdiction
British Virgin Islands · Outside the alliances
No-logs audit
KPMG, 2023 (report not public)
Price
from $4.99/mo · ~$7.08/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Network Lock kill switch, Lightway with fast reconnects, per-app split tunnelling, and the most consistent Windows app in user reports. The travel pick for a laptop that moves between networks all day.
Windows app has a history of DNS-leak complaints and the free tier shares data with advertisers. No audit.
What we weighed for Windows, and the exact weights
Kill switch through sleep and crash
Windows Fast Startup and sleep reconnect the network before the VPN. A kill switch implemented with Windows Filtering Platform rules holds; a reactive one leaks.
DNS leak protection
Windows' Smart Multi-Homed Name Resolution sends DNS to every adapter. The app must block outside-tunnel DNS or the ISP sees every domain.
Per-app split tunnelling
Windows supports it well. Banking, games, and work apps outside the tunnel; everything else inside.
Trust record
The app runs with elevated privileges and sees all traffic. Ownership, audits and open source count.
Weights on this page: Privacy & trust 24% · Features 20% · Price & renewal 15% · Streaming 12% · Speed (our tests) 10% · App quality 8% · Support & refunds 6% · Censorship bypass 5%. Formula.
The two ways Windows leaks
Windows is the desktop where a VPN app can do the most and where the OS most readily undermines it. The first leak is DNS. Since Windows 8, Smart Multi-Homed Name Resolution sends each DNS query out of every adapter simultaneously and takes the fastest answer, so a query can reach the ISP’s resolver alongside the VPN’s. Every domain you visit is named to the ISP even though the content is tunnelled. Every pick here blocks non-tunnel DNS in the app; you can also switch the feature off in Group Policy.
The second is the wake gap. Windows Fast Startup and sleep restore the network before the VPN app restores the tunnel, and anything queued goes out in the clear. Only a kill switch built on Windows Filtering Platform rules — which block all non-tunnel traffic at the driver level regardless of whether the app is running — closes it. Every pick uses that approach. Test it with the kill switch tool, then kill the VPN’s process from Task Manager and watch.
Speed
WireGuard-family protocols with a kernel driver (NordLynx, Mullvad’s WireGuard, PIA’s WireGuard) keep the most throughput on Windows; OpenVPN, still the default in some apps, can halve a fast line. Antivirus products that inspect network traffic add their own overhead inside the tunnel. The speed test run with the VPN off and then on shows the real cost on your machine.
Split tunnelling done properly
Windows has the best split-tunnelling support of any desktop OS, and every pick offers it per app. PIA and Proton add per-IP rules. Common uses: banking apps that refuse foreign IPs, games where the tunnel adds latency, video calls that want the direct route, and work software behind a corporate VPN that conflicts with a personal one.
Elevated privileges and trust
A Windows VPN app installs a driver and runs a service with system privileges. That is necessary and it is also why the provider’s record matters here: the app can see and do anything. Open-source apps (PIA, Proton, Mullvad) let anyone check what the driver does; audits cover the others. Providers whose corporate siblings have been fined for selling data are not on this list for that reason.
Where to get the installer
From the provider’s website only. Windows “VPN” installers from download aggregators have been an adware and malware vector for a decade, and a search for a provider’s name returns paid ads for lookalikes. The picks all link from their reviews on this site to their own sites.
What we have not tested
Kill-switch behaviour under process kill and sleep-wake, and DNS leak protection under Smart Multi-Homed resolution, are from provider documentation and user reports. Our own tests on a fixed Windows machine with each provider’s defaults are scheduled and will move any provider that leaks.
iPhone app rating is far below every established provider in this catalogue
Frequently asked questions
What is the Windows DNS leak and how do I stop it?
Windows 8 and later use Smart Multi-Homed Name Resolution, which sends every DNS query to all network adapters at once and uses the fastest reply — so a query can reach your ISP's resolver even with the VPN up. Good VPN apps block outside-tunnel DNS; every pick above does. You can also disable the feature via Group Policy (Computer Configuration → Administrative Templates → Network → DNS Client → Turn off smart multi-homed name resolution).
Which kill switch works on Windows?
One implemented with Windows Filtering Platform rules that block all non-tunnel traffic, so that a crash or sleep-wake gap cannot leak. PIA, Mullvad, Proton (permanent), NordVPN (Internet kill switch) and ExpressVPN (Network Lock) all use this approach. Test with the kill switch tool: connect, monitor, then kill the VPN process from Task Manager.
Does Windows have a built-in VPN?
It has a client for IKEv2, L2TP, SSTP and PPTP profiles, and since Windows 11 supports WireGuard through the official WireGuard app. No provider is included and there is no kill switch. Every pick supports manual configs if you prefer no app.
Why is my VPN slow on Windows?
Usually OpenVPN. Switch to WireGuard, NordLynx or Lightway. Also check that the app is using the kernel WireGuard driver (NordLynx and Mullvad do), that no antivirus is inspecting the tunnel, and that the server is nearby. The speed test on this site with the VPN off and on shows the real overhead.
Can I split tunnel specific apps on Windows?
Yes; Windows has the best split tunnelling support of any desktop OS. Every pick here does it per app; PIA and Proton also allow per-IP rules. Put games, banking and video calls outside the tunnel if you need latency or a home IP.
Is a free VPN safe on Windows?
Proton's and Windscribe's free tiers, yes — same apps, same policies as paid. Free VPN installers found elsewhere have been a malware vector for years; several 'VPN' downloads are adware bundles. Get the installer from the provider's own site.
