Proton VPN
The Swiss all-rounder that pairs a genuine free tier with a paid stack most households can actually live inside.
TL;DR verdict
Proton is what happens when a privacy company grows up without embarrassing itself. The free tier is real, Secure Core and NetShield earn their marketing, and the streaming story mostly holds. The upsells and the sprawling Proton Unlimited bundle are the annoyance.
What we like
- Free tier is genuinely usable and has no session or bandwidth cap
- Secure Core routes through Iceland, Sweden and Switzerland before your exit
- Streaming works reliably on Plus servers labelled for the region
- Open-source clients on every platform, audited by SEC Consult
- Bundles cleanly with Proton Mail and Drive if you already live in that stack
Where it falls short
- Free tier deliberately excludes Secure Core and streaming servers
- The apps push Proton Unlimited hard, which gets tiring
- Swiss jurisdiction is friendly but not immune to lawful requests
- Linux GUI is newer and still catches up to the Windows and Mac clients
TL;DR verdict
Proton VPN is the pick for someone who wants a serious VPN but is not going to hand-tune WireGuard configs on a Friday night. The free tier is real. The paid tier streams. Secure Core is a genuine second layer for high-risk work. It is not the cheapest and the marketing is a bit much, and it is still the most defensible mainstream recommendation.
What it does well
The free tier is the headline, and it deserves it. There is no time limit, no bandwidth cap, and no ad injection. You get a smaller server list and lower priority on shared load, and that is the whole catch. For a household that just wants a coffee-shop safety net, the free tier is enough.
The paid product does the things the free tier does not. Secure Core routes traffic through a hardened jurisdiction — Iceland, Sweden or Switzerland — before it exits, so a compromised exit country never sees your origin IP. NetShield blocks trackers and malware at the DNS level and is more honest than most competitor equivalents. Streaming servers are labelled by platform and region and work most of the time.
The clients are open source across every platform, audited by SEC Consult, and Switzerland's post-2022 legal environment is friendlier to zero-knowledge providers than most of Europe. The company shares an org chart, an office and a leadership team with Proton Mail, which makes the accountability story concrete rather than abstract.
What it doesn't
The upsells. Every app pushes Proton Unlimited — Mail, Drive, Calendar, Pass and VPN bundled together — and the nudges show up in places they should not. The Linux GUI works and is newer than the CLI, and it still lags the Windows and macOS clients on polish.
Swiss jurisdiction is often oversold. Switzerland is not a member of Five, Nine or Fourteen Eyes, and it does respond to lawful requests via the appropriate treaty channels. Proton has published transparency reports acknowledging this. The provider cannot hand over what it does not have, which is the point of the no-logs architecture; treat the marketing about Switzerland with a little less awe than the ads suggest.
Who it's for
Households, remote workers who want streaming to keep working while they move, and journalists who want a serious client without leaving a stack they already use. Not the pick for someone who wants payment anonymity — Mullvad remains stronger there. It is the pick for almost everyone else.
Frequently asked
Is Proton VPN's free tier a real free tier or a trial?
It is a real free tier. No time limit, no bandwidth cap, no ads. You get a smaller set of countries and slower priority on shared servers, but you can live inside it indefinitely. Very few paid VPNs offer anything close.
Does Proton VPN keep logs?
Proton's published policy is a no-logs stance for connection and activity data, and the clients are open source so the connection side can be inspected. Switzerland has no data-retention mandate on VPN providers. The usual caveat applies. Policy is not the same as a proof, and audits reduce but do not eliminate that gap.
Is Secure Core actually useful or is it marketing?
It is genuinely useful if your threat model includes the exit country being coerced. Traffic hops through a hardened server in Iceland, Sweden or Switzerland before reaching the exit, so an adversary at the exit sees Proton infrastructure rather than your home IP. It adds latency, so it is not the everyday default.