VPN Glossary

A browser add-on/extension, or software, that prevents advertisements from displaying on web pages.

The majority of these will also help to block ad-based malware and cross-site tracking, which is when companies collect your data across multiple websites.

Adblock Plus is probably the most famous example – it’s a browser extension that’s been downloaded by tens of millions of people all over the world for years now. We fully recommend you download it for whatever browser you’re using. There are others out there that do a good job too, but there’s little need to have more than one installed at any time.

Some VPNs have ad blockers built-in as an extra feature. Some of the best VPNs we’ve reviewed with this capability are:

• NordVPN
• CyberGhost
• Private Internet Access
• Hotspot Shield
• Surfshark
• Windscribe
• VPNArea
• FastestVPN
• TorGuard

One of the most commonly used encryption protocols, AES-256 is the cipher of choice for the US federal government – hence why you’ll often see VPN providers describe it as ‘military grade‘.

It is considered completely unbreakable, and since its creation in 2001 has undergone excessive testing to prove exactly how secure it is.

It’s a type of cipher, which means it’s a sort of algorithm for encrypting and decrypting data. If a VPN says it uses AES-256 encryption, that simply means that it uses AES-256 to jumble your data at one end of the connection, then reassemble it at the other.

AES is the best encryption standard available to VPN users.

We go into much more detail about how AES works in our VPN encryption guide.

An open source digital currency – or “cryptocurrency” – that’s been around since 2009. It isn’t linked to any banks or administrative bodies, and is the most popular cryptocurrency in the world.

Bitcoin operates using peer-to-peer technology, with transactions take place directly between users, cutting out the need for ‘middle men’ like financial institutions. It can be exchanged for goods and services or for other currencies.

Many VPN providers allow payment via Bitcoin as it provides customers with an additional layer of privacy. It’s more private because Bitcoin isn’t associated to any bank, or even any person. Every Bitcoin (or fraction of a Bitcoin) is tracked via a public ledger – the ‘blockchain’.

They’re then linked to a Bitcoin wallet, but don’t be confused by the name. A Bitcoin wallet works nothing like the one in your back pocket – rather than being a container, it’s actually two cryptographic keys. One key lets people pay Bitcoin into the wallet, while another (private) key lets the owner spend it. You can learn more about Bitcoin wallets here.

Be warned though, Bitcoin (and other cryptocurrencies) fluctuate wildly in value. Paying for a VPN with cryptocurrency may seem like a fair deal at the time, but if Bitcoin has a spike in value down the line then you could end up having massively over-paid for your VPN service.

 

One of the most common peer-to-peer (P2P) protocols used to download and distribute files over the internet.

Rather than downloading a file from one central source (like when you download a VPN install file from a provider’s website), torrenting instead connects you to multiple users who already have the complete file. You download bits and pieces of that file from them until you too have a complete download. In return, you can then share (or ‘seed’) the file to help other users looking to download it, and increasing the speed at which they can do so.

To get started, you’ll need BitTorrent client software along with a small torrent file that contains the information needed to download the file you want. These torrent files are most notoriously available on illegal torrenting sites, but also on forums and other sites.

For many unscrupulous individuals, breaking the law is a part of the appeal of torrenting – people take advantage of its speed and P2P nature to share pirated software or media. You should never use it for that. Torrenting is perfectly legal when used to share rights-free material.

Unless you use a VPN, your IP address will be exposed to anyone involved in data transfers, so check out our best VPNs for torrenting in order to protect yourself from unwanted snooping.

 

A plug-in, or add-on, that can be downloaded and installed to your web browser to let it do all manner of extra things.

Most major browsers (Google Chrome, Firefox, Opera and Safari) offer online stores that allow you to find extensions, however not all extensions will work with every browser.

You should also beware that anyone can make their own browser extension – make sure you only install ones that look trustworthy, otherwise you may find yourself being spied on or monitored even more.

Many VPN providers offer browser extensions – they can be an excellent, lightweight solution to achieving a little more anonymity or simple geospoofing. In most cases, these are proxies rather than full VPN extensions (see our definition of ‘proxy’ below), so your web traffic won’t actually be encrypted.

The only VPN provider with a browser extension currently available that acts as a genuine, full VPN is ExpressVPN.

A mathematical algorithm used for data encryption. Modern-day ciphers are almost impossible to crack, even with the help of advanced supercomputers, as they’re made up of incredibly complex algorithms. AES-256 is considered to be the strongest cipher currently available for a VPN. You may also see AES-128 from time to time, too.

To simply put how complex high-end VPN ciphers are, let’s look at AES-128 as an example.

Let’s say that:

• Every person on the planet owns 10 computers.
• There are seven billion people on the planet.
• Each of these computers can test one billion key combinations per second.
• On average, you can crack the key after testing 50% of the possibilities.

Then the population of Earth can crack one encryption key in 77,000,000,000,000,000,000,000,000 years. That’s seventy-seven septillion years.

And that’s just with AES-128, never mind AES-256, which you’ll see as a part of almost every high-scoring VPN on this website.

That example above shows just how hard it is for would-be hackers to ‘brute-force’ a VPN’s encryption, attempting every single possible combination to decrypt the data.

Also known as metadata logs, connection logs are used by VPN providers (in most cases) for troubleshooting and dealing with technical issues.

The amount of data collected varies from one VPN service to the next, but generally includes anonymous details such as: connection time, amount of data transferred and the number of devices that are connected to the VPN.

We largely believe that these sorts of logs are fine.

Some providers will also log your originating IP address, however – we recommend you don’t use a VPN that logs your IP.

As a general rule, connection logs aren’t too much of a concern as long as they’re anonymous, not overly detailed, and are only stored for a very short period of time.

Providers like ExpressVPN are a good example of this: they only collect your connection date, server choice, and total amount of data used, none of which can be used to personally identify you.

Other VPN services, like HideMyAss!, are a little more intrusive, storing your originating IP address for up to three months. We think that’s entirely unnecessary, and a potential risk to your anonymity.

A small text file placed on your computer when you visit a website, used to remember something about you or your device at a later date.

Cookies have many uses, including remembering your login details and website preferences. However, there have been some issues with sites using them to track visitors without them knowing.

The two most commonly used types of cookie are session cookies and persistent cookies. A session cookie disappears after you close your browser, but a persistent cookie remains after you close your browser and may be used on subsequent visits to the website.

If you want to delete any cookies from your web browser, follow these steps:

Google Chrome

• Navigate to chrome://settings/
• Scroll to the bottom of the page and click Advanced
• An option should have now appeared just a bit further down called Clear browsing data – click it
• Now check the box labelled Cookies and other site data and click Clear data – be careful not to have the other two boxes checked if you don’t want to also wipe your browsing history or cached images

Apple Safari

• Click on the Safari menu button, then Preferences
• Click onto the Privacy tab
• On this tab you can check boxes to both prevent sites from tracking you between one another, and also to block cookies altogether
• To delete any currently stored cookies click Manage Website Data… then Remove All

Mozilla Firefox

• Click the hamburger menu button
• Click the Privacy & Security tab
• Click the Manage Data… button that appeared to the right
• Click Remove All Shown

Opera

• Click the Opera icon in the top-left corner of the browser window
• Click Preferences from the drop-down menu
• Click Privacy & Security in the left-hand menu
• In the Cookies section on this page you can choose what sort of cookies are allowed to be stored by your browser, and for how long
• To delete any existing ones, click All cookies and site data… and then Delete all

Microsoft Edge

• Click the Settings & more button in the top-right hand corner of the browser window (it looks like three dots in a row)
• Click Settings
• Click Privacy & security
• Check the box labelled Cookies and saved website data and then click Clear

A digital currency that can be exchanged for goods or services, using cryptography as a means of securing and verifying transactions.

Some more well-known examples of cryptocurrencies include Bitcoin, Litecoin, Ethereum, and Dash, some of which are accepted by VPN providers as a means of payment.

We always like it when a VPN provider accepts cryptocurrency for payment as it means that users can stay that little bit more anonymous.

For more information check out the Bitcoin section of this glossary.

While they may often be spoken of as if they’re the same thing, the Dark Web and the Deep Web are actually two different things.

The Deep Web is all of the websites you can’t find or access using regular search engines like Google or Bing. Instead of .com or .org, for example, these websites end with the suffix .onion.

It is only accessible through networks such as Tor (The Onion Router – you can read more about it below) or I2P (Invisible Internet Project). Users of Tor become incredibly difficult to track.

There is nothing illegal about accessing the Deep Web. Plenty of people living under oppressive regimes or intense censorship use it to bypass internet blocks – in fact many regular websites have .onion mirrors, ExpressVPN included. Some VPNs let you access .onion websites through servers on their network, too, meaning you don’t even need to download Tor browser to visit them.

Be warned, though – use of the Tor browser will likely alert your ISP. That’s fine if you have nothing to hide, and it won’t be able to see what sites you’re visiting on it, but it will certainly draw attention.

The Dark Web, on the other hand, is a section of the Deep Web used almost exclusively for illegal means.

There are all manner of shady marketplaces and forums on the Dark Web, and we would advise you to stay clear of it entirely.

We conduct an annual investigation into the state of illegal markets on the Dark Web. Our most recent foray revealed how much your personal data and hacked accounts from various popular websites is worth.

A Linux-based open source firmware for wireless routers. It’s a third party software compatible with numerous router brands, designed to be installed over the default operating system to provide added functionality.

You can ‘flash’ DD-WRT into your existing router, which will remove the default factory settings and give you more control, or you can purchase a router that’s been pre-flashed.

This enables you to configure a VPN at router level, so every device you connect wirelessly will be routed through the VPN without you having to install individual apps.

Ordinarily when you use a VPN you are randomly assigned an IP address from a pool of total available options. This number can vary greatly – one VPN provider may offer 1,000 IP addresses on the server you wish to connect to, while another may offer just one.

Either way, that IP address you’re assigned is shared by other users also connecting to that server. In fact there’s a high chance there will even be someone using it at the same time as you.

Some VPNs, such as VPNArea and NordVPN, offer subscribers the option of a dedicated IP address. For a small extra monthly fee you can be assigned an IP address unique to you. No other users have access to it, and you will always be able to connect to it whenever you choose.

It may sound strange, given that VPNs are all about protecting your anonymity, but there are some reasons where it makes sense to get a dedicated IP:

• It can more reliably unblock streaming sites like Netflix within the country that the IP is located (but it will only unblock content from that one specific region).
• You’ll see fewer Captchas around the internet
• You won’t receive as many messages from your various accounts notifying you of logins from unfamiliar IP addresses
• Your speeds might be higher due to less congestion on the network

However, we still recommend that you don’t purchase a dedicated IP address. By using one you essentially lose all anonymity. Without other users also being assigned it, or without the potential to be randomly assigned a different address yourself, everything done on that IP address can be traced back to you.

Even if the VPN service in question does not ordinarily keep any logs, it still has to maintain some system of linking an IP address to your account, which can then be used to easily reveal your true identity.

Deep packet inspection is an advanced method of monitoring and analyzing web traffic. Usually when we talk about it in the context of VPNs it’s with regard to governments utilizing it to censor the internet or block citizens’ web traffic.

All your traffic that travels over the internet is comprised of ‘packets’. As the name suggests, they’re small portions of data which as transported bit by bit and then reconstructed upon reception, completing the communication process between a client (your device) and the server (the website you’re trying to view, for example).

To use a metaphor, they’re a lot like letters. Ordinarily, only the packet headers are visible to outside forces, a bit like how anyone could see the address on an envelope but not the information within it.

DPI, though, is akin to opening up the letter and scanning over the contents. It’s possible to use it in a positive way, like to prevent malware, but it’s more commonly used by workplaces, ISPs, or even governments to determine what information can be transferred and what cannot. It’s a super-efficient way to censor the internet.

A good VPN with the right obfuscation tools can shield your traffic from DPI.

DMCA stands for Digital Millennium Copyright Act, and a DMCA notice refers to a copyright infringement notification that’s sent to ISPs by copyright holders.

Anyone who torrents copyrighted material or accesses illegal streaming websites is at risk of having one of these letters forwarded onto them in the mail by their ISP.

Since VPN users take on an IP address registered with their VPN provider, any alert relating to alleged infringement goes to the VPN service rather than the ISP of the user doing the alleged infringing.

It’s worth looking closely at a VPN provider’s terms of service, and logging policy, if you are a heavy torrenter to understand how a VPN service responds to these notices.

We strongly condemn torrenting copyrighted material, whether it’s with or without a VPN. Torrenting copyrighted material with a VPN is just as illegal as doing it without one.

The internet’s method of translating web addresses (URLs) into numeric IP addresses.

Every website has an IP address, but it would be a horrible task for you to have to remember it for every site you want to visit.

Instead, we memorize domain names. Every domain name corresponds to an IP address.

For example, the domain name Top10VPN.com converts to an IP address of 151.101.50.49 via DNS.

This translation process is usually performed by your ISP, meaning that it can see every site you visit, along with its IP. But when you’re connected to a VPN, all DNS requests are first routed through the VPN tunnel and then resolved by the VPN provider, rather than by your ISP.

This is a core function of a VPN, and it means that your ISP has no idea what websites you’ve been visiting.

Pick the wrong VPN, though, and this process may fail. You could be exposed to a DNS leak.

DNS hijacking is a form of man-in-the-middle attack wherein the hacker intercepts your traffic before it reaches the proper DNS server. The hacker then redirects the unsuspecting user to a malicious site.

Sometimes these can be sites designed for phishing (which look just like the real site, but instead steal any entered credentials) or they can simply be different sites entirely, riddled with malware.

A VPN can prevent DNS hijacking by creating a secure tunnel between your device and the DNS server, ensuring that your DNS requests can’t be observed or tampered with.

These occur when a DNS request slips out of the encrypted VPN tunnel and instead go via your ISP, meaning your true IP address (as well as the site you’re trying to visit) is exposed. You can check for DNS leaks by reading our leak-testing guide.

The best way to prevent this from happening is to choose a VPN provider that offers built-in DNS leak protection. Any VPN with a respectable score on our website is guaranteed to keep you safe from leaks of all sorts, not just DNS.

We explain in full what DNS is a little further up this page. DNS over HTTPS aims to improve this technology and make it even more secure and private.

Currently, DNS requests are sent in ‘plain text’ – that is to say, entirely unencrypted. Anyone spying on you (not to mention your ISP) can see the name of the site you’re browsing to. This makes DNS requests particularly vulnerable to ‘man-in-the-middle’ attacks.

DoH, however, aims to secure this process by securing all DNS requests within what’s called an ‘HTTPS GET’ or ‘HTTPS POST’ request.

This means that, just as HTTPS domains are secure, DNS requests will also be secured – protected from interference and interception.

Server Name Indication, or SNI, was made an internet standard all the way back in 2003. SNI allows a server to host multiple HTTPS websites all on the same IP address.

SNI also requires your device to specify which of these websites it wants to connect to, to ensure that you’re not returned a random or incorrect one from the same IP address.

However, this information is all transported in plain text, which is no good for privacy or security. It means that your DNS request or your own IP address could be leaked as the server attempts to resolve your request.

ESNI, or Encrypted Server Name Indication, aims to solve this by encrypting the process. With ESNI, only the server and the client trying to connect to it has the key capable of decrypting it.

ESNI technology is currently in a preliminary phase. Only users of certain versions of Mozilla Firefox will be able to use it, and only when accessing services hosted by Cloudflare (which hosts a great explainer on the matter here). When it’s been shown to work properly, we hope to see it supported by other browsers and content delivery networks (CDN), and eventually used automatically for the majority of web traffic.

Until then, a VPN is important to prevent leaks during the SNI stage.

The method of converting data to an encrypted form, using a mathematical algorithm known as a cipher.

It’s used to protect sensitive information and prevent it from being viewed by unauthorized parties, and is incredibly difficult to ‘crack’ unless you have access to the correct ‘keys’.

This is just a top-level look at the matter, as it’s one that’s incredible sprawling and complex. We’ve done our best to make it a bit easier to understand with our in-depth guide to encryption.

A free, open-source web browser developed by Mozilla Foundation, a non-profit organization.

It still isn’t quite as widely-used as Google Chrome, but Firefox is becoming more popular with security-conscious users due to the abundance of privacy enhancing add-ons on offer.

You can also install extensions within Firefox browser, just like chrome – here are the very best Firefox VPN extensions we’ve tested.

Sometimes abbreviated as FVEY, Five-Eyes is an intelligence alliance made up of Australia, Canada, New Zealand, the United Kingdom, and the United States.

The countries work together to collect mass surveillance data and share it between their respective security organizations, bypassing the laws that prevent them from spying on their own citizens.

Five Eyes’ origins can be traced all the way back to 1941, when the US and UK set out to make plans for intelligence cooperation following the end of the Second World War.

Between 1948 and 1956 the treaty expanded to include Canada, Norway, Denmark, West Germany, Australia, and New Zealand. Norway, Denmark, and West Germany eventually withdrew from the alliance, leaving the five nations that we know today. ‘Five Eyes’ is shorthand for ‘For AUS/CAN/NZ/UK/US eyes only’ – a level of security clearance.

Since then the alliance has played a major role in the Cold War, the post-9/11 ‘War on Terror’, and other major political events.

Five Eyes has also had its fair share of controversies. It has a long history of conducting intrusive and extensive spying on well-known celebrities and politicians, including Charlie Chaplin, Nelson Mandela, and Diana, Princess of Wales.

Read more about Five Eyes, Nine Eyes and 14 Eyes in our guide, and try to avoid VPN providers based in any of these countries – unless they operate a zero-logs logging policy.

Restricting access to web content based on the user’s geographical location. For example, BBC iPlayer is only accessible to UK residents, and Hulu is only available in the US.

It is also used by governments in high-censorship countries to block websites that are deemed inappropriate or those that are illegal under local laws.

VPNs can be used to access content that isn’t usually available in your country, however you must be careful not to infringe any copyright laws or violate any terms of service.

Using software to change your virtual location is commonly known as ‘geo-spoofing’, and is one of the most popular reasons to use a VPN.

You can also geo-spoof by using a proxy. If all you want to do is access content unavailable where you are then proxies are fine, but be warned that your data won’t be encrypted while doing so, and you’ll be publicly visible.

The most commonly used name for the Chinese government’s vast, advanced internet censorship apparatus.

Just as the Great Wall was designed to keep intruding armies out of the country, the Great Firewall is designed to prevent outside internet from reaching the people of China.

It’s the most advanced, most large-scale example of government web censorship in the world. Thousands of websites are blocked, including many that those in unrestricted nations would take for granted, like Google and Wikipedia.

The Great Firewall is so advanced that the overwhelming majority of VPNs can’t even get around it. Our reviews have uncovered a small number of VPNs that can grant reliable, open internet access in China, but even then some will need to be downloaded before you enter the country as the Great Firewall blocks the providers’ websites.

A more secure version of HTTP, the protocol that is the foundation of the web. ‘HTTP’ stands for ‘Hyper Text Transfer Protocol’ – the ‘S’ in ‘HTTPS’ stands for ‘Secure’.

Hypertext is any sort of online content which links through to other content – without it, the internet is just an entirely separate and disconnected assortment of web pages. You’ll see either HTTP or HTTPS at the start of the URL of almost every website you visit. To understand the difference, you need to how HTTP actually works.

Put simply, HTTP is a series of requests and responses. When you attempt to access a website, the ‘client’ (your web browser) sends an HTTP request to the ‘server’ (where the website you want to access is hosted). The server then returns a ‘response’ to the client – this response is usually the resource requested, i.e. a website.

When this transaction takes place over HTTP, rather than HTTPS, it is entirely unencrypted. That means that not only can hackers view the contents of the request and response (known as an eavesdropping attack), but they could potentially hijack the process and insert whatever data they want instead of the requested response (known as a man-in-the-middle attack).

HTTPS uses secure port 443 by default and encrypts all user data, making it far less vulnerable to these attacks.

Previously it was mainly used by banks and online retailers, but it’s now the norm for mainstream websites. If you ever find yourself on a standard HTTP website then it’s a good sign that either the owner has forgotten to keep it updated or that the site is outright dangerous.

When you visit a HTTPS website, anyone monitoring your activity can tell that you’ve visited the site, however they won’t be able to see anything specific that you’ve done, such as the pages you visited or any details that you entered into forms.

Look for a padlock icon in your browser’s URL bar and try to only use websites where the address begins with https://

As defined by Access Now, an internet shutdown is an intentional disruption of internet or electronic communications, rendering them inaccessible or effectively unusable, for a specific population or within a location, often to exert control over the flow of information.

Internet shutdowns are remarkably common, all over the world. While they may often be associated with totalitarian or discriminatory governments, we have, on occasion, seen internet shutdowns from otherwise-democratic governments in an attempt to stop access to or the spread of hate speech or dangerous content.

Internet shutdowns are rarely total in nature – they’re often confined to specific regions, specific websites, or specific providers.

A unique numerical address given to your internet connection by your ISP.

These can be ‘rotated’ (changed) on a regular basis or randomly reassigned every time a connection resets, but everything you do online is linked to one.

One of the main reasons for using a VPN is to mask your true IP address so that your browsing activity can’t be traced back to you as an individual, protecting you from unwanted surveillance from your ISP and other third parties.

There are two types of IP address: public and local. The vast majority of the time, when we talk about IP addresses we’re referring to public IPs.

Public IP addresses assigned by your ISP will apply to all the devices connected to your network. That means that, for example, your smartphone and your laptop look the same to your ISP.

Local IP addresses are assigned by your router to all of the various devices connected to it as a means of telling them apart. They’re only visible to those on that network, and are rarely something you need to worry about.

IP addresses aren’t purely virtual – they’re also tied to physical locations. This is how VPNs work to get you around geo-blocked content. They can assign you an IP address from a server in a different country, meaning that any website or service trying to see where you are will be none the wiser.

This happens when a device running a VPN ends up contacting a default server, rather than the intermediary VPN server it was supposed to.

The result is that websites or apps you’re using can see your real IP address instead of the one your VPN has assigned you.

You can test for IP leaks by reading our leak-testing guide – tests take less than a minute and require very little technical knowhow, so don’t be put off by the idea of it.

In order to prevent this happening you should select a VPN provider that offers DNS and IPv6 leak protection, such as CyberGhost.

Short for Internet Protocol Version 4. The current default system for defining numerical IP addresses (see our definition of DNS above).

First devised in 1983, IPv4 is based around a 32-bit address scheme, meaning that it there are 2³² addresses available – that’s almost 4.3 billion. 94% of all internet traffic flows through IPv4 addresses.

An IPv4 address will look something like this: 198.51.100.1

The trouble is, the internet has exploded exponentially in popularity since IPv4 was first created, and now addresses are running out as only a limited number were available for assignment.

This is where IPv6 comes in (see below).

Internet Protocol Version 6, a new standard introduced to solve the problems presented by IPv4. It utilizes 128-bit rather than 32-bit internet addresses, meaning the total number available is absolutely enormous: compared to IPv4’s 4.3 billion, IPv6 has over three hundred and forty undecillion. In terms of practical application, it’s essentially inexhaustible.

An IPv6 address will look something like this: 2600:1005:b062:61e4:74d7:f292:802c:fbfd

IPv6 is still fairly niche, though, and unfortunately a lot of VPNs fail to direct IPv6 traffic through the VPN tunnel. If you connect to a website that supports IPv6, your DNS request can be handled by your ISP, therefore exposing your true IP address.

Some VPN services that don’t work on IPv6 connections block your internet connection altogether in order to stop your IP from being revealed.

Look for providers that either work on IPv6, like Mullvad, or that offer IPv6 leak protection, like IPVanish.

The company that supplies your internet connection. Unless you use a VPN, your internet data remains unencrypted, meaning your ISP can see everything you’re doing online.

ISPs in many countries (notably the US, most of Europe, Australia and Russia) are legally required to store customer metadata to allow government access if necessary.

Some ISPs even monitor internet traffic in real time and feed it directly to law enforcement agencies and intelligence networks.

A feature offered by most popular VPN providers, a kill switch prevents your true IP address from being exposed should the VPN connection drop for any reason.

Some VPNs allow you to choose certain sites or apps to bypass the kill switch (known as split-tunnelling) however most will simply cut off all internet connections until the VPN tunnel is re-established.

Note that not all providers will call it a kill switch, for example ExpressVPN calls it a ‘Network Lock’. Some VPNs come with a kill switch built in, like CyberGhost, which is great if you might otherwise forget to switch it on.

Wherever possible, you should try to choose a provider that offers this feature. Even the most reliable of VPNs can experience drops or disconnections, and your hardware can also be just as guilty – it’s always better to be safe than sorry.

Layer 2 Tunneling Protocol is a commonly used VPN protocol that’s built into most popular operating systems.

It’s quick and easy to set up and is secure enough if implemented correctly. There are some concerns that the NSA (US National Security Agency) might have deliberately weakened it, although this isn’t backed up by any solid evidence.

L2TP itself is actually unencrypted, which is why it’s usually bundled together with IPSec (Internet Protocol Security) to created the simple, secure L2TP/IPSec.

There are no major vulnerabilities to note, but if you’re planning to use it in a high-censorship country you could have some issues, as it isn’t very effective at bypassing firewalls due to communicating over the easily-blocked UDP.

Where possible, you should stick with OpenVPN.

Any information collected or retained by your ISP or VPN provider. This is usually spelled out in its privacy policy or terms and conditions.

Some VPN providers incorrectly claim to be ‘zero logs’, so it’s vital make a clear distinction between those that don’t collect logs and those that do.

Not all logs are bad – we don’t judge a provider too harshly if it solely collects connection metadata to help it run its service better (for example how many users are connected to a server at once, or how much data you consume over the course of a month).

So long as that data is entirely anonymous and can neither be traced back to you nor reveal your activity in any way, that top-level logging is largely harmless.

What we absolutely don’t want to see logged by a VPN, though, is:

• Your real IP address
• Unique information about your device (such as your smartphone’s IMEI number)
• The IP addresses of sites you visit
• DNS requests you make while browsing
• Detailed connection timestamps

All of these things can be used to identify you, should they fall into the wrong hands. There are plenty of other things that VPN providers can log, too, but we believe that those are the absolute worst.

If a VPN does collect logs, we also want to see them deleted in a timely fashion – ideally as soon as your session is over. Some providers can hold on to them for months, or even indefinitely.

It’s best to choose a provider that collects a minimal amount of logs to protect your online privacy, or even better a VPN that doesn’t collect any logs whatsoever, such as NordVPN. This way, everything you do online remains completely private and can in no way be traced back to you as an individual.

Unsure if your VPN is logging too much? We go into greater detail in our guide to VPN logging policies.

Ordinarily, when using a VPN, your web and app traffic travels from your device, to the VPN server, then on to its destination point.

Multi-hop VPN is a feature that routes your traffic via two different VPN servers instead of just one. These servers are usually in totally different parts of the world.

The goal here is added security – the more points your traffic jumps between before unencrypting itself at the destination, the harder it is to track. It’s a similar concept to Tor.

While added security is always appreciated, the downside to multi-hop VPN is that it makes your connection much slower, as your traffic has to travel double the distance.

We don’t think that multi-hop VPN is strictly necessary, and 99% of users will be fine using a standard VPN connection, but it can be useful in certain circumstances (where anonymity is an absolute must, or when you want to bypass censorship).

Some high-quality VPNs that offer a feature like this are:

• ibVPN
• NordVPN
• Surfshark
• TunnelBear
• VPNArea
• VPN.ac

A popular term used when discussing the visibility of VPN traffic.

While VPNs do a terrific job of encrypting and shielding your data, they’re also quite obvious when they do it. Many websites, services, or anyone observing the flow of information are able to tell when a traffic is regular and unencrypted, and when it’s being run through a VPN.

Obfuscation is the act of masking that VPN traffic, passing it off as regular data from a regular internet user.

This is most important when trying to work around government censorship blocks in countries like China. Their censorship setups are so advanced that standard VPNs will be detected – advanced obfuscation technologies are required to sneak by undetected. Only a handful of top quality VPNs have the obfuscation necessary to do so.

Open source software is a product built with source code that is freely available for anyone to inspect.

We love seeing VPNs which are open source, as it means that technically proficient users, security buffs, and white hat hackers can inspect the VPN at its most basic level to check for weaknesses. Being open source also means that a provider can’t lie about the capabilities or activities of its VPN and get away with it.

Some top-tier examples of open source VPNs are ProtonVPN and Private Internet Access. Our favorite VPN protocol, OpenVPN, is also open source.

The industry-standard VPN protocol and the one we recommend you use wherever possible.

OpenVPN is an open-source software that’s highly configurable and offers the best balance between performance and privacy.

OpenVPN encryption is comprised of two parts: data channel and control channel encryption. Data channel encryption secures the data itself, while control channel encryption uses TLS to secure the connection between your computer and the VPN server. You can find out how exactly this works in our guide to VPN encryption.

It isn’t natively supported by any platforms, but is available on most of them through third-party software. The majority of VPN providers will offer custom apps that run on OpenVPN – we do all of our speed testing over OpenVPN.

It runs best on a UDP port, but can be set to run on any, including TCP port 443, which is the port used by regular HTTPS traffic.

While OpenVPN in its default configuration is blocked in high censorship countries like China, it continues to work well combined with some form of custom obfuscation. ExpressVPN, Astrill, and VyprVPN, for example, all do this.

P2P is a type of network in which computers or other devices share files with each other rather than downloading them centrally from a server.

Even before a file download is complete, devices in the P2P network will upload parts of the file to other devices requesting that file. This data transfer continues even after the initial download is complete, which can make large P2P networks an incredibly efficient means of sharing data.

There are different types of P2P platforms or systems, many of which revolve around large media files, often causing copyright infringement issues – you’ll likely have heard it referred to as torrenting.

Some of the most popular uses of P2P networks today are torrenting, Kodi and services like Popcorn Time. It’s important to remember that not all P2P is illegal, though. Far from it, in fact, as so long what you’re sharing isn’t copyright protected then it’s totally legal.

Every time you connect to a VPN, the client (your VPN app) and the VPN server exchange a key. This key allows both parties to decrypt the data being transferred between themselves – in this instance, that data is everything you’re doing online.

Obviously it’s imperative that that key is kept 100% private. If a hacker or spy were to intercept it they would be able to see everything you’ve done while connected to your VPN.

Ordinarily, there’s one ‘master key’ that your VPN will use when you connect. This is where Perfect Forward Secrecy (sometimes referred to as PFS) comes in to play.

Perfect Forward Secrecy guarantees that your VPN is generating a brand new key every time you connect to it. That means that, should the very worst happen, a hacker would only have access to your data from the very most recent session, rather than every connection you’ve ever established.

With the level of encryption employed by most VPNs it’s incredibly unlikely that their keys will ever be cracked. Still, Perfect Forward Secrecy is a very useful extra step to take in protecting yourself online.

Plenty of VPNs use PFS. There are a number that make it explicitly clear on their websites, while a load more will be using it without actually promoting it. Some of our favorite VPNs with PFC are:

• ExpressVPN
• IPVanish
• Private Internet Access
• Hotspot Shield

Your home router has something called a NAT firewall built into it. As the router acts as a gateway between all your devices and the internet, it’s the NAT firewall that determines which traffic is meant for which specific device. It also blocks out unwanted traffic.

The NAT firewall does this automatically – port forwarding allows you to configure it manually.

Of the 60,000 or so ports on your router, the first 1,000 are dedicated to a specific set of common functions. The majority of the remainder can be assigned to whatever you like.

Assigning a port to a specific device on your network allows your router to create a direct connection between it and the desired destination (be it a website or another device).

Some of the most common reasons to set up port forwarding are to connect to a gaming server, connect to an internet of things device, or to improve torrenting P2P connections.

This direct line of communication would usually mean leaving your device’s identity and IP address exposed, but by doing so over a VPN you ensure that an open connection is maintained while your IP address remains anonymized.

While open ports are great for speed, they can also pose a security risk. Some VPNs don’t permit port forwarding, as they aim to protect you from unwanted web traffic.

PPTP, or Point-to-Point Tunneling Protocol, is an outdated VPN protocol with lots of known security issues.

First introduced in 1995, PPTP is available on almost all major platforms and is very easy to set up without the need for third-party software, and its simplicity, versatility, and speed mean that it’s still offered by a large majority of VPN providers.

However, PPTP is highly insecure. In fact, it’s probably the least secure VPN protocol out there.

It’s been proven that the NSA has managed to crack it, hackers can extract Windows NT password hashes from its authetication process, it’s extremely vulnerable to dictionary attacks, and all of this is well known – making PPTP a target.

We recommend that you use virtually any other protocol rather than PPTP – OpenVPN is our favorite.

 

A proxy server acts as an intermediary between your computer and the internet, so any traffic routed through it will appear to come from an IP address different from your own.

While this may sound a lot like using a VPN, proxy connections are not encrypted.

While the website you’re visiting won’t know your true IP address, your ISP will still be logging your activity. The owner of the proxy server will also be able to see your originating IP address, and hackers will still be able to intercept your traffic.

Proxies are extremely popular for getting around content geo-blocks, as they change your virtual location quickly and simply, with no slowdown and (usually) at no cost. While they’re fine for this purpose, we would still recommend a good VPN that can do all that while also keeping your traffic encrypted.

Most VPN browser extensions are proxies, so check our reviews before you start using one. They’re handy for heavy browser users just looking to mask their IP address, however most of them aren’t VPN substitutes.

The only VPN provider with browser extensions that encrypt your web traffic is ExpressVPN, with extensions for Chrome, Safari, and Firefox.

Secure Sockets Layer (SSL) is the standard technology used for establishing an encrypted connection between two systems. This could be between a web server and a client (e.g. an e-commerce website and a browser) or server to server (e.g. an application that processes financial details).

This connection ensures that all data passing between the two parties remains encrypted, private, and whole, and prevents malicious parties from reading or modifying the information transferred.

In order to create an SSL connection, a web server requires an SSL Certificate. To receive this, you will be required to answer a number of questions regarding the identity of your website and your company. The server will then create two cryptographic keys: a Public Key and Private Key.

Along with your website’s details, the Public Key is then placed into a data file called a Certificate Signing Request (CSR), which you can then submit to a certification authority like Let’s Encrypt. This third party will then validate your details and issue you with an SSL Certificate, allowing you to use the protocol on your website. Your server will match your issued SSL Certificate to your Private Key, and will then be able to establish an encrypted link between the website and a user’s web browser.

When a browser connects to a secure website it will retrieve the site’s SSL Certificate and ensure it up-to-date, is issued by an Authority the browser trusts, and it is being used for the correct website. If it fails any of these checks, the browser will display a warning to the user that the site is not secured by SSL.

When a website is successfully secured by an SSL certificate, HTTPS (Hyper Text Transfer Protocol Secure) will appear in the URL. The details of the certificate can be viewed by clicking on the lock symbol in the browser bar. 

TLS (Transport Layer Security) is an updated, more secure version of SSL. While many still refer to their security certificates using the term SSL, when you are implementing SSL from an authority today you are actually using the most recent TLS certificates.

If you’d like to look into the configuration of any SSL server on the web, you can use an independent auditing tool like Qualys SSL Labs, which will assess and rate the SSL/TLS connection of any given server.

The assignment of multiple users to a single IP address.

Ordinarily, your IP address is unique to your router, so is solely allocated to the devices and people connected to it.

A shared IP address makes its more difficult to pin down a single user, therefore increasing privacy.

This is a key principle of VPNs, and why some don’t invest heavily in a large number of available IP addresses. On the one hand, a small number of IP addresses can result in slowdown during busy periods but, on the other, it also leads to a greater level of privacy due to the sheer number of people using it.

When you pick a VPN, decide which of those two factors matters most to you.

Sideloading, as the name suggests, sits somewhere between uploading and downloading.

It’s most commonly used when referring to the installation of apps on Android devices that aren’t officially listed on the Google Play Store.

These apps have to be downloaded as .APK files, and then installed (or sideloaded) from a separate app or device.

In VPN terms, this means installing the APK of your VPN onto an Android device (most likely a Fire TV Stick or an Android TV device) using a file manager app in order to find and load the APK file.

The number of devices you can use your VPN on at the same time.

The more simultaneous connections a VPN provider allows the better, as it means you can protect all of your household or family’s devices, as well as your own.

Between three and five simultaneous VPN connections is standard, but watch out for restrictions on the most basic or free plans, which limit you to just one.

A handful of VPN providers, such as Surfshark, don’t place any restrictions on the amount of devices connected at the same time.

Smart DNS is a tool which, much like a VPN or proxy, allows you to appear to be connecting to a website or service from a different part of the world than where you actually are.

The difference here is that, rather than change your IP address, Smart DNS changes the DNS server that your traffic is routed through (you can learn more about DNS in our glossary entry here).

By re-routing your DNS requests, your true location is kept a secret and previously blocked sites are now made available. Beware, though, that Smart DNS does not encrypt your traffic like a VPN does.

The lack of encryption does make Smart DNS fast, though, and it’s also geared for easy use on devices that usually lack native VPN apps, such as games consoles, Apple TV, and other streaming devices.

A popular VPN feature that allows you to control which apps or programs travel outside of the encrypted VPN tunnel.

It may seem counter-intuitive to deliberately leave some of your traffic unencrypted and personally-identifiable, but there are some circumstances where split-tunneling is necessary.

Certain services may not work unless they think that you’re in the correct real-world location (like online banking), while some services actively detect and block VPN traffic (like Amazon Prime Video).

Simply use split-tunneling to route these apps outside of the VPN and they’ll work exactly as normal – just beware that they won’t be encrypted.

Some VPN providers offer static IP addresses, often for an extra monthly premium.

Ordinarily, the address assigned to you by a VPN is dynamic. That means that it’s randomly assigned every time you connect.

With a static IP address, however, you’re guaranteed to be connected to the same IP address every time – a bit like how your home router has the same fixed IP address.

There are pros and cons to using static VPN IP addresses. On the positive side, a static IP address:

• Guarantees faster speeds as you’re the only person connecting to it.
• Can help with unblocking geo-restricted content, as its traffic patterns resemble normal web traffic more so than VPN traffic.
• Can making using online services a smoother experience – some can take issue with frequently-shifting IP addresses on one account.

There are some crucial downsides to static IP addresses, though:

• They’re explicitly linked to you. If you want to use a VPN for anonymity then a static IP address is the complete opposite of that. Even if the VPN provider doesn’t keep usage logs your activity could still all be traced back to you.
• They’re tied to one region. A static IP address stays in place – that means that if you want to connect to a server in a different country you’ll have to use a different (shared) IP address.
• They cost money. It’s usually considered an extra service, and some VPN providers don’t even offer them.

We personally believe that you shouldn’t be using a static IP address. VPNs are a privacy tool first and foremost and a static IP address runs directly contrary to those principles. However, they can have their uses – only you can say whether or not it’s the right choice for you.

TCP stands for ‘Transmission Control Protocol’, and it’s one of the two protocols that OpenVPN can run over (the other being UDP).

TCP is viewed as the more reliable of the two OpenVPN protocols.

When packets of data are transferred over TCP, the client (i.e. the device sending it, like your smartphone) waits for confirmation that the packet has been correctly received, before then either sending the next one or resending the failed packet.

This guarantees the transaction to be completed properly, but it comes at a cost to its speed. As TCP’s checks involve data being sent back and forth, the further you are from the VPN server the greater the slowdown will be.

If you’re using a VPN to stream content over great distances, or to game on faraway servers, then you should use UDP instead. For everything else, TCP is a good choice (the VPN in question even lets you choose between the two of them, that is – many don’t).

Speed throttling, or bandwidth throttling, is when your ISP intentional slows down the speed of your internet connection. This is usually used as a way of regulating network traffic and therefore minimizing potential bandwidth congestion.

Often, ISPs will detect users taking part in high-bandwidth activities such as streaming or torrenting and intentionally throttle their traffic to even out the usage across the network. A good VPN service will prevent this from happening as your ISP won’t be able to see what you’re doing online.

Free software that anonymizes your browsing, Tor stands for ‘The Onion Router’.

While it’s best known for providing access to the Dark Web, it’s actually becoming increasingly common among everyday internet users seeking the highest possible levels of privacy.

It’s also an excellent way of bypassing government restrictions and accessing blocked content in high-censorship countries, however be warned, it is incredibly slow.

Tor can be used to access .onion websites, which is the suffix of pages on the Deep Web (instead of the usual suffixes like .com or .org). These websites are entirely inaccessible through standard web browsers (like Chrome or Edge) without additional software.

When you request a service or website through the Tor browser, your request is wrapped in multiple layers of encryption. It’s then bounced through three or more randomly selected nodes on the Tor network.

Each node decrypts and forwards the request to the next server in the chain. The last node – known as the exit node – performs the final decryption, reads the content of the transmission (for example, the URL you originally requested), and sends it to the destination server.

As a result, users are completely anonymized. Someone spying on the exit node may be able to see what site was visited, but they would have no way of knowing who visited it.

Connecting to Tor through a VPN is an excellent way of ensuring your security, and some VPN providers actually offer servers optimized for that purpose.

We explore the differences between Tor and VPN, plus the pros and cons of each, in our dedicated guide.

First defined in 1999, TLS is a proposed Internet Engineering Task Force (IETF) standard that builds on earlier SSL specifications to provide secure communications over a network. Websites, email services, instant messengers, and VoIP services can use TLS to secure all communications between their servers and a user’s browser.

The protocol primarily aims to provide privacy and data integrity between two or more communicating applications. When secured by TLS, connections between a client (e.g. a web browser) and a server (e.g. wikipedia.org) are encrypted, authenticated, and regularly checked for integrity.

The technology is comprised of two layers: the TLS record and the TLS handshake protocols. The former provides connection security, while the latter enables the server and client to authenticate one another and to negotiate encryption keys before any data is transmitted.

TLS is more efficient and secure than SSL thanks to stronger authentication, encryption, key-material generation, and a range of other processes. This includes the use of secure remote passwords, pre-shared keys, elliptical-curve keys, and lots more — all of which SSL does not support. TLS and SSL are not interoperable, but TLS does offer backward compatibility for older devices. 

In addition to the properties above, certain configurations of TLS can provide additional privacy-related features such as ‘perfect’ forward secrecy, which ensures that future disclosure of encryption keys cannot be used to decrypt TLS communications recorded in the past.

UDP stands for ‘User Datagram Protocol’ and, along with TCP, is one of the two different protocols used by OpenVPN.

Unlike TCP, which employs a reliable method of checking that data packets have all been communicated between your device and the VPN server, UDP employs no such error correction.

That means that data sent over UDP is either sent and received very quickly – or with errors.

As a result, we recommend that you use UDP for tasks like streaming or gaming, where lag-free data transmission and fast download speeds are a priority.

For any other task, though, TCP is preferable due to how reliable it is. Many VPN providers don’t let you choose between the two when you use OpenVPN, but it’s always worth checking.

Uniform Resource Locator, otherwise known as a website address to you and me (e.g. www.top10vpn.com or www.google.com).

Technically speaking, URLs are addresses made of words and numbers, which are then converted into IP addresses by a DNS translation service so they can be understood by your computer.

You’ll see a URL at the top of every webpage in your browser’s search bar. URLs can be broken down into several key components. Let’s take https://www.top10vpn.com/ as an example to better understand how they work.

• https:// is the ‘scheme’. It details what protocol has to be used in order to fetch the information you’re attempting to access (the information, in this instance, being the website you’re on right now).
  HTTPS is a more secure version of HTTP – the vast majority of the URLs you visit will use one of these two.The : indicates the end of the scheme, while the // signifies the start of the hostname (i.e. the website you’re looking for).If you’re confused as to why there’s two slashes, you’re not alone – there’s actually no good reason. The inventor of the internet, Sir Tim Berners Lee, has even apologized for the use of them.
• www. defines the location of the content – in this case, the rest of the URL that follows is hosted on the world wide web.
• top10vpn is the domain name.
• .com is the domain suffix, and tells you what sort of website you’re visiting, or its location. For example, ‘.gov’ indicates a government organization, while ‘.co.uk’ indicates a site based in the United Kingdom.
• Anything that follow after that dictates where the content can be found on the server that hosts the website. It works just like your computer does, like when you access the C: drive and then browse to /User/My Documents/ to find a specific file, for example.

Short for Virtual Private Network, they give you privacy and security online, unblock restricted content, and allow you to appear as if you were connecting to the web from another country.

It does this by encrypting your internet connection and diverting you via a remote VPN server in order to replace your IP address.

This is just a top-level explanation, though. We explore VPNs in much greater detail in our dedicated guide, ‘What is a VPN‘, including more technical information and the reasons why you you should you use one.

The software that you use to connect your device to a VPN server.

The term “VPN client” is generally used to refer to a VPN provider’s desktop or mobile application.

Be careful not to confuse this with the general computational use of the word ‘client’, which would be referring to your hardware (like your desktop computer or smartphone) rather than the software running on it.

The processes and sets of instructions VPN clients rely on to establish secure connections between a device and a VPN server in order to transmit data.

A VPN protocol is a mix of transmission protocols and encryption standards. Read our ‘Guide to VPN Encryption‘ for a more detailed explanation of how these protocols work.

Popular VPN protocols that you’ll regularly see from numerous providers include:

• PPTP
• L2TP/IPSec
• IKEv2/IPSec
• OpenVPN
• IPSec
• SSTP
• SoftEther
• Wireguard

OpenVPN is our protocol of choice, thanks to its excellent combination of security and speed.

A common term for the encrypted connection between your device and a VPN server.

It’s often referred to as a metaphorical ‘tunnel’ because it can’t be breached, its entirely opaque, and it can take you from your physical location to an entirely different geographical one.

Commonly found in cafés, hotels, and airports, these are public internet access points that can be used by anybody and everybody.

While they’re undeniably useful if you don’t want to use up your data allowance when you’re out and about, a major downside is that they are not secure.

It’s easy for hackers to set up fake hotspots that look like the real thing, detect your web traffic as it travels from your device to the hotspot, or hack the router itself.

The only way to protect yourself when using these free WiFi hotspots is to first connect to a VPN, as this will encrypt your internet connection so it cannot be intercepted by anyone else.

That said, if the public network you’re using requires any sort of password then you should be safe.