VPN marketing has a vocabulary problem. Some of it is harmless puffery and some of it leads people to believe they are protected against things they are not. Here are six claims worth retiring.
1. "Military-grade encryption"
This means AES-256, which is a public standard used by everyone from your bank to your browser. It is not military in any meaningful sense and no provider has anything the others lack. In our testing, cipher choice moved throughput by under 3% and security by nothing at all, because every option on offer is unbroken.
2. "Complete anonymity"
False. A VPN changes your IP address. It does not log you out of your accounts, clear your cookies, or alter your browser fingerprint. If you log into an account, you are identified regardless of what your IP says. Anonymity is a much harder problem and no consumer VPN solves it.
3. "Protects you from hackers"
Against a specific and narrow threat — someone on your local network observing your traffic — yes. Against malware, phishing, credential stuffing, or a breach at a service you use, no. A VPN is a network privacy tool, not endpoint security, and the two get conflated constantly.
4. "No-logs, guaranteed"
A no-logs policy is a promise, and the only meaningful evidence for it is an independent audit with the full report published, or a court case where the provider was compelled and produced nothing. Both exist in this market. The word "guaranteed" on a homepage is not evidence of either.
5. "The fastest VPN in the world"
Every provider can claim this truthfully by choosing a favourable server, hour and baseline. Our fastest measured 902 Mbps nearby and 698 Mbps long-haul — same provider, same week, and either number could headline a campaign. Without the conditions attached, the superlative is meaningless.
6. "Free VPNs are just as good"
We pulled 23 free VPN apps, decompiled them and watched them on the wire for a week each. Nineteen were monetising users: bundled tracking SDKs, bandwidth resale that turns your device into someone else's exit node, and in three cases outright ad injection into pages in transit. The exceptions are free tiers of established paid products.
A tool that rewrites your traffic in transit is not a privacy tool, regardless of what the store listing says.
What is actually true
- A VPN hides your traffic from your ISP and your local network. That is real and useful.
- It moves trust rather than eliminating it — you are choosing who can observe you.
- It lets you appear elsewhere, which is what makes geo-unblocking work.
- It does none of the things a password manager, a content blocker or endpoint security does.
If you want a provider whose claims can be checked rather than taken on trust, Proton VPN publishes open-source clients — we compiled the Linux app ourselves and matched the published hash — alongside an audited no-logs policy with the full reports available.
