Overview
What we’re reviewing: Proton VPN from Switzerland‑based Proton AG (maker of Proton Mail and Proton Drive). Apps are available for Windows, macOS, iOS, Android, Linux and as browser helpers. Proton positions itself as a privacy‑first VPN with multi‑hop (Secure Core), DNS‑level filtering (NetShield), Tor‑on‑VPN options, and WireGuard as the everyday protocol.
- Headquarters / jurisdiction: Switzerland (Proton AG)
- Protocols: WireGuard and OpenVPN (IKEv2 availability varies by platform)
- Notable features: Secure Core multi‑hop routing, NetShield DNS filtering (ads/trackers/malware), kill switch, split tunneling, Tor‑over‑VPN servers, P2P on designated servers
- Free tier: Yes — limited locations and features
Bottom line: Proton VPN remains a defensible choice for privacy‑minded users in mid‑2026. It’s engineered for threat modeling and verifiable operational behavior, not marketing promises of instant anonymity. The core strengths—readable documentation, multi‑hop options, and modern protocols—are still useful as adversaries and detection systems evolve.
Background
Proton AG grew from the Proton Mail team and keeps privacy engineering visible in product decisions: design notes, public documentation, and a preference for features that reduce correlation risk. That ethos matters because the context for VPNs changed significantly between 2023 and 2026: anti‑VPN detection has become more sophisticated (often using machine learning signal correlation), browser fingerprinting techniques have advanced, and IPv6 and QUIC adoption widened the surface for leaks.
Target audience: People who value a privacy posture they can understand and test: journalists, researchers, activists, frequent travelers, and technically inclined users who want modern protocol performance with options for higher assurance (multi‑hop, Tor). If your main priority is simply unblocking streaming catalogs, plan for variable results and consider providers that focus on that use case.
Features Analysis
Protocols and real‑world performance
WireGuard remains the recommended daily driver: it’s compact, power efficient on mobile, and performs well on congested 5G and Wi‑Fi 6/6E networks. In practice you’ll see lower CPU use and faster handshakes than older setups. OpenVPN still has practical uses where traffic needs to be disguised or forced through proxy chains. Two practical notes for 2026:
- Check how your client handles QUIC/HTTP3 traffic. QUIC uses UDP and can bypass some tunnel expectations—ensure the client tunnels QUIC or your browser may leak connections in unusual setups.
- IPv6 is widespread now. Confirm Proton’s apps correctly route IPv6 through the tunnel or offer an easy toggle to disable IPv6 at the OS level; IPv6 leaks are a common privacy gap.
Secure Core: the correlation‑risk tool
Secure Core is Proton’s signature multi‑hop option: your traffic first enters a hardened entry node in a privacy‑friendly jurisdiction, then exits where you choose. Think of it like wrapping a second envelope around a letter—more work to trace, but it adds latency. Use Secure Core selectively for higher‑risk tasks (traveling through hostile networks, targeted investigations). For everyday streaming and gaming, stick to single‑hop WireGuard.
NetShield and leak hygiene
NetShield blocks known ad/tracker/malware domains at the DNS layer. It’s efficient and useful on mobile or public hotspots, but it isn’t a silver bullet: it won’t stop browser fingerprinting or trackers loaded from the same domain. In 2026, combine NetShield with browser‑side protections (content blockers, anti‑fingerprint extensions, or a hardened browser profile) and platform DNS encryption (DNS‑over‑HTTPS or DNS‑over‑TLS) to get layered protection.
Kill switch, split tunneling, and test habits
Proton’s kill switch and split tunneling are functionally solid, but the real work is user verification. New leak vectors since 2024—QUIC, IPv6, and aggressive browser caching—mean you should run a short checklist after configuration:
- Connect to Proton and run a DNS leak test (ipleak.net or DNSLeakTest.com).
- Check WebRTC leaks with browser tests (search “WebRTC leak test”).
- If you use IPv6, open an IPv6 test page (search “IPv6 test”) to confirm your global IPv6 address is not exposed.
- Force a QUIC request by visiting an HTTP/3‑enabled site and observe IP via packet capture or a network inspector if you have the skills; otherwise use a conservative approach and disable QUIC in the browser when testing.
Make these checks part of your "set and verify" habit after toggling split tunneling or switching servers.
Tor‑over‑VPN, P2P and operational transparency
Proton’s Tor‑over‑VPN servers remain useful as an on‑ramp when direct Tor is blocked or when you prefer your ISP to see VPN traffic rather than Tor entry nodes. P2P is supported on designated hosts—check kill switch and port‑forwarding behavior before large transfers. For assurances about logs and warrants, check Proton’s transparency materials and any independent audits; a written audit and a clear policy on requests are the usable signals when you model risk.
Pros and Cons (June 2026)
Pros
- Privacy‑first design: Secure Core, Tor over VPN, and NetShield map to concrete threat models rather than marketing slogans.
- WireGuard performance: efficient, low battery impact on modern mobile hardware.
- Layered controls: kill switch, split tunneling, and DNS filtering give practical hardening options.
- Free tier: useful trial option and basic protection on public Wi‑Fi.
- Clear documentation: Proton tends to document design choices in human terms—helpful for verification and threat modeling.
Cons
- Latency with Secure Core: multi‑hop increases round‑trip time—noticeable in gaming and low‑latency calls.
- Streaming and anti‑VPN arms race: detection systems are dynamic; results vary and change frequently.
- Advanced settings need testing: split tunneling, QUIC/IPv6 handling and P2P have platform‑specific pitfalls.
- Value depends on bundles: Proton often packages VPN with Mail/Drive/Pass—evaluate whether you’ll use those extras before committing.
Pricing / Value (June 2026)
Proton continues to offer a free tier and paid plans with incremental features (higher speeds, Secure Core, expanded server access). Pricing changes often with billing cycles and promotions; don’t buy on impulse. Practical steps:
- Compare annualized cost per device across monthly, annual and multi‑year offers.
- Check refund/guarantee terms before subscribing.
- Factor in bundled services—if you already have a password manager or encrypted email, a bundle may duplicate value.
Because rates and promotions change, confirm exact pricing on Proton’s official pricing page before subscribing.
Who It’s For
- Threat‑modelers: users who want tools they can understand, test, and adjust (journalists, researchers, activists).
- Travelers: people who face hostile or surveilled networks and need multi‑hop or Tor options.
- Technical users & Linux enthusiasts: people who will verify kill switches, IPv6 handling, and QUIC behavior.
Who should look elsewhere: if you need the cheapest subscription purely to chase streaming access, consider providers focused on unblocking with larger commercial CDNs—but expect whack‑a‑mole results as detection improves.
Alternatives
- NordVPN: large server footprint, strong performance optimizations, aggressive streaming support.
- Mullvad: minimal data collection and strong anonymity options for purists.
- Surfshark: competitive pricing and unlimited device connections for large households.
Verdict
Proton VPN in June 2026 remains a pragmatic choice for privacy‑minded users. Its strengths—multi‑hop Secure Core, readable documentation, and modern protocol support—map to real threat models. The tradeoffs are straightforward: extra latency for multi‑hop, variable streaming success, and the need for users to test for modern leaks (IPv6, QUIC, WebRTC). If you want a VPN that behaves like a security tool you can understand and verify, Proton is worth evaluating. If your priority is lowest-cost streaming unblocking, evaluate other providers but expect tradeoffs.
FAQ
Does Proton VPN keep logs?
Proton publishes a privacy policy and transparency materials; they state a no‑logs posture. “No logs” can mean different things—avoid a one‑word read: verify the current privacy policy and any recent independent audits against your threat model before relying on the service for high‑risk activity.
Should I run Secure Core all the time?
No. Secure Core adds measurable latency. Use it when your risk profile requires additional correlation resistance (e.g., traveling through surveilled networks, sensitive reporting). For everyday browsing, WireGuard single‑hop is a better tradeoff.
How do I check for modern leaks (IPv6, QUIC, WebRTC)?
After connecting, run DNS leak tests (ipleak.net), WebRTC checks (search “WebRTC leak test”), and an IPv6 visibility test. If you suspect QUIC leaks, temporarily disable HTTP/3/QUIC in your browser during testing or use packet inspection tools if comfortable. These checks should be part of your verification routine whenever you change clients or platforms.
Is Proton’s free plan sufficient?
The free tier is fine for basic protection on public Wi‑Fi and trying out the apps. It lacks Secure Core and full server access; upgrade if you need multi‑hop or larger region access regularly.