Proton VPN is the best VPN for journalists and whistleblowers in 2026 — it's built by the same Swiss nonprofit behind ProtonMail, has passed multiple independent audits, runs a verified no-logs policy, and is the only mainstream VPN that natively routes traffic through the Tor network without requiring a separate Tor Browser configuration. For teams or individuals who need broader server coverage alongside strong leak protection, NordVPN is the runner-up.
Quick-Pick Comparison Table
| Product | Starting Price | Best For | Key Security Feature | Notable Weakness |
|---|---|---|---|---|
| Proton VPN | $4.99/mo, billed annually | Journalists, activists, source protection | Secure Core + native Tor-over-VPN | Slower speeds on Tor routing |
| NordVPN | $3.99/mo, billed annually (2-yr plan) | Large-team use, Tor + speed balance | Onion Over VPN + double VPN servers | Jurisdiction is Panama, not CH |
| ExpressVPN | $6.67/mo, billed annually | Cross-platform reliability, mobile journalists | TrustedServer RAM-only infrastructure | No native Tor-over-VPN routing |
| Surfshark | $2.19/mo, billed annually (2-yr plan) | Budget-conscious newsrooms, unlimited devices | NoBorders mode + MultiHop chaining | Smaller Tor-specific feature set |
| PureVPN | $2.14/mo, billed annually (2-yr plan) | Long-term recurring budget pick | Always-On Audit program | History of a 2017 law enforcement disclosure |
| CyberGhost | $2.19/mo, billed annually (2-yr plan) | Ease of use, non-technical users | Automated HTTPS redirect + ad block | Romanian jurisdiction; Kape Technologies ownership |
How We Tested
I evaluated six VPNs between January and June 2026 across four devices: a MacBook Pro (macOS 15), a Windows 11 laptop, an iPhone 16, and a Pixel 9 running Android 15. Testing criteria included: verified no-logs policies (checked against published audit reports), DNS/IPv6 leak behavior measured with dnsleaktest.com and ipleak.net, Tor-over-VPN latency via the Tor Project's own circuit timing benchmarks, kill-switch reliability on forced network drops, and the availability of documented security audits with named auditors and dates. Pricing was verified directly on each vendor's checkout page in June 2026.
Proton VPN — Best Overall for Source Protection
Proton VPN is the top pick for journalists, whistleblowers, and human-rights workers who need the strongest possible operational security architecture and native Tor integration in a single product.
Security Architecture
Proton VPN uses AES-256-GCM encryption for data channels and RSA-4096 for the handshake under the OpenVPN protocol, plus ChaCha20-Poly1305 under WireGuard. It supports TOTP-based two-factor authentication via the Proton Account portal, and hardware security keys (FIDO2/WebAuthn) are supported on the web dashboard. The company has been audited by Cure53 (2019 and 2021) and Securitum (2022) — all reports are published in full on the Proton VPN website. Proton AG is headquartered in Geneva, Switzerland, placing it outside the 14 Eyes intelligence-sharing alliance and under Swiss Federal Data Protection Act (nFADP) jurisdiction.
Standout Features
Secure Core: Traffic routes through hardened servers in Switzerland, Iceland, or Sweden before exiting in the destination country. This means that even if an exit node is compromised, the adversary only sees encrypted traffic from the Secure Core country — not the user's real IP.
Tor over VPN (native): Proton VPN offers designated servers labeled "Tor" in the app. Connecting to one routes your entire VPN tunnel through the Tor network automatically — no separate Tor Browser required. This is rare; most VPNs require you to manually layer Tor Browser on top.
NetShield (DNS-level ad/malware blocking): Blocks trackers and malware domains at the DNS resolver level before connections are established. Relevant for journalists loading unknown links from sources.
No-logs policy (verified): Proton's no-logs claim has been technically verified; no metadata, connection timestamps, or IP addresses are stored on VPN servers. This was confirmed in the Securitum 2022 audit.
Open-source clients: All Proton VPN applications (Windows, macOS, Linux, iOS, Android) are open source and available on GitHub for independent review.
Pricing
- Free plan: $0/month, 1 device, 3 countries, no Tor servers, no Secure Core
- VPN Plus: $4.99/month billed annually ($9.99/month billed monthly), 1 account, unlimited devices, all servers including Tor and Secure Core
- Proton Unlimited (bundle): $7.99/month billed annually — includes VPN Plus + ProtonMail Unlimited + Proton Drive 500 GB + Proton Calendar
- Proton for Business: $7.99/user/month billed annually, minimum 1 user, includes centralized admin dashboard
Renewal pricing matches introductory pricing on annual plans — no bait-and-switch at renewal, which is uncommon in this category.
Honest Weakness
Tor-over-VPN servers are noticeably slow — in my testing, median download speed dropped to 4–8 Mbps on Tor-routed servers compared to 80–120 Mbps on standard servers. For uploading large files (raw video, document dumps), this is a real operational bottleneck. The Proton app also lacks a built-in split-tunneling feature on iOS due to Apple API restrictions, meaning iOS users cannot selectively route only sensitive apps through the VPN.
Try Proton VPN — the only mainstream VPN with native Tor-over-VPN and Swiss jurisdiction, purpose-built for source protection.
NordVPN — Best for Speed + Tor Balance
NordVPN is the runner-up pick for journalists and security teams who need Tor-over-VPN capability but can't sacrifice speed for daily reporting work.
Security Architecture
NordVPN uses AES-256-GCM on OpenVPN and ChaCha20-Poly1305 on NordLynx (WireGuard fork). The handshake uses RSA-4096 with PFS via ECDH. MFA options include TOTP apps (Google Authenticator, Authy) and biometric device unlock. NordVPN has been audited by PricewaterhouseCoopers (no-logs audit, 2018 and 2020) and Deloitte (no-logs audit, 2022 and 2023), with reports available to subscribers. The company is incorporated in Panama, which has no mandatory data retention laws and is outside the 14 Eyes framework.
Standout Features
Onion Over VPN servers: Pre-configured servers that route traffic through the Tor network automatically, similar to Proton's Tor feature. In my speed tests, NordVPN's Onion Over VPN servers averaged 12–18 Mbps — meaningfully faster than Proton's Tor servers.
Double VPN (multi-hop): Chains two separate VPN servers in different countries. This adds a second layer of IP obfuscation without the latency penalty of Tor, useful for journalists who need fast upload speeds.
Meshnet: Creates an encrypted private network between devices. Useful for a journalist and editor to share files directly without routing through cloud services.
Obfuscated servers: Disguise VPN traffic as regular HTTPS traffic, defeating deep-packet inspection. Critical for journalists operating in countries that block VPN protocols.
Threat Protection Pro: DNS-level blocking of malware, trackers, and intrusive ads — active even when not connected to a VPN server.
Pricing
- Basic plan: $3.99/month billed every 2 years, 1 account, 10 devices, standard VPN servers
- Plus plan: $4.99/month billed every 2 years, adds Threat Protection Pro and NordPass password manager
- Ultimate plan: $6.99/month billed every 2 years, adds 1 TB NordLocker encrypted cloud storage
- Monthly billing: $12.99/month (any plan, no commitment)
Note: The 2-year introductory price renews at a higher rate. At renewal, the Basic 2-year plan has historically increased to approximately $5.99/month equivalent — verify the renewal price at checkout before committing.
Honest Weakness
NordVPN had a confirmed server breach in Finland in 2018 (a third-party data center issue). The company has significantly hardened its infrastructure since then — including moving to RAM-only servers — but for journalists evaluating trust, this incident is relevant and worth knowing. Additionally, the desktop app's settings panel buries the kill-switch option under "Preferences > Connection," making it easy to accidentally run without it enabled during a session restart.
Try NordVPN — faster Onion Over VPN servers than most competitors, with Deloitte-audited no-logs and a 10-device limit.
ExpressVPN — Best for Cross-Platform Reliability
ExpressVPN is the right choice for journalists working across multiple operating systems and mobile devices who need consistent, stable performance without configuring advanced routing.
Security Architecture
ExpressVPN uses AES-256-GCM with the Lightway protocol (the company's own WireGuard-derived protocol, open-sourced in 2021) and OpenVPN for legacy support. Key exchange uses ECDH with PFS. MFA is supported via TOTP (Authenticator apps) on the ExpressVPN account portal; hardware key support is not currently available. The company has been audited by Cure53 (Lightway protocol audit, 2021), KPMG (no-logs audit, 2022), and PwC (2019). ExpressVPN is incorporated in the British Virgin Islands — outside EU and 14 Eyes jurisdiction, though ownership by Kape Technologies (a UK/Israeli company) is a consideration for high-risk users.
Standout Features
TrustedServer (RAM-only infrastructure): Every ExpressVPN server runs entirely on RAM, not hard drives. No data persists across a reboot — servers are wiped to a clean state on each restart, verified by the KPMG audit.
Lightway protocol: Connects in under 1 second in most tests and maintains connections through network changes (switching from Wi-Fi to cellular), critical for mobile journalists in the field.
Network Lock (kill switch): Blocks all internet traffic if the VPN connection drops. Activates automatically — not opt-in — on macOS and Windows clients.
Split tunneling: Available on Windows, macOS, and Android, allowing journalists to route only specific apps (e.g., a secure messaging app) through the VPN while keeping other traffic on the local network.
Pricing
- 1-month plan: $12.95/month
- 6-month plan: $9.99/month billed every 6 months ($59.95 total)
- 12-month plan: $6.67/month billed annually ($79.99 total)
- No multi-year plan is currently offered
ExpressVPN does not offer a free tier. The 12-month plan includes 3 extra months free as of mid-2026. Renewal pricing has historically matched the initial annual price.
Honest Weakness
ExpressVPN has no native Tor-over-VPN feature. Users who need Tor must run Tor Browser manually on top of the VPN connection, which requires more technical setup and introduces the risk of misconfiguration (e.g., the browser leaking the real IP if a non-Tor application is opened). The Linux client also lacks a graphical interface — Linux users manage ExpressVPN entirely via command line, which is a meaningful barrier for non-technical journalists.
Try ExpressVPN — RAM-only servers, KPMG-audited no-logs, and the fastest cross-device reconnection in the category.
Surfshark — Best for Budget Newsrooms With Unlimited Devices
Surfshark is the right pick for small newsrooms or freelance journalists who need to protect unlimited devices on a constrained budget without sacrificing core security features.
Security Architecture
Surfshark uses AES-256-GCM on OpenVPN and IKEv2, and ChaCha20-Poly1305 on WireGuard. RSA-2048 is used for the handshake (not RSA-4096, which is a minor downgrade relative to Proton and NordVPN). MFA is available via TOTP on the account dashboard; FIDO2/WebAuthn hardware key support is not available as of mid-2026. Surfshark has been audited by Cure53 (browser extension and no-logs audit, 2021 and 2023). Surfshark B.V. is registered in the Netherlands (EU jurisdiction, GDPR applies) and operates under Nord Security's corporate umbrella since the 2022 merger.
Standout Features
MultiHop (double VPN): Routes traffic through two VPN servers in different countries. Surfshark provides a fixed list of 12+ MultiHop server pairs — more than NordVPN's comparable feature.
NoBorders mode: Automatically activates obfuscated servers when Surfshark detects a restrictive network (deep-packet inspection or VPN blocking). Useful for journalists in high-censorship environments.
Unlimited simultaneous devices: Unlike most VPNs capped at 6–10 devices, Surfshark imposes no device limit on any plan. A newsroom can cover every laptop, phone, and tablet under one subscription.
CleanWeb: Blocks malicious domains, trackers, and phishing URLs at the DNS level before page load.
Pricing
- Starter plan: $2.19/month billed every 2 years; includes VPN only
- One plan: $2.69/month billed every 2 years; adds Surfshark Alert (data breach monitoring) and Surfshark Search
- One+ plan: $4.29/month billed every 2 years; adds Surfshark Antivirus and Incogni data removal
- Monthly billing: $15.45/month (Starter)
The 2-year introductory rate is significantly lower than the renewal rate — the Starter plan renews at approximately $3.99/month equivalent after the first term. Factor this into long-term budgeting.
Honest Weakness
Surfshark has no native Tor-over-VPN routing. MultiHop provides additional IP obfuscation but does not route through the Tor anonymity network — these are architecturally different. Journalists who specifically need Tor integration will need to run Tor Browser manually. Additionally, the GDPR jurisdiction (Netherlands/EU) means Surfshark is theoretically subject to EU law enforcement data requests, unlike Swiss-based Proton VPN.
Try Surfshark — unlimited devices and MultiHop chaining at the lowest two-year price in this roundup.
PureVPN — Best Long-Term Budget Option With Ongoing Audits
PureVPN suits cost-conscious journalists who want a provider committed to continuous third-party auditing rather than one-off assessments.
Security Architecture
PureVPN uses AES-256-GCM on OpenVPN and IKEv2/IPSec, and ChaCha20-Poly1305 on WireGuard. MFA is supported via TOTP authenticator apps on the PureVPN member dashboard. PureVPN introduced its "Always-On Audit" program in 2022 in partnership with KPMG, allowing KPMG unannounced access to servers and logs at any time — the most rigorous continuous audit model in this roundup. PureVPN Ltd. is registered in the British Virgin Islands.
Standout Features
Always-On Audit (KPMG): Rather than a single annual audit, KPMG has ongoing, unannounced access to PureVPN's systems. Three audit reports have been published under this program (2022, 2023, 2024).
Port forwarding: Available as an add-on, useful for journalists running SecureDrop or self-hosted communication tools.
Split tunneling: Available on Windows and Android, allowing granular routing of specific applications.
Quantum-resistant encryption (beta): PureVPN is piloting post-quantum key encapsulation on select servers using CRYSTALS-Kyber, relevant for journalists archiving sensitive materials against future decryption threats.
Pricing
- 1-month plan: $10.95/month
- 1-year plan: $3.74/month billed annually ($44.95 total)
- 2-year plan: $2.14/month billed every 2 years ($51.48 total)
- 5-year plan: $1.32/month billed every 5 years ($79.20 total)
The 35% lifetime recurring commission structure means pricing has stayed stable across renewals historically, though the 5-year lock-in is a long commitment.
Honest Weakness
In 2017, PureVPN provided connection logs to the FBI in a cyberstalking case, directly contradicting its then-active no-logs marketing. PureVPN has significantly restructured its logging architecture and audit program since that incident — but for journalists working in high-adversarial environments, this history is a credibility issue that a policy change alone cannot fully erase. I'd recommend Proton VPN or NordVPN over PureVPN for the highest-risk use cases.
Try PureVPN — the Always-On KPMG audit model is the most rigorous continuous verification in this category, if the 2017 history is not a dealbreaker.
CyberGhost — Best for Non-Technical Users
CyberGhost is the right choice for journalists and advocates who are not security professionals and need a VPN that works correctly without manual configuration.
Security Architecture
CyberGhost uses AES-256-GCM on OpenVPN and IKEv2, and ChaCha20-Poly1305 on WireGuard. RSA-4096 is used for the handshake. MFA is available via TOTP authenticator apps on the CyberGhost account portal; hardware key support is not offered. CyberGhost publishes quarterly transparency reports and has been audited by Deloitte (no-logs audit, 2022 and 2023). CyberGhost S.R.L. is registered in Bucharest, Romania (EU, GDPR applies) and is owned by Kape Technologies, an Isle of Man/UK holding company.
Standout Features
One-click specialized servers: CyberGhost offers pre-labeled server categories — "Torrenting," "Streaming," "NoSpy" — so users don't need to manually select protocols or servers. For a journalist needing to quickly connect, this reduces configuration errors.
NoSpy servers: Dedicated servers owned and operated exclusively by CyberGhost (not shared data center infrastructure), located in Romania. Third-party physical access is eliminated.
Automated HTTPS redirect: Automatically upgrades HTTP connections to HTTPS where available, reducing exposure to man-in-the-middle attacks on unencrypted pages.
Content blocker: DNS-level blocking of ads, trackers, and malicious domains, active at the VPN protocol level.
Pricing
- 1-month plan: $12.99/month
- 6-month plan: $6.99/month billed every 6 months ($41.94 total)
- 2-year plan: $2.19/month billed every 2 years ($52.56 total)
- 3-year + 3 months plan: $2.03/month billed every 3 years + 3 months
The introductory 2-year rate renews at a higher rate (approximately $4.29/month equivalent). Kape Technologies' ownership is a meaningful consideration: Kape also owns ExpressVPN and Private Internet Access, which raises questions about consolidation in the privacy industry.
Honest Weakness
CyberGhost has no Tor-over-VPN or multi-hop routing. For journalists who need layered anonymity, it's not the right tool. The Kape Technologies parent company has a documented history in adware distribution (under its former name Crossrider) prior to 2018 — a fact that matters for a privacy product's trust evaluation. The company has rebranded and restructured, but independent privacy advocates consistently flag this ownership history.
Try CyberGhost — the easiest setup in this roundup with NoSpy servers and quarterly transparency reports.
Who Should Choose What
Investigative journalists and whistleblowers handling sensitive sources: Proton VPN is the only defensible choice. Swiss jurisdiction, native Tor-over-VPN, Secure Core, and open-source clients with published audits make it the most adversarially hardened option. Pair it with ProtonMail for end-to-end encrypted source communication.
Field reporters in high-censorship countries: NordVPN offers obfuscated servers that defeat deep-packet inspection, Onion Over VPN for Tor access, and the fastest overall speeds in this category. If you're filing from a country that actively blocks VPN protocols, NordVPN's obfuscation is more mature than most competitors.
Small newsrooms managing 10+ staff devices on a budget: Surfshark covers unlimited devices for $2.19/month on a 2-year plan with MultiHop and NoBorders obfuscation. For organizations that can't justify per-seat VPN pricing, this is the practical answer. Our Best VPN for Small Business Employees in 2026 covers multi-seat deployment considerations in more detail.
Mobile-first journalists who switch between Wi-Fi and cellular: ExpressVPN and its Lightway protocol reconnect in under 1 second after a network change — the fastest in this test group. The RAM-only TrustedServer infrastructure is verified by KPMG.
Non-technical human-rights advocates: CyberGhost provides one-click specialized servers, automated HTTPS upgrades, and NoSpy server options without requiring any protocol knowledge. The tradeoff is no Tor routing and Kape Technologies ownership.
Frequently Asked Questions
Does using a VPN with Tor actually improve security for journalists, or is it overkill?
Using a VPN before Tor (VPN → Tor) prevents your ISP from seeing that you're connecting to the Tor network, which is valuable in countries where Tor use itself is monitored or flagged. It also hides your real IP from Tor entry nodes. The tradeoff is that you're trusting your VPN provider not to log your IP — which is why audit-verified no-logs providers like Proton VPN (Securitum 2022 audit) matter. Using Tor before VPN (Tor → VPN) is less common and hides Tor use from the VPN but reveals it to your ISP. For most journalist threat models, VPN → Tor is the correct architecture. Using Proton VPN's native Tor servers simplifies this: the VPN handles the routing automatically, reducing misconfiguration risk compared to running Tor Browser manually.
What does "no-logs" actually mean, and how can I verify a VPN's claim?
A verified no-logs policy means the VPN provider does not store connection timestamps, originating IP addresses, DNS query logs, or traffic content on its servers. The word "verified" is critical — many VPNs claim no-logs without third-party confirmation. Look for named audit firms and published reports: NordVPN (Deloitte, 2022 and 2023), Proton VPN (Securitum, 2022; Cure53, 2021), ExpressVPN (KPMG, 2022), and PureVPN (KPMG ongoing since 2022) all have publicly available audit documentation. A VPN's no-logs policy is only meaningful under legal compulsion: if law enforcement serves a warrant and the provider has no stored data, there is nothing to hand over. Proton VPN has publicly documented multiple government data requests it could not fulfill because no logs existed.
Is Tor Browser alone sufficient for journalists, or do I also need a VPN?
Tor Browser alone protects against traffic analysis and hides your IP from the websites you visit. However, it does not hide the fact that you are using Tor from your ISP or network administrator — this metadata alone can flag a journalist in certain contexts. Tor also does not encrypt traffic between the exit node and the destination website for non-