Five factors, fixed weights: how a VPN ranking can be reproduced

"Best VPN" lists are some of the most commercially polluted content on the web. Affiliate links decide the order, and the criteria are rarely written down. We tried the opposite: a ranking where the formula is public, every input is a fact with a source, and anyone can recompute a score by hand. This is how the VPN ranking works and what it shows today.

The formula

The Score (0-100) is a weighted sum of five factors:

Factor	Weight
Privacy and security	35%
Network and features	25%
Price and terms	20%
User reputation	12%
Transparency	8%

Each factor is the weighted average of its metrics, and each metric is computed from one published fact using a rule you can read on the methodology page.

Privacy and security (35%)

• Is the no-logs policy independently audited? Yes = 100, No = 0 (weight 3 inside the factor)
• How recent is the latest audit? This year = 100, minus 20 per year (weight 2)
• RAM-only servers (weight 2)
• Jurisdiction of the operating company: Five Eyes countries = 30, Fourteen Eyes = 60, everything else = 100 (weight 2)
• WireGuard, open-source apps, kill switch (weight 1 each)

Network and features (25%)

Number of countries with servers (linear up to 100), simultaneous devices (unlimited = 100, linear from 1 to 10), server count on a logarithmic scale (full score at 10,000) and split tunneling.

Price and terms (20%)

Best monthly price on the longest plan (linear from $1.50 = 100 to $8 = 0), the 1-month price, the money-back window (0 to 45 days) and whether a free plan exists.

Reputation (12%) and transparency (8%)

App Store and Google Play ratings (3 stars = 0, 5 stars = 100, damped when there are few ratings), and whether there is a transparency report plus company age.

Two rules that keep it honest

1. Missing facts score zero. If we can't verify something, it doesn't get the benefit of the doubt.
2. A service is ranked only when at least 70% of its Score is backed by verified facts. That is why IPVanish is not in the ranking yet.

What the data shows today

11 services are ranked (data last updated October 28):

#	Service	Score	Audited no-logs	Jurisdiction	Server countries
1	Proton VPN	85	Yes	Switzerland	140
2	CyberGhost	81	Yes	Romania	100
3	Private Internet Access	78	Yes	United States	113
4	ExpressVPN	73	Yes	British Virgin Islands	113
5	Surfshark	73	Yes	Netherlands	100
6	PureVPN	73	Yes	British Virgin Islands	65
7	IVPN	65	Yes	Gibraltar	41
8	NordVPN	64	Yes	Panama	Not verified
9	Windscribe	63	Not verified	Canada	69
10	TunnelBear	59	No	United States	46
11	Mullvad	55	Not verified	Sweden	50

A few things stand out. Eight of 11 have an independently audited no-logs policy. The top three are separated by seven points, while ranks 4 to 6 are tied at 73. Mullvad is last, and the reason is visible in the table: the no-logs audit is not verified, it is among the pricier long-plan options at $5.57 per month, and the Score only counts what can be checked.

That last point is worth stating plainly. The ranking does not say Mullvad is a bad VPN. It says that, using these public facts and these weights, its measurable score is lower. If your priorities differ from the weights, the factor bars on each company page let you rank by what you care about.

Limitations

• We don't test speed, streaming unblocking or real-world leaks. Those results vary by day, location and network, and cannot be reproduced from a public page.
• Weights are a judgment call. We chose them, published them, and will revise them in the open if the evidence suggests it.
• Jurisdiction is a crude proxy. A Five Eyes country doesn't automatically mean a provider can be compelled to log, and we know this simplification is debatable.
• Some facts are hard to verify. Where an official page can't be read, the cell says "Not verified".

Full ranking, sources and methodology: https://global-rating.com/en/software/vpn/?utm_source=devto&utm_medium=social&utm_campaign=vpn