PureVPN
A long-running, budget-priced VPN with a large server network and repeated independent no-logs audits, shadowed by a 2017 case in which it handed connection-correlation data to the FBI.
www.purevpn.com ↗- Jurisdiction
- British Virgin Islands
- Founded
- 2007
- Owner
- GZ Systems Ltd.
- Best price
- $1.99/mo
- Devices
- 10
- Free tier
- No
Best for
- · Budget-conscious users who want a cheap long-term VPN for streaming and general privacy
- · People who value a large server footprint across many countries
- · Users comfortable with audited-but-not-court-tested no-log claims
Not ideal for
- · High-risk users (journalists, activists, whistleblowers) who need a provably court-tested no-log provider
- · Anyone who weighs the 2017 logging incident as a dealbreaker
- · Users requiring fully open-source clients or verified RAM-only infrastructure
Strengths
- ✓Large network (~6,500 servers across ~78 countries) with low long-term pricing (~$1.99/mo on the 5-year plan)
- ✓Four consecutive independent no-logs audits, including a KPMG 'always-on' arrangement permitting unannounced inspections
- ✓Solid feature set: WireGuard/OpenVPN/IKEv2, kill switch, obfuscated servers, own encrypted DNS, split tunneling
- ✓Accepts cryptocurrency and offers a 31-day money-back guarantee
Weaknesses
- ✗2017 FBI case proved it logged and handed over connection-correlation data while claiming 'no logs', a lasting trust mark
- ✗BVI HQ but development/staff historically tied to Gaditek in Karachi, Pakistan; some users distrust the operational footprint
- ✗Several privacy features (port forwarding, dedicated IP) are paid add-ons, not included
- ✗No free tier and only a paid $0.99 7-day trial; RAM-only servers and multihop not clearly documented; the most recent (2023) audit firm was not named
Protocols & encryption
The tunnelling protocols this service offers and the cryptography behind them.
WireGuard
ModernA modern, lean protocol (~4,000 lines of code) that is fast and easy to audit. Its cryptography is fixed and state-of-the-art, with no weak options to misconfigure.
- Data cipher
- ChaCha20-Poly1305
- Key exchange
- Curve25519 (ECDH)
- Integrity
- BLAKE2s
OpenVPN
TrustedThe mature, widely-trusted open-source standard. Flexible and heavily audited over two decades, though slower than WireGuard.
- Data cipher
- AES-256-GCM
- Key exchange
- RSA-4096 / ECDH
- Integrity
- SHA-256 / SHA-512 HMAC
IKEv2 / IPsec
TrustedA fast, stable protocol that reconnects quickly when you change networks, so it is popular on mobile. Built natively into most operating systems.
- Data cipher
- AES-256-GCM
- Key exchange
- Diffie-Hellman (ECP)
- Integrity
- SHA-256 / SHA-384
- Stated data cipher
- AES-256-GCM
- Stated handshake
- RSA/ECDH (OpenVPN, IKEv2, WireGuard); markets 'quantum-resistant' keys
- Perfect forward secrecy
- Yes
- Post-quantum resistant
- Yes
- RAM-only servers
- Unknown
- Kill switch
- Yes
- First-party DNS (leak protection)
- Yes
- IPv6
- Unknown
Post-quantum: Quantum-resistant encryption keys generated via Quantinuum's Quantum Origin platform, deployed with OpenVPN in the Windows/Mac/iOS/Android apps. Limited to servers in US, UK, Australia, Canada, Germany, Netherlands. Note: this is quantum-verified key generation, not a post-quantum KEM (no ML-KEM/Kyber yet); PureVPN says NIST-approved PQ algorithms are still pending.
Full data sheet
Every attribute we track, coloured by whether it helps or hurts your privacy.
| Based in | British Virgin Islands |
| Eyes alliance | Outside 5/9/14 Eyes |
| Enemy of the Internet | No |
| Owner | GZ Systems Ltd. |
| Conglomerate | PureSquare |
| Founded | 2007 |
| Traffic / activity | None kept |
| DNS requests | None kept |
| Timestamps | None kept |
| Bandwidth | None kept |
| Source IP address | None kept |
Privacy policy claims no logging of traffic, DNS/browsing, originating IP, assigned VPN IP, or connection timestamps. These claims have been the subject of four consecutive independent no-log assessments: Altius IT (2019) and subsequent audits by KPMG (first KPMG audit 2021, under a first-of-its-kind 'always-on' clause permitting unannounced inspections), plus a fourth assessment conducted Feb-Apr 2023 (PureVPN's own announcements attribute the 2023 audit to 'a top audit firm' without naming it). The 2023 report did flag that some legacy protocols had briefly retained origin IPs in failed-connection error logs and some timestamps, which PureVPN says were remediated. Importantly, the 2017 Ryan Lin case predates this no-log re-architecture, when PureVPN retained and disclosed connection-correlation data.
| Anonymous signup | No |
| Accepts cash | Unknown |
| Accepts crypto | Yes |
| PGP key | Unknown |
| OpenVPN | Yes |
| WireGuard | Yes |
| Proprietary protocol | n/a |
| Multi-hop | Unknown |
| Obfuscation | Yes |
| Kill switch | Yes |
| First-party DNS | Yes |
| RAM-only servers | Unknown |
| Port forwarding | Yes |
| P2P / torrenting | Yes |
| IPv6 | Unknown |
| Data cipher | AES-256-GCM |
| Handshake | RSA/ECDH (OpenVPN, IKEv2, WireGuard); markets 'quantum-resistant' keys |
| Open-source clients | No |
| Independent audits | 3 |
| Transparency report | Yes |
| Court / seizure-tested | Untested |
Failed in 2017: in the FBI cyberstalking case against Ryan Lin, PureVPN provided connection records that let investigators determine the service had been accessed by the same customer from two originating IP addresses (corresponding to his home and work), contradicting its no-logs marketing at the time. The company subsequently rewrote its policy and commissioned independent audits, but no post-2017 server seizure/subpoena has been documented to test the new no-log architecture under real-world legal pressure.
| Simultaneous devices | 10 |
| Countries | 78 |
| Servers | 6500 |
| Linux support | GUI app |
| Month-to-month | $12.95 |
| Best $/mo | $1.99 |
| On plan | 5-year (Standard) |
| Free trial | None |
| Refund window | 31 days |
| Free tier | No |
| Logging policy | Contradictory |
| Marketing honesty | Overclaims |
Independent audits
- Altius IT· 2019 · First independent no-logs audit; found no system configurations or log files that could independently or collectively identify a specific person.report ↗
- KPMG· 2021 · First KPMG no-logs audit under PureVPN's 'always-on' arrangement, which permits surprise/unannounced inspections of infrastructure, server configs, and logs at any time.report ↗
- Undisclosed ('top audit firm')· 2023 · Fourth consecutive no-log assessment (conducted Feb-Apr 2023); 'Technical Privacy Assessment Report' concluded all protocols across locations were compliant with the no-log policy. PureVPN did not publicly name the firm for this audit.report ↗
Corporate identity GZ Systems Ltd. operates under the PureSquare (Pure²) brand umbrella (brand identity unveiled Nov 2022; PureSquare ONE-platform/parent-brand launch Feb 2023), which also covers PureKeep, PurePrivacy, PureEncrypt, PureDome, and PureWL. Operationally the group is tied to Gaditek in Karachi, Pakistan. HQ relocated from Hong Kong to the British Virgin Islands in November 2021 for a privacy-favorable jurisdiction with no mandatory data-retention laws. BVI is not a member of any Five/Nine/Fourteen Eyes intelligence alliance. Pricing tiers are Standard/Plus/Max; figures above are the Standard tier; the cheapest genuine rate is the 5-year Standard plan (~$1.99/mo), with the 2-year Standard at ~$2.15/mo. P2P is restricted to designated servers (excludes US/UK/CA/AU). The $0.99 7-day trial is a paid trial, not a free tier. NOTE ON AUDITS: there have been four consecutive no-log assessments (Altius IT 2019; KPMG 2021; a fourth Feb-Apr 2023 by an unnamed 'top audit firm'); the DRAFT's claim of an 'Altius IT 2024 renewal' and a 'new' Dec 2025 KPMG audit could not be substantiated, the Dec 2025 KPMG blog re-publicizes earlier KPMG audit content.
Sources
- Wikipedia, PureVPN (owner GZ Systems Ltd., founded 2007, BVI HQ, 6,500 servers/78 countries, 2017 FBI Ryan Lin incident, active as of Jan 2026) ↗
- PureVPN, 'Fourth successful no-log assessment' blog (4th audit, Feb-Apr 2023, 'top audit firm', legacy-protocol findings; pub. Aug 2023) ↗
- PureVPN, KPMG validates no-log claims (always-on audit; re-published Dec 2025) ↗
- PR Newswire, PureVPN passes SECOND KPMG evaluation under always-on audit (first KPMG audit, 2021) ↗
- PureVPN, No-Log Certified / Altius IT first audit (2019) ↗
- PureVPN, HQ migration Hong Kong to BVI (Nov 2021) ↗
- Newswire, PureVPN unveils new brand identity / PureSquare rebrand and new products (Nov 2022) ↗
- PureVPN, Order/pricing page (Standard/Plus/Max; 2-year Standard $2.15/mo; 31-day money-back) ↗
- Security.org, PureVPN review (cheapest ~$1.69-$1.99 on 5-year, $12.95/mo, 31-day refund, $0.99 7-day paid trial, 10 connections, WireGuard, crypto) ↗
- Security.org, PureVPN pricing 2026 (5-year Standard $47.95 ≈ $1.99/mo; 31-day refund all plans) ↗
- CyberInsider, PureVPN review 2026 (BVI/Gaditek Karachi, Altius IT June 2019, 31-day refund, $0.99 trial, dedicated IP paid add-on, cheapest 5-year) ↗
- PixelPrivacy, 5/9/14 Eyes alliances (BVI not a member of any Eyes alliance) ↗
- The Register, VPN logs helped unmask alleged net stalker (2017 Ryan Lin case; two originating IPs) ↗
- Help Net Security, Alleged cyberstalker unmasked by PureVPN logs (2017) ↗
Last verified 2026-06-17. Point-in-time data, so always confirm on the provider's own site.