Best open source VPNs: which ones publish their code and audits 

What does “open source VPN” actually mean?

An open source VPN is one whose client apps, the software you install on your phone or computer, are published so anyone can read, build and check the code. That matters because a VPN app sits between you and the entire internet: it handles your traffic, your DNS lookups and often your login credentials. If the code is public, independent researchers can look for leaks, weak encryption or tracking, and you are not relying entirely on the company’s word.

It is worth being precise about what open source does and does not cover, because providers use the phrase loosely:

• Client apps are what all four providers in this roundup publish. This is where most leaks and privacy bugs would show up on your device.
• Server software and infrastructure are usually not fully public. None of the four providers states that its entire server stack is open source, and Mullvad says only that “the majority” of the software it uses and develops is open source. That is why audits of the servers matter separately.
• The licence tells you what you are allowed to do with the code. GPL licences, which all four use for their main apps, require anyone who distributes a modified version to publish their changes too.
• Audits are the other half of the trust picture. Open code lets anyone look; an audit means a named firm actually did look, on a known date, and published what it found.

So in this roundup we check two things for each provider, using their own GitHub organisations, blogs and audit pages as read on October 11, 2026: which apps are genuinely open source, with links to the repositories, and when each provider was last independently audited, by whom, and what the audit covered. We also cover jurisdiction, price and devices, because an open source app on an expensive or limited plan is still a buying decision. If open source software appeals to you beyond the VPN, our guide to how to de-Google your life covers private alternatives for email, storage and passwords.

How do the four open source VPNs compare?

All four publish their main apps on GitHub, but they differ on audit recency, free plans and device limits. This table summarises what each provider documents today.

Two things stand out. Proton has the most recent audits on both fronts, servers and apps, and Mullvad audits more parts of its business more often than anyone else, from apps to payment systems. IVPN’s audits are the oldest for the VPN itself, and Windscribe’s app audits date from 2021 and 2022.

Why is Proton VPN the top pick?

Proton VPN is our top pick because it combines fully open source apps on every platform with the most recent audits of both its servers and its apps, plus features the others lack, such as a free plan with no data cap. Here is the evidence.

What is open source

Proton’s GitHub organisation publishes official apps for every platform, each under the GPL-3.0 licence: the Windows app, a combined iOS and macOS app, the Android app, the Linux GUI app, the Linux CLI and the browser extension. Proton’s pricing page says its “apps are 100% open source, so anyone can examine our code,” and its open source and audit page describes Proton as the first VPN provider to open source its apps on all platforms and have them independently audited, which is Proton’s own claim about its history. We found no Proton statement that its server-side code is public, so treat “open source” here as meaning the apps, which is also true of the other three.

What has been audited

Proton’s no-logs audit post says Proton VPN has passed “a fifth consecutive annual third-party audit” of its infrastructure confirming its no-logs policy. The auditor is Securitum, and the linked 2026 report is dated May 2026; the previous one was August 2025. According to Proton, Securitum’s team spent several days on site reviewing VPN and server configurations, operating procedures and staff interviews. The report itself says the evidence reviewed did not indicate that the examined server infrastructure logs browsing activity, DNS queries or user-identifiable connection metadata. Separately, Proton updated its open source page on December 1, 2025 with a security assessment of its VPN client apps by independent researcher Ruben Santamarta, dated November 2025.

Proton also points to a real-world record: its audit post says its no-logs policy has been tested in over 400 legal cases. Its transparency report lists all 59 legal orders for Proton VPN data in 2025 as denied.

What else you get

Proton AG is a Swiss company whose primary shareholder is the non-profit Proton Foundation, based in Geneva, according to Proton’s about page. VPN Plus covers 10 devices, servers in more than 140 countries, streaming, P2P with port forwarding, and the NetShield ad and malware blocker. Proton also has an official graphical Linux app and an official Linux CLI, which reached a stable 1.0 release in April 2026. The free plan covers one device with no data cap, on servers in 10 countries chosen for you. Our Proton VPN review covers the service in more depth.

The trade-offs: Proton needs an account with an email address, unlike Mullvad, and VPN Plus renews at a higher price than its first term, as the pricing section below shows.

Is Mullvad the most transparent VPN?

Mullvad is the strongest alternative, and on some measures, such as how much of its business it has audited and how little it knows about you, it is ahead of Proton. Its mullvadvpn-app repository contains, in its own words, “all the source code for the desktop and mobile versions of the app,” covering Windows, Linux, macOS, Android and iOS, under GPL-3.0. Mullvad’s open source page says the majority of the software it uses and develops is open source and that all its open source projects are on GitHub, including its own Rust WireGuard implementation.

The audit record is long and varied. Cure53 audited Mullvad’s VPN infrastructure between June 3 and June 14, 2024, Mullvad’s fourth infrastructure audit, and Mullvad quotes the report as finding no vulnerabilities affecting the core product. Mullvad said then that it would audit its infrastructure again in 2025; we could not find a published 2025 infrastructure audit on its audits page, so the June 2024 report is the latest we can confirm. X41 D-Sec audited the app on all platforms between October 23 and November 28, 2024, finding no critical issues, three rated high, two medium and one low. Since then, X41 D-Sec audited Mullvad’s account and payment API (published January 2026), and Leviathan Security Group assessed its Android app (published June 2026); Mullvad’s Linux download page lists a security assessment by Leviathan in February 2026.

On infrastructure, Mullvad announced in September 2023 that it had completed its move to RAM-only, diskless VPN servers using its own bootloader, stboot. On accounts, its no-logging policy says it asks for no username, no password and no email: you get a random account number instead. It is owned by its two founders, according to its about page, and charges a flat €5 a month on every term, with five devices per account and no free plan.

The trade-offs are features rather than trust: no port forwarding, no free plan, and five devices rather than ten.

Is Windscribe’s free plan worth it?

Windscribe is the open source option for people who want a free plan with location choice or unlimited devices, as long as they accept a data cap and older app audits. Its GitHub organisation publishes the desktop client for Windows, Mac and Linux and the Android app under GPL-2.0, and the iOS app under GPL-3.0, along with its browser extension. Windscribe’s about page says “All our apps are open-source.”

Windscribe’s audit page lists three checks. Packetlabs audited its server stack, which Windscribe calls FreshScribe, in June 2024; Windscribe’s blog says the test covered 20 code repositories and microservices, around 80,000 lines of code, and found minimal security concerns. Leviathan Security Group audited the desktop app in September 2021 and the Android and iOS apps in March 2022. Those app audits are now four to five years old, the oldest of the four providers except IVPN’s app audit.

Windscribe’s infrastructure runs entirely in RAM, according to its no-logs page, which also describes cases where authorities took a server or requested data and found nothing to hand over. Windscribe Limited is registered in Ontario, Canada, and says it is self-funded. Its paid plan costs $9 a month or $69 a year, and it allows unlimited devices. The free plan reaches servers in 10 countries with 10 GB of data a month once you confirm an email address, or 2 GB a month without one, which is enough for travel browsing and messaging but not for streaming or large downloads.

Where does IVPN stand in 2026?

IVPN publishes its desktop, iOS and Android apps on GitHub under GPL-3.0, and its pricing page describes “Open-source clients (Android, iOS, macOS, Windows, Linux/CLI).” Like Mullvad, it requires no email to sign up and accepts cash and Monero. It is operated by IVPN Limited, registered in Gibraltar, whose founder and CEO owns it outright, according to its team page.

The audit picture is more mixed than its reputation suggests. IVPN says it has had annual third-party security audits since 2019, but recent ones have covered other parts of the business: its web infrastructure in 2024, and its email forwarding and DNS services in 2025. The last audit of the VPN infrastructure itself took place in February 2023, and the last app audit in early 2021. IVPN states that its only no-logs audit was in March 2019 and that it will not commission further no-logs audits. Its eighth annual Cure53 audit was scheduled for July 2026, but the results were not published when we checked.

IVPN also changed its plans in May 2026. It now sells Standard at $60 a year with 5 devices, Plus at $80 a year with 5 devices, and Pro Suite at $100 a year with 10 devices, with monthly options from $6. There is no free plan. It is a principled, transparent company, but as an open source VPN choice in 2026, its audit evidence for the VPN itself is older than Proton’s or Mullvad’s.

When was each VPN last audited, and by whom?

Proton and Mullvad have the most recent audits; IVPN and Windscribe have older ones for their VPN apps. This table lists each provider’s latest audit we could confirm on its own pages, by type.

Audit dates are not the whole story. An audit checks a snapshot of the code and servers; a provider that audits often is giving you more snapshots. That is why we rate Mullvad’s breadth highly even though its latest confirmed infrastructure audit is from 2024, and why Proton’s combination of a yearly no-logs audit and a recent app audit puts it first. When choosing the best open source VPN for your needs, look for an audit within the last two years of whichever part matters most to you: the app on your device, or the servers your traffic passes through.

What do they cost, and what do they renew at?

Proton VPN Plus costs $3.49 a month on a two-year plan and renews at $83.88 a year; the others mostly charge flat prices. Prices below are from each provider’s own pricing page on October 11, 2026.

Proton’s headline monthly price is introductory: the one-year plan costs $53.88 and then $83.88 a year, which is $6.99 a month from the second year. Over three years, the two-year plan followed by one renewal comes to $167.64, about $4.66 a month, which is still below Mullvad’s €5 flat rate in US dollar terms. Proton’s free plan also lets you test the open source apps for as long as you like before paying, which none of the paid-only providers can match. To see current offers in your currency, compare Proton VPN’s plans, and if you are unsure whether you need to pay at all, our Proton VPN Free vs Plus guide goes through the differences.

How can you check open source claims yourself?

You do not need to be a developer to check whether a VPN’s open source claim holds up. Five checks take about ten minutes:

1. Find the repository for your platform. Go to the provider’s GitHub organisation and look for an official repository for the app you would actually install: Windows, macOS, iOS, Android or Linux. A provider that publishes only a library or an old app is not the same as one that publishes the app you use.
2. Check that it is alive. Look at the date of the latest commit and release. An active repository with recent releases matches what ships in the app store; an archived one does not. Proton, for example, archived its old iOS repository and points to a combined iOS and macOS repository instead.
3. Read the licence. GPL-2.0 and GPL-3.0, which these four use, mean anyone can inspect, build and share the code under the same terms. A repository with no licence file is visible, but not open source in the legal sense.
4. Find the audit report, not just the announcement. A blog post saying “we passed an audit” is less useful than a linked report with the auditor’s name, scope and date. Proton, Mullvad and Windscribe link reports from their own sites or GitHub pages.
5. Check what the audit covered. An audit of a web shop or an email service says nothing about the VPN app on your phone. Match the scope to what you care about.

None of this replaces trust entirely. You cannot easily confirm that the binary in an app store matches the public source, and server-side behaviour is only visible to auditors. But a provider that publishes its apps, names its auditors and dates its reports gives you far more to go on than one that does not.

Frequently asked questions

Is Proton VPN fully open source?

Its apps are. Proton publishes official apps for Windows, iOS and macOS, Android, Linux and its browser extension on GitHub under GPL-3.0, and says its apps are 100 percent open source. We found no Proton statement that its server software is public, which is also true of the other providers here.

Which open source VPN has a free plan?

Proton VPN and Windscribe. Proton’s free plan covers one device with no data cap, on servers in 10 countries chosen for you. Windscribe’s free plan covers servers in 10 countries with 10 GB a month after you confirm an email address, or 2 GB without one. Mullvad and IVPN have no free plan.

Is Mullvad better than Proton VPN?

For anonymity, Mullvad has an edge: no email, a random account number and cash payments. For features and audit recency of its no-logs policy, Proton leads, with a May 2026 Securitum audit, port forwarding, 10 devices and a free plan. Both publish their apps under GPL-3.0.

Does open source mean a VPN is safe?

Not by itself. Open source means the code can be checked; it does not mean anyone has. That is why audits matter: Proton, Mullvad, Windscribe and IVPN all publish reports from named firms, but with very different dates and scopes, as the audit table above shows.

Has IVPN had a recent audit?

IVPN has had annual third-party audits since 2019, but recent ones covered its web infrastructure in 2024 and its email and DNS services in 2025. Its last VPN infrastructure audit was in February 2023, and it says it will not commission further no-logs audits. A 2026 audit was scheduled for July.

What is the best open source VPN for Linux?

Proton VPN, for most desktop users: it has an official graphical Linux app and an official CLI, both under GPL-3.0. Mullvad’s Linux app and CLI are also open source and well suited to minimal setups. Windscribe’s desktop client covers Linux too, and IVPN publishes a Linux CLI.

Which should you choose?

Proton VPN is the best open source VPN for most people. Every app it ships is on GitHub under GPL-3.0, its no-logs policy passed a fifth annual Securitum audit in May 2026, its client apps were assessed in November 2025, and it adds port forwarding, 10 devices and the only uncapped free plan in this group. Plan for the renewal: VPN Plus costs $83.76 for the first two years and then $83.88 a year.

Mullvad is the right choice if you want to give no personal data at all and value a flat price and the broadest audit programme. Windscribe suits people who need unlimited devices or a free plan with country choice. IVPN remains a principled provider, but its VPN audits are older. For everyone else, start with Proton VPN’s free plan, read the code on GitHub if you like, and upgrade when you need more devices or country choice.