Free Open-Source VPNs: What the Free Plans Give and Who Runs the Servers

Top three free open-source VPNs side by side

Each of the three stumbles somewhere different. Windscribe loses ground on censorship bypass (0.5) and network (3.1), Proton on its bypass sub-score of 2.4 and the streaming and P2P lockout, CitadelVPN because its open-source claim and its audit both rest on the vendor's word.

Services, bare clients and DNS filters

Check what an entry actually is before installing. Beyond the top three, these also give you a working network without paying: VpnHood!, Psiphon and Geph run as services, while URnetwork routes your traffic over community devices, Orbot exits through Tor relays, and VPN Gate rides volunteer-hosted servers. What separates them is how the free tier is funded and limited; the table below lists each one's caps.

Then there are bare clients. Hiddify needs your own server, v2rayNG ships none, Karing is a subscription client, avoVPN wants a vless:// key, and MyVPN deploys onto cloud servers you rent. The trade-off only appears where the server is yours: with Hiddify or MyVPN you stop trusting a VPN company, but you pay for hosting and keep it running yourself.

A third group never builds an encrypted tunnel on the free tier: Blokada blocks ads via DNS, Safing SPN's free part is the Portmaster firewall, Lockdown Privacy is a firewall and tracker blocker, Rethink DNS + Firewall keeps its free app at the DNS tier.

Free plan caps by service

Nine of the 35 publish anything about free data at all. Where the figure is absent, the cap is unknown, not zero. Four free plans carry ads, fifteen state no ads, sixteen stay silent.

What open code tells you about a free provider

Public source shows what the app does on your device: what it sends, stores, and which SDKs it pulls in. It cannot show what the exit server logs once your packets leave the tunnel. That gap is why independent no-logs audits matter: only 3 of the 35 have one, 12 confirm they don't, and 20 don't state anything. An audit covers the server side; a public repo does not.

Of the top three, Proton's code lives in a public GitHub organisation, while Windscribe links its repository from its site and CitadelVPN gives no repository link at all. Fourteen of the 35 do not state a home country.

How the order on this page is weighted

Value counts for 40% (price, trial, refund, devices), privacy 21.2%, security 14.1%, censorship bypass 10.6%, network and apps 7.1% each. A free plan and open-source apps are shared by all 35 entries, so those two facts add identical points and move nothing; the upgrade price, refund window and audits do the separating. Twelve entries lacked enough published data for the main ranking; the full open-source VPN ranking lists them alongside paid providers.

FAQ

Short answer

Proton VPN is the practical default: unlimited free data, published code, published audit, and a 30-day refund window on paid plans. CitadelVPN tops the score but you take its audit and its open-source claim on trust. Bare clients fit only if you already have a server; the free tiers of Blokada, Safing SPN, Lockdown Privacy and Rethink DNS + Firewall come with no VPN tunnel, just DNS blocking or a firewall. Where a provider prints no data figure, that missing number is a question to ask before relying on the plan.