Best Open-Source VPNs: Services with Public App Code, Ranked

Top 3 open-source VPNs compared

CitadelVPN leads through a privacy sub-score of 9.3, which rests on an independent no-logs audit, no stored connection IPs and sign-up without email, plus a bypass score of 8.1 from VLESS and Hysteria2. IVPN trails on value (2.9): its price is absent from our data, and no trial or free tier exists. Proton VPN loses privacy points to a required email and a policy of holding temporary connection IPs for abuse checks. Its bypass score sits at 2.4 because it lists none of VLESS, Trojan, Hysteria2 or Shadowsocks.

Four different things called "open source"

The label hides real differences, and this is where a marketing claim and a public repository diverge.

• Their own client repos on GitHub. Mullvad, NymVPN, Psiphon, Cryptostorm, Mozilla VPN and IVPN let you read and rebuild the client; Proton VPN does the same. AirVPN's Eddie client carries GPLv3, which allows anyone to fork and redistribute it.
• A claim without a repository. CitadelVPN, avoVPN, Mysterium VPN and Independent dVPN state their apps are open but give no link you can check. Until code appears, the claim is unverifiable.
• Services with no in-house app. CruxVPN, Incognet VPN, SlingshotVPN and MoreVPN give you a config that works with the official WireGuard clients; uncensore.net recommends Hiddify or v2rayN.
• Standalone clients. Hiddify, Shadowsocks, Karing and v2rayNG are empty shells waiting for your own server or subscription. Not enough of their service data is published for the main ranking.

Server code is rarer still: Bitmask (LEAP) publishes its server platform on 0xacab.org, and Geph claims everything including the website is open. VPNasap releases just the messenger encryption library.

Why public code is not an audit

A repository proves what the client does on your machine. It says nothing about what the exit server writes to disk, and an app-store build may differ from the public source unless someone reproduces it. A no-logs audit is the check that covers servers and logging practice; only 7 services on this page have one. Twelve have undergone a security review of their apps or infrastructure, which hunts for bugs rather than logs. Licences matter too: GPLv3 (AirVPN Eddie, v2rayNG, MASQ Network), Apache-2.0 (ChibaTunnel), MPL-2.0 (URnetwork SDK) and EPL-2.0 (Meile dVPN) set the terms on which the code can be forked.

How the score is weighted

Open-source apps contribute 1.5 security points out of 14, which every service here gets automatically, so the label never separates them. Privacy does: a no-logs audit, no stored IPs, sign-up that skips email, a home country beyond surveillance alliances. Twenty services have confirmed no independent audit; 32 simply do not state one.

Windows, Mac and free options

Desktop coverage is broad: 44 services ship a Windows app, 42 macOS, 44 Linux; Android reaches 48. On price, 35 of these 59 have a free plan, ranked in the free open-source VPN comparison. To move trust from a provider to yourself, the self-hosted VPN comparison covers running your own open-source server.

Open-source VPN FAQ

Short answer

Base your pick on two things: a client repo you can clone and a no-logs audit performed by an outside party. IVPN and Proton VPN meet both conditions, while CitadelVPN tops the score, the entry price and bypass, with open apps claimed by the vendor rather than shown as a repo. The free sub-list is the place to start for a free tier; if third-party trust must be zero, host the server yourself.