VPNs with a Warrant Canary: Who Publishes One and What It Proves

Top 3 VPNs with a warrant canary

None of the three belongs to a surveillance alliance. The gaps come from privacy, which carries 45% of the page score: Proton loses points for demanding an email at sign-up and for a policy that only partly rules out storing connection IP. IVPN drops behind on price and network because no price figure exists in our data and its footprint is small.

How the mechanism works

The provider publishes a short dated text stating it has received no gagged court order or national security letter, then reposts it on a fixed rhythm. Several services here renew monthly: AzireVPN, Bolehvpn and Malwarebytes Privacy VPN, while LunoVPN signs its file and renews it on a schedule. Once a gagged order arrives, the company cannot tell anyone, so it quietly stops renewing. The missed date is the signal. A PGP signature lets you confirm the text originates from the provider's key, and some providers also add a recent news headline to the file to show it was not prepared in advance. Our glossary entry on warrant canaries gives the plain definition.

Why the canary barely moves the ranking

In our privacy formula a canary counts 1 of 15 points, and every service here earns it, so it separates nobody. An independent no-logs audit is worth 3 points, a strict no-logs policy 2, staying out of an alliance 2. That is where the sorting happens.

Who is on the list

The 22 break down into 16 consumer VPNs, two VPNs inside security suites, two decentralised networks and two free mobile apps. Six are US-based, fittingly, since American gag rules are why canaries exist. Jurisdictions vary (Panama, Hong Kong, Switzerland, Gibraltar), and nine of the 22 report no alliance at all. Publishing quality differs: some sign on a strict schedule, others are recorded only through a third-party review, as with AVG Secure VPN and Vpn.ht. Only 8 of the 22 also issue a transparency report, and just 7 have an independent no-logs audit, so a canary alone is not the whole picture.

What a canary does not prove

It says nothing about logging. That is what the audit checks. A stale canary may reflect a forgotten cron job rather than an order, and Australia has made the canary itself illegal for journalist warrants. EFF's FAQ on warrant canaries also notes that no court had ruled on a warrant canary when it was written.

No canary is not a red flag

Of 543 consumer VPNs, 22 publish a canary, 89 say they do not, and 432 never mention it. Several large providers replaced canaries with regular transparency reports, which make sense where the law forces eventual notification anyway. Judge the audit first; our ranking of VPNs with an independent no-logs audit lists the ones that have one.

Canary, report or audit

Checking a canary yourself

1. Check the date against the promised next update.
2. Import the provider's public key and run gpg --verify on the file.
3. Compare the wording with an archived version; a quietly deleted line is the signal.

Warrant canary FAQ

Short answer

CitadelVPN, IVPN and Proton VPN all publish a canary plus an audit and a transparency report. Confirm the canary is dated, on schedule and signed; pick the service on the strength of its audit and privacy record, not the canary alone.