Best VPN for China (2026): Obfuscation That Is Documented

The best VPN for China is one whose own help pages explain how it gets through the country’s internet filters. You should be able to install and test it on every device before you fly, and get a refund if it fails. On 31 October 2026, six of the twelve providers we track meet that test: ExpressVPN, Proton VPN, NordVPN, Surfshark, hide.me and Windscribe.

Each of the six documents obfuscation on an official page. Obfuscation disguises VPN traffic as ordinary encrypted web traffic. Each also publishes guidance for China or for restricted networks.

None of them guarantees a connection from inside China, and neither do we. We have no test server in mainland China, so we cannot verify any provider’s claim from there. This page ranks on documented features, verified prices and how candid each provider’s own China guidance is, not on measured results.

Is a VPN legal in China? The position in plain words

China does not ban VPN software by name. Instead, it licenses the channels that international internet traffic may pass through. The rules are in the Interim Provisions on the Administration of International Connections of Computer Information Networks. The State Council issued them as Order No. 195 on 1 February 1996 and revised them on 20 May 1997.

Article 6 says networks that connect directly to the international internet must use the international gateway channels of the national public telecommunications network. It also says no unit or individual may establish or use other channels for international networking on their own.

Under Article 14, public security organs can order such a connection stopped. They can also issue a warning, impose a fine of up to 15,000 yuan and confiscate any illegal gains. The text is on the Cyberspace Administration of China’s website, linked in the sources.

The rule aimed at VPN businesses is more recent. On 17 January 2017, the Ministry of Industry and Information Technology (MIIT) issued its Notice on Cleaning Up and Regulating the Internet Network Access Service Market. It is document number 32 of 2017.

Without approval from the telecommunications authority, the notice says, no one may establish or lease dedicated lines, “including virtual private networks (VPN)”, to carry out cross-border business. It also set a clean-up campaign running to 31 March 2018.

MIIT also published answers to reporters’ questions. It said the target was companies or individuals without an international telecommunications license that rent lines or VPNs to run cross-border telecom business on their own. It added that foreign-trade and multinational companies that lease lines from licensed operators for their own office use would not be affected.

Individuals have been penalized, though reported cases are rare. On 7 January 2019, Sixth Tone reported that a Guangdong man surnamed Zhu was fined 1,000 yuan. The fine was for “setting up and frequently using illegal channels to connect to international networks”. The report cites a Shaoguan public security bureau notice dated 28 December 2018.

The same report also records penalties for two VPN sellers. One got a nine-month prison sentence in March 2017. Another got a five-and-a-half-year sentence and a 500,000 yuan fine in December 2017.

We have found no official statistics on how often users, as opposed to sellers, are penalized. We cannot assess your personal risk.

Surfshark’s own China guide says VPN use there is “not officially illegal” and that providers must cooperate with the state. Read that as the company’s view of the enforcement record, not as a reading of Article 6.

Our laws hub tracks developments. The practical points for the rest of a trip are in our travel VPN guide.

What matters in China, and why

Obfuscation matters most. Plain WireGuard and OpenVPN connections have handshakes that are easy to recognize. A handshake is the opening exchange that sets up a connection. The providers’ own pages describe these connections being blocked.

What gets through is traffic that looks like something else. Each pick documents its own method:

• ExpressVPN’s features page documents automatic obfuscation on every server through its Lightway protocol.
• Proton VPN’s Stealth protocol wraps the tunnel in what its China page calls “an obfuscated TLS tunnel over TCP, making it look like a regular HTTPS connection”.
• NordVPN’s help center points users on restricted networks to the NordWhisper protocol and to obfuscated servers. Those servers appear only when the protocol is set to Auto or NordWhisper. Its fallback is OpenVPN TCP, which it calls “more resilient against blocks than UDP”.
• Surfshark’s guide describes Camouflage mode, which “makes your connection seem like a conventional internet connection”. It also describes a NoBorders mode that the app switches to by itself when it detects a restricted network.
• hide.me relies on SSTP and SoftEther, which tunnel over HTTPS. On Windows, it also has its Bolt transport over TLS 1.3.
• Windscribe’s Stealth protocol “encapsulates OpenVPN in a TLS tunnel via Stunnel”. Its WStunnel protocol wraps OpenVPN in a WebSocket on port 443.

You buy and install before you fly. Proton’s China page says to download and set up the app before traveling. Surfshark recommends setting one up beforehand and covering every device you plan to use. Mullvad’s guide tells you to create an account, add time and test the app’s API access before you need it.

On 31 October 2026, NordVPN’s China help articles said its iOS and Android apps are “fully blocked in China”. They also said Windows configurations had “recently been blocked”. That leaves a manual IKEv2 setup as the documented route.

The service credentials for that setup come from your Nord Account, after a verification code sent by email. That is another thing to do while your email still works normally.

Server location is not obvious. Mullvad’s page says China’s firewall blocks all of its servers in Asia. It suggests US cities instead. Proton suggests Japan, Hong Kong and Singapore first, then more distant servers if those fail. Expect to try several.

A fallback that is not an app. hide.me, NordVPN and IVPN document manual setups. A manual setup connects without the provider’s app. Each documents different options:

• hide.me: SSTP, SoftEther, OpenVPN and IKEv2.
• NordVPN: IKEv2.
• IVPN: OpenVPN with obfs4.

Mullvad, by contrast, says its obfuscation methods are not available outside its own app.

NordVPN has moved its obfuscated servers from OpenVPN to NordWhisper. The change came to iOS in version 9.8 on 1 July 2026 and to Linux in version 6.0.0 on 22 October 2026.

Its support center says that, since the move, those servers cannot be reached by a manual OpenVPN connection. That makes IKEv2 NordVPN’s only documented manual route. We covered the change in NordVPN’s obfuscated servers now run on NordWhisper.

Kill switch and leaks. A kill switch blocks your internet if the VPN connection drops. Our data records one on desktop and mobile for all six picks. A connection that silently drops back to the open network is worse than no VPN.

A leak lets some of your traffic bypass the VPN. Check for DNS and IPv6 leaks with our VPN check before you leave. You may not be able to reach the tool once you are there.

Refunds. Five of the six picks give 30 days. Windscribe gives 7 days, and only if you have used under 10 GB. NordVPN and Surfshark refund the initial purchase only. If you buy through Apple’s or Google’s app store, any refund comes from Apple or Google under their own rules.

Pick by pick: what the verified data says

ExpressVPN documents obfuscation more plainly than anyone. Its features page records automatic obfuscation on every server. The Lightway core is open source, with post-quantum ML-KEM key exchange on by default. Post-quantum methods are designed to resist attacks from future quantum computers.

The “Can’t connect to ExpressVPN” guide gives an order of protocols to try: Automatic, then Lightway UDP, Lightway TCP, WireGuard and OpenVPN. It tells users “located in a country with a high level of internet censorship” to contact support if they cannot find a working solution.

The company operates from the British Virgin Islands. KPMG has audited its no-logs policy three times: in 2022, 2023 and June 2025. Its servers run from RAM, and its network covers 113 countries.

The order page shows a single plan: 28 months at $2.99 a month, or $83.72 in total. It renews at $99.95 a year. The Basic tier covers 10 devices, Advanced covers 12 and Express Pro covers 14. First-time buyers get a 30-day refund.

We could not load a China-specific help page for ExpressVPN on 31 October 2026, so its guidance is general. The monthly price appears only at checkout. ExpressVPN has not accepted cryptocurrency since August 2026, so you can only pay by card, PayPal or an app store. See the ExpressVPN review.

Proton VPN has the most useful China page of the six. It documents Stealth and tells you to set up before traveling. It also covers alternative routing, which is on by default.

When Proton’s own servers are blocked, alternative routing “routes your connection through third-party networks”. The page admits that “no VPN service can guarantee 100% reliability in China”.

Proton AG is Swiss, and every app is open source. Securitum has audited the no-logs policy every year since 2022. The fifth audit was published in June 2026. On 5 November 2026, the network counted 21,882 servers in 149 countries.

VPN Plus costs $3.49 a month on the 2-year plan, or $83.76 in total, and renews at $83.88 a year. The monthly plan is $9.99. VPN Plus covers 10 devices. The 30-day refund excludes cash and bank-transfer payments.

Servers are not RAM-only. Proton uses full-disk encryption instead and explains why. The free plan assigns a random server in one of ten countries, so do not count on it as a China fallback. See the Proton VPN review.

NordVPN covers the most countries we track: 150, with 7,229 servers. It offers NordWhisper and obfuscated servers. Its servers are RAM-only, and it is based in Panama.

It has had six no-logs assurance engagements, which are outside checks of its no-logs policy. The latest is by Deloitte, with a report dated 12 December 2025.

Its help center has a dedicated “I can’t connect from China” section with an article per platform. That is exactly the documentation this page asks for.

On 31 October 2026, though, the iOS and Android articles said the apps are “fully blocked in China”. The Windows article said “our server configurations for manual connections and applications have recently been blocked on Windows”. It added that developers were working on it.

On mobile, the documented workaround was a manual IKEv2 profile using service credentials from your Nord Account. On Android, you set it up through the strongSwan app.

The 27-month Basic plan is $3.49 a month, or $94.23 in total, and renews at $139.08 a year. The monthly plan is $14.99. Refunds run 30 days on the initial purchase only.

NordVPN stays on the list because it documents the situation instead of hiding it. If your trip is next week, read those articles first. See the NordVPN review.

Surfshark is the pick for people carrying several devices. It allows unlimited simultaneous connections and has apps for nine platforms.

Its China guide was updated on 18 May 2026. It says that when the app is used in China, it “detects this and immediately switches to NoBorders mode”. The guide also documents Camouflage mode, recommends OpenVPN there and tells you to set everything up beforehand.

Deloitte issued its second no-logs assurance report in June 2025. Servers are RAM-only, and the network spans 4,500 servers in 100 countries.

The Starter plan costs $2.49 a month for 27 months, or $67.23 in total. The pricing page does not state what the plan renews at. It says only that the “applicable renewal price” applies each year. The monthly plan is $18.95.

Surfshark B.V. is in Amsterdam, which puts it inside the Nine Eyes grouping. No app is open source. The guide itself says access cannot be guaranteed. See the Surfshark review.

hide.me publishes the most candid help article of the group. It is called “Connecting to VPN in China” and was last modified on 2 March 2026.

The article opens by saying the company “cannot guarantee that our VPN service will work 100% during all the time in China”. It calls the situation “a cat and mouse game”. Its steps are concrete:

• Update the app.
• Change your device’s DNS, the service that turns names into internet addresses. Some Chinese internet providers block hide.me’s server names at the DNS level.
• Switch the protocol to SSTP.
• Then try WireGuard, SoftEther, OpenVPN and IKEv2, one at a time.
• Fall back to a manual SSTP, SoftEther, OpenVPN or IKEv2 setup.

Securitum audited the no-logs policy between March and June 2024. The service is run by eVenture Ltd in Labuan, Malaysia. It accepts nine cryptocurrencies.

The 30-month plan costs $2.33 a month, or $69.99 in total. hide.me gives a written guarantee that it renews at the same price. The monthly plan is $11.99. The refund window is 30 days on a first order, and 10 devices are allowed.

The official pages do not say whether servers run from RAM. The free plan offers 8 locations and 1 device, and it excludes Bolt. See the hide.me review.

Windscribe earns its place on documentation and on honest pricing. Its knowledge base article, dated 23 October 2025, explains Stealth and WStunnel. It says plainly that “while Windscribe might work for some people in a restricted country, other people might not be able to use it”. It advises switching servers and protocols, because “the best protocol is the protocol that works at that time”.

Pro costs $9 a month, or $69 a year, which works out to $5.75 a month. It renews at the same price. The free plan’s 10 GB a month lets you test the protocols before paying.

Windscribe has published no independent no-logs audit. Its audits cover the apps in 2021 and 2022 and its infrastructure in 2024. The refund window is 7 days, and only if you have used under 10 GB.

There is no human live chat. Windscribe Limited is in Toronto, inside the Five Eyes. See the Windscribe review.

Mullvad and IVPN: documented, but outside the top six

Two providers that pay us nothing document China use at least as carefully as the picks.

Mullvad has a page called “Using Mullvad VPN in restrictive locations”, dated 22 April 2026. It names China among ten countries where connections are hard. It says the firewall blocks all of Mullvad’s Asian servers. It then walks through these methods:

• Shadowsocks, on the automatic port first and then port 443.
• UDP-over-TCP on port 80, 443 or 5001.
• QUIC on UDP port 443.
• Its own lightweight LWO obfuscation.

Mullvad charges a flat 5 euros a month, about $5.60. It needs no email address and takes cash.

IVPN’s article covers V2Ray in VMESS/QUIC and VMESS/TCP modes on every platform. On iOS, this is in beta. It also covers obfs4 with OpenVPN on desktop. It warns that obfuscation “is not designed to bypass VPN blocks on websites”.

Both rank below the six picks on our total score. One reason is that they make no streaming claims and offer no live chat, which our published weights penalize. Another is that Mullvad’s 14-day refund excludes cash and cryptocurrency payments. If privacy is your first concern, they lead our privacy guide.

What to avoid

Apps you find once you are there. Provider websites are among the first things blocked. Copies of VPN apps offered through unofficial channels are a common way to install something else. Surfshark’s guide recommends covering every device before departure for this reason. Proton and Mullvad say the same in their own words.

Providers without documented obfuscation. CyberGhost and PrivadoVPN document no obfuscation on their official pages, so our data records none for either. Neither publishes China guidance. Both are good value for other uses. See our best-of hub.

A single protocol. Every provider on this page describes the situation as changing. Learn where the protocol switch is in each app before you need it.

Monthly plans bought in a hurry. NordVPN’s monthly plan is $14.99 and Surfshark’s is $18.95. Both refund the initial purchase only. If you buy through Apple’s or Google’s store, Apple or Google handles the refund, not the provider.

Trusting “not illegal”. The regulations quoted above are in force and have been applied to individuals. Decide with that in mind.

Setup notes

Before you leave:

• Buy the plan, install the app on every device, log in, and connect at least once.
• Save a copy of the installer where you can reach it offline.
• Generate or note the manual-setup credentials now. NordVPN’s need a code sent by email. hide.me’s manual guides are in its knowledge base.
• Download any configuration files.
• Write down the support email address. ExpressVPN and NordVPN both direct users in censored countries to support.
• Run our VPN check to confirm there is no DNS or IPv6 leak.
• Turn the kill switch on.

Once you are there, use the protocols each provider documents:

• ExpressVPN: leave it on Automatic, then try Lightway TCP and OpenVPN TCP.
• Proton VPN: use Stealth with alternative routing on. If you get stuck, switch between Stealth and Smart.
• NordVPN: use NordWhisper and an obfuscated server, then OpenVPN TCP, then the manual IKEv2 profile.
• Surfshark: let NoBorders switch on, and use OpenVPN with Camouflage.
• hide.me: change your DNS, then try SSTP first.
• Windscribe: use Stealth or WStunnel on port 443.
• Mullvad: use Shadowsocks or UDP-over-TCP, and pick US servers.

Try a different server in the same country before you try a different protocol. Note what works for next time.

How we chose

The picks are ordered by each provider’s score, which is shown above. We include only providers whose official pages document both an obfuscation feature and guidance for China or for restricted networks. We loaded those pages on 31 October 2026. Scores come from our published methodology.

Prices are the lowest effective monthly price on each pricing page on that date. We state the renewal price every time.

CyberGhost and PrivadoVPN were left out because their official pages document no obfuscation. Private Internet Access and IPVanish document obfuscation but no China guidance, so they were left out too. Private Internet Access uses an SSL layer, and IPVanish uses OpenVPN Scramble. We will add them if that changes.

Mullvad and IVPN meet every criterion. Only the six-pick limit cut them, because they rank below the six on total score for the reasons given above.

We have not tested any of these services from inside China, and we will not claim to until we can. ExpressVPN, NordVPN, Surfshark and Proton VPN pay us a commission on some purchases. hide.me and Windscribe currently do not. Mullvad and IVPN run no affiliate programs at all.

None of that affects the order, which is computed, not chosen. Read more about how we make money.