IVPN Review (2026): Audited, Open Source, No Affiliate Cut

IVPN is a Gibraltar-based VPN that publishes all seven of its Cure53 audit reports. It releases all of its apps as open source. You can pay in cash or Monero without giving an email address. IVPN has refused to pay affiliates since 2016, so we earn nothing if you buy it after reading this page.

Its score, shown above, is lower than that reputation might suggest. The reasons are mechanical:

• IVPN documents support for zero streaming services.
• It offers no live chat.
• It has no TV apps or browser extensions.
• It runs 89 gateways in 42 countries.
• Its only no-logs audit is from 2019.

This review explains each of those, what IVPN does better than anyone, and who should choose it anyway.

Privacy and logging

IVPN is operated by IVPN Limited, registered in Gibraltar. The company was called Privatus Limited until 10 August 2023, when it was renamed. IVPN’s blog says the ownership, registration number and registered address did not change. The team page states that founder and CEO Nick Pestell owns 100 percent of IVPN Limited. It also says the service has operated since 2009, and no parent company is named. Our data record classes Gibraltar as outside the 5, 9 and 14 Eyes alliances, which are groups of countries that share intelligence.

The logging policy is among the shortest we track. IVPN says it keeps no traffic, connection-timestamp, session-duration, DNS, bandwidth or customer IP logs. The only thing it tracks is the number of active simultaneous connections, which is deleted when the session ends. Accounts are random IDs, and IVPN asks for no name or email.

Payment records are kept for accounting. Once the account is deleted, after 90 days, they have no link to the account ID. Crash reports are anonymized. The website analytics run on self-hosted Matomo with truncated visitor IPs. Add cash, Monero and Bitcoin payment, and no provider in our data set separates your identity from your account more completely. Only Mullvad matches it.

The audit record is long, and all of it is public. Cure53 has examined IVPN seven times:

• March 2019. A no-logging audit by three auditors over seven days, covering the VPN gateways and authentication servers. It found one low-impact DNS caching issue, which was mitigated.
• November and December 2019. An infrastructure audit, published on 23 January 2020. It found nine issues, three of them high, and all were resolved.
• February and March 2021. An audit of all the apps. It found two critical and two medium vulnerabilities in the then-unreleased desktop app, fixed before release.
• February and March 2022. A second apps audit. It found eight vulnerabilities, one of them high. The remaining daemon-authentication issue was mitigated in desktop app 3.8.7.
• February 2023. An audit of the upgraded gateway infrastructure. It found three vulnerabilities and five miscellaneous issues, all fixed.
• March 2024. A sixth annual audit, covering the customer web UI, backend, API endpoints and web servers. It found two low-severity vulnerabilities and two informational findings.
• May 2025. Audits of the Mailx email-aliasing service and the modDNS filtering service. The Mailx audit found six vulnerabilities, including one critical, all fixed before the beta. The modDNS audit was announced on 18 March 2026.

An eighth audit was scheduled for July 2026. It covers the cryptography and privacy model of IVPN’s token services. No results had been published by 31 October 2026.

Two things about that record count against IVPN in our scoring. First, the only no-logs audit is the 2019 one. IVPN has said it will not commission further no-logs audits. Its reasoning is that an audit at one point in time cannot prove what a server does the next day.

Our privacy score gives most of its points to a no-logs audit under two years old. So IVPN scores there as a provider with an old audit. NordVPN and Proton VPN score as current. NordVPN has had six engagements, the latest in December 2025, and Securitum audits Proton VPN every year.

Second, IVPN’s gateways are dedicated bare-metal servers, not virtual machines. That means each gateway is a physical machine that IVPN does not share with other customers. IVPN rents them from 18 named hosting providers. But only a small number of pilot gateways run diskless. RAM-only servers run from memory, so a restart wipes them. IVPN’s network-wide RAM-only rollout is an ongoing project, so our record marks RAM-only as false.

You can reasonably disagree with the weighting, and the methodology page shows exactly how it works. These two points explain why a service with this reputation lands where it does.

IVPN’s transparency report lists every legal request by year. There were nine requests in 2026 and twelve in 2025. There were twelve in 2024, and one of them was valid. There were two in 2023, none in 2022, and one each in 2021, 2019, 2018 and 2017. In every year, the number of requests where data was provided is zero.

IVPN also signs a warrant canary every month. A warrant canary is a statement a provider updates regularly to show it has not received a secret government order. The latest in our record is dated 6 October 2026.

One incident is on the record, and IVPN disclosed it itself. On 7 August 2026 a critical vulnerability in BTCPay Server was publicly disclosed. BTCPay Server is the self-hosted software IVPN uses to accept Bitcoin. Attackers who were already exploiting the flaw extracted the credentials of IVPN’s Lightning node. Lightning is a payment network that runs on top of Bitcoin. The attackers moved out 0.6168 BTC in two transactions.

IVPN’s post of 11 August 2026 states four things:

• The money was its own operating balance, held in its own Lightning channels.
• No customer data was accessed.
• No customer funds were lost.
• The VPN infrastructure was a separate system and was not involved.

IVPN destroyed the old Lightning node and created a new one from a new seed. It set the node to move excess funds to hardware-wallet storage automatically and added its own alerting. It also closed the public Lightning API endpoint and disabled a default web interface.

We record the severity as low because customers were unaffected, and our scoring does not penalize low-severity incidents. But a payment server exposed to a known class of attack is still a mark against the operational record of a company that sells privacy.

Security features

The apps use WireGuard and OpenVPN. These protocols are the methods the apps use to build an encrypted tunnel. The iOS app also offers IPSec/IKEv2, which is otherwise available only through manual setup. PPTP and L2TP are not offered.

OpenVPN defaults to AES-256-GCM, and ChaCha20-Poly1305 is optional on OpenVPN 2.5 and later. WireGuard uses ChaCha20-Poly1305, and IKEv2 uses AES-256.

All the apps offer a quantum-resistant WireGuard mode. Quantum-resistant encryption is designed to hold up against attacks from future quantum computers. IVPN’s mode exchanges pre-shared keys with the Kyber-1024 and Classic-McEliece-348864 key-encapsulation mechanisms. It is not available for manual configurations. IVPN states that the connection still relies on classical primitives, the standard building blocks of today’s cryptography.

A kill switch blocks your internet if the VPN connection drops. IVPN’s kill switch is the IVPN Firewall. It is built on WFP on Windows, pf on macOS and iptables on Linux, with always-on and boot-time options. On iOS it exists only up to iOS 15. No kill switch is stated for the current iOS or Android apps, so our record marks the mobile kill switch as absent.

For phone users, that is the most significant gap in the feature set. It is also the reason the security part of our score does not put IVPN at the very top.

Split tunneling lets you choose which apps use the VPN. IVPN’s Split Tunnel is available on Windows, Linux and Android, though not in the Linux Snap build. macOS gained it in app 3.16.1 on 20 October 2026.

Obfuscation disguises VPN traffic so that networks which block VPNs find it harder to spot. IVPN’s obfuscation is better than most. V2Ray has been available on every platform since 28 November 2025, and obfs4 is available on desktop. Multi-hop sends your traffic through two VPN servers instead of one. It has been included in every tier since May 2026, and every gateway lists its multi-hop and SOCKS5 endpoints.

Each gateway handles DNS with internal non-logging resolvers that use the AntiTracker and AntiTracker Plus blocklists. Options also include custom DNS with DoH and DoT, which encrypt DNS lookups, and a public recursive resolver. IPv6 support is partial:

• WireGuard connections get an IPv6 address delivered over IPv4.
• Connecting over IPv6 is under development.
• IPv6 DNS is not available.
• The firewall blocks IPv6 leaks.

Check your own connection with our IPv6 leak test.

Port forwarding is not available. Port forwarding lets other devices connect to yours through the VPN, which torrent users rely on for seeding. There are no dedicated or static IPs either. IVPN uses shared IPs for privacy.

On 31 October 2026 the network had 89 active gateways in 59 cities and 42 countries. We counted them from the live server list linked from the status page. Each gateway is one physical server with WireGuard and OpenVPN. For comparison, Mullvad runs 566 servers in 50 countries and Proton VPN 21,722 in 149. The comparison table puts every field side by side.

Apps and usability

IVPN has apps for Windows, macOS, Linux, iOS and Android. All of them are open source on GitHub, in the desktop-app, ios-app and android-app repositories. Open-source code is public, so anyone can read and check it. IVPN also offers configuration generators for pfSense, OPNsense, Asus-wrt, OpenWRT, DD-WRT and Tomato routers, plus a Synology NAS guide.

There are no TV apps. The help center says the app is not compatible with Fire OS or the Nvidia Shield. It suggests OpenVPN for Android or a router instead. There is no Apple TV app. There are no browser extensions and no Smart DNS, which is the usual fallback for devices that cannot run a VPN app. The device limit is 5 on Standard and Plus and 10 on Pro Suite.

IVPN makes no streaming claims at all. Its help center says “we make no guarantee about the availability of these services when connected to our network”. It suggests using Split Tunnel on Windows and Android to exclude a streaming app from the tunnel. Our streaming score counts the services a provider documents support for, plus Smart DNS. We treat those services as claims until we test them.

So IVPN scores zero there by design, while providers that list a dozen services score highly on claims we have not verified either. If streaming is why you want a VPN, our streaming picks are the place to start, not this page.

Our apps score counts:

• platform coverage
• the device limit
• router support
• browser extensions
• open-source clients
• split tunneling.

IVPN covers five platforms plus routers, against nine for NordVPN or Proton VPN. It earns full marks for open source and router support and loses them on TVs and extensions. We have not yet published our own usability testing or screenshots. The how we test page describes the lab plan.

Support

Support is by email only, with a knowledge base. IVPN’s contact page says replies normally arrive within a few hours and in rare cases take up to 24 hours. We have not measured this. There is no live chat and no phone line. That costs IVPN most of the points in our support score, because live chat availability carries the largest share. It is also a real limitation if you want a problem solved while you wait. Refund requests also go by email to support@ivpn.net with your account ID.

IVPN pricing: tiers, weekly plans and refunds

IVPN sells three tiers at fixed prices, verified on 31 October 2026. There are no promotions and no introductory discount. There is no separately stated renewal price, because a plan renews at the same list price.

• Standard costs $6 a month or $60 a year, which is $5 a month. It covers 5 devices and includes multi-hop.
• Plus costs $8 a month or $80 a year, which is $6.67 a month. It also covers 5 devices and adds the Mailx email-aliasing service and modDNS filtering.
• Pro Suite costs $10 a month or $100 a year, which is $8.33 a month. It covers 10 devices and adds Portmaster Pro, which runs on Windows and Linux only.

One-week plans at $2, $3 and $4 are sold for testing, since there is no free tier or free trial. They are left out of the table above because our schema records whole months.

The pricing page renders its prices client-side, in your browser. So our record was read from the page’s own script bundle. It matches IVPN’s plan-changes post of 8 May 2026, which also explains the current structure:

• Standard went from 2 devices to 5 and gained multi-hop.
• The old Pro tier became Pro Suite. Its device limit rose from 7 to 10, and the extra services are included at no additional cost.
• Plus is new.
• Pricing was unchanged.

Accounts created before November 2020 received the device-limit upgrades but not the Plus tier or the additional services.

Compared with the discounters, $5 a month on a yearly plan is more than the introductory rates of NordVPN, at $3.49, or Surfshark, at $2.49. But it is less than either charges on renewal. NordVPN Basic renews at $139.08 a year, which is $11.59 a month, and Surfshark does not say. Mullvad’s flat 5 euros, about $5.60, is the direct rival. IVPN Standard on a yearly plan is 60 cents a month cheaper. On monthly plans, Mullvad is 40 cents cheaper than IVPN.

Upgrades between tiers are prorated and leave the expiry date unchanged. Prorated means the charge is worked out for the time left on your plan. Downgrades give a choice of a prorated refund or a time extension. Cash and in-app payments only qualify for the extension.

You can pay with:

• Bitcoin, through IVPN’s own BTCPay server
• Monero, through a self-hosted node
• PayPal
• cards, though not American Express or prepaid cards
• iOS in-app purchase, while Android in-app purchase was temporarily unavailable
• voucher cards and codes
• cash.

Our IVPN pricing page tracks every reading. IVPN never appears with a discount on our Black Friday tracker, because it never runs one.

The refund policy gives a full refund within 30 days of payment. It applies once per account and once per customer, and there are no prorated refunds. Cash and voucher payments and IVPN Light purchases are non-refundable. Apple refunds App Store purchases. Requests go by email with the account ID and the payment details:

• for a card, the first six and last four digits
• for PayPal, the transaction ID
• for Bitcoin or Monero refunds, a wallet address.

We must also disclose that IVPN closed its affiliate program on 23 September 2016. Its post gives three reasons:

• Affiliates posted fake coupon pages to collect commissions on sales that would have happened anyway.
• Comparison sites sold top placements.
• An audit in May 2016 found that fewer than 5 percent of its affiliates carried the disclosure its terms required.

“One of the most offensive practices is the offer to pay for top rankings,” it wrote. The help center confirms the program remains closed. So we earn nothing from IVPN. Our how we make money page explains why that changes nothing in the ranking. The buttons on this page point to IVPN’s own site.

Who it is for and who should skip it

Choose IVPN if the risk you most want to guard against is the VPN provider itself. It suits you if you want:

• an account with no email
• payment in cash or Monero
• apps whose source code you can read
• audit reports you can download without logging in
• a transparency report with a zero in the disclosure column every year
• obfuscation that is built for hostile networks.

Choose it if you are a Linux or desktop user who values a firewall-grade kill switch and post-quantum WireGuard. Choose it if you would rather pay a flat $60 a year than manage a renewal trap. Choose it, too, if you dislike the affiliate economy enough to reward a company that walked away from it. IVPN and Mullvad are the only two providers on our site that no review site is paid to recommend.

Skip it if you want a VPN for streaming, because IVPN promises nothing and has no TV apps, no extensions and no Smart DNS. Skip it if you use the VPN mainly on a phone and need a kill switch there, since the current iOS and Android apps do not have one. Skip it if you need port forwarding, a dedicated IP, live chat or a large server list. And skip it if you pay in cash and might want a refund, because cash is non-refundable. Our privacy picks weigh IVPN against the alternatives for the use case it was built for.

Alternatives

IVPN vs Mullvad is the comparison most readers of this page are really making. Mullvad charges a flat 5 euros a month for every term, shown as $5.60 on its pricing page. It gives a 10 percent discount for cryptocurrency. It runs 566 servers in 50 countries, and it dropped OpenVPN in January 2026 to run WireGuard only. It needs no email address and accepts cash and crypto. It has fifteen audits on record from seven firms, and Swedish police left its office without data in April 2023. It refunds within 14 days, but not for cash or crypto. It makes no streaming claims, has no affiliate program and allows 5 devices.

IVPN is cheaper on a yearly Standard plan, at $5 against $5.60. It keeps OpenVPN and offers obfs4 and V2Ray, plus a 10-device Pro Suite tier. It also has email support with a stated response target, a 30-day refund window and a monthly-signed warrant canary, which Mullvad does not run. Mullvad has the larger network, the longer audit list and a kill switch on mobile. See our Mullvad review. For the wider view, read Mullvad vs Proton VPN and Mullvad vs NordVPN.

Proton VPN is the open-source alternative that also does streaming. It has a free tier, 21,722 servers in 149 countries and twelve documented streaming services. It also offers port forwarding, a mobile kill switch, Swiss jurisdiction and a Securitum no-logs audit every year. It costs $3.49 a month on a 24-month plan, or $83.76, and renews at $83.88 a year. It pays affiliates, which is the practice IVPN rejects. See our Proton VPN review.

NordVPN is the mainstream contrast. It has six no-logs assurance engagements, RAM-only servers and 7,242 servers in 150 countries. It makes six streaming claims and offers 24/7 chat and apps for Apple TV, Android TV and Fire TV. But its apps are closed source, apart from the Linux client. Its renewal goes from $94.23 for 27 months to $139.08 a year, and it has a 2024 Panamanian warrant on its record. See our NordVPN review. Every provider we cover is on the reviews hub.

How we verified this review

Every price, plan term, device limit, server count and feature on this page was read from IVPN’s official pages on 31 October 2026. This is where each part came from:

• Prices. The pricing page renders prices client-side, so we read them from the page’s own script bundle. We checked them against the 8 May 2026 plan-changes post and the subscription-tiers help article.
• Server counts. These come from the live server list linked from the status page.
• Audits. The details come from IVPN’s own announcements and the published Cure53 reports.
• Incident and affiliate program. The BTCPay incident and the affiliate-program closure come from IVPN’s blog and help center.
• Transparency figures. We read them from the report itself.

We have not run speed or streaming tests. That is why speed is left out of the score, and IVPN makes no streaming claim for us to record. The data record behind this page is public, and no link on it earns us a commission.