NordVPN Review (Oct 2026): Verified Prices, Audits, Flaws

NordVPN is the biggest consumer VPN brand on the market, and our verified data shows it earns that place on substance rather than advertising. It has the deepest audit history of any provider we track. All of its servers run in RAM. It is based in Panama, outside every intelligence-sharing alliance.

It also has real drawbacks:

• The renewal price is more than three times the introductory rate.
• Some features are missing on Apple devices.
• Two incidents are on the record, and every buyer should know about them.

This page sets all of that out, with the date and source for every number.

Privacy and logging

NordVPN is run by nordvpn S.A. under Panamanian law. Its parent company, Nord Security, is based in the Netherlands. Panama has no law that forces companies to keep user data. It is not a member of the 5, 9 or 14 Eyes, the alliances of countries that share intelligence. This matters because a provider can only hand over data it is forced to keep or chooses to keep.

NordVPN says it keeps very little:

• encrypted login details: an email address for password recovery and a username to set up connections
• the transaction or order ID it needs for refunds

A no-logs policy is a promise not to record what you do online. NordVPN states that it does not log any user activity, and that your account is not linked to your VPN activity. It says that under its no-logs policy, it could not provide relevant information even in response to a valid court order. We could not read the full privacy policy, because it loads only with JavaScript at my.nordaccount.com. So the logging facts on this page come from NordVPN’s help-center articles.

Outside firms have checked this claim more often than any competitor’s. These checks are called assurance engagements: an auditor tests whether a company does what its policy says. PricewaterhouseCoopers Switzerland carried them out in 2018 and 2020. Deloitte Audit Lithuania has done one every year since 2022. The most recent ran from 10 November to 12 December 2025, under the ISAE 3000 (Revised) standard. Only logged-in customers can read the reports. That is a fair criticism, because you have to pay before you can see the evidence. Cure53 audited the apps in 2022 and 2024. In December 2025 it audited them again, together with the infrastructure. VerSprite assessed the apps in 2019.

Two incidents are on the record, and our data record for NordVPN includes both. In March 2018, someone got into a rented server at a third-party datacenter in Finland without permission. They used an insecure remote-management account that the datacenter provider had added. An expired TLS key was taken. NordVPN says no activity logs existed on the server. The company disclosed the breach only on 21 October 2019, nineteen months later. The delay drew more criticism than the breach itself. In response, NordVPN sped up its move to RAM-only servers that it owns. It also began the audit program described above.

The second incident is more recent and less widely reported. In October 2024, NordVPN received a binding warrant from the Panamanian prosecutor’s office in a criminal investigation. The law required it to provide the requested user data in its possession. Its transparency report records one order that led to the disclosure of user information. Under a no-logs policy, “in its possession” means account data, such as the email address and payment reference. It does not mean browsing activity, which NordVPN says it does not hold. It is still a disclosure, and it shows that being based in Panama does not make a provider immune to legal orders.

NordVPN also announced in October 2024 that it is phasing out its warrant canary. A warrant canary is a public statement that a company has not received secret government orders. If it disappears, readers can assume an order arrived. NordVPN is replacing it with quarterly transparency reports in its Trust Center. The old canary page now redirects to the homepage.

If you want to limit what NordVPN can know about you, two payment options help. It accepts these cryptocurrencies: Bitcoin, Ethereum, Litecoin and stablecoins. It also sells prepaid cards for cash in selected retail stores. The other options are cards, PayPal, Google Pay, Apple Pay and regional methods.

Security features

A protocol is the set of rules a VPN uses to build its encrypted connection. The default in most NordVPN apps is NordLynx, NordVPN’s version of WireGuard. It adds a double-NAT system, so the server does not need to store a fixed IP address for each user. OpenVPN, over UDP or TCP, and IKEv2/IPsec are also available.

NordWhisper is a newer protocol that NordVPN built itself. It is designed to look like ordinary web traffic on networks that block VPNs. NordVPN’s obfuscated servers now run on it. Obfuscation disguises VPN traffic so that a network cannot easily spot and block it. The switch to NordWhisper began with iOS 9.8 on 1 July 2026. It reached Linux with version 6.0.0 on 22 October 2026, which also removed the nordvpn set obfuscate command. NordVPN’s support center says a manual OpenVPN connection can no longer reach obfuscated servers. Its NordWhisper page says the protocol does not work with Dedicated IP or Onion Over VPN. The page also says NordWhisper is designed for local network restrictions, not nationwide internet controls.

In China itself, the help center says the Android and iOS apps are “fully blocked”. It documents a manual IKEv2/IPsec connection as the only route. That is why this review lists restrictive networks outside China under “best for”. Our China guide covers the options there.

Since 2025, every app has offered an optional post-quantum key exchange, which works only with NordLynx. Post-quantum encryption is designed to resist attacks from future quantum computers. OpenVPN connections use AES-256-GCM with a 4096-bit Diffie-Hellman key.

A kill switch blocks your internet if the VPN connection drops. NordVPN’s kill switch differs by platform:

• On Windows, NordVPN has two kill switches: one for the whole connection and one for the apps you choose.
• Linux and Android 8 or later have a system-wide kill switch.
• On macOS and iOS, the App Store versions use what NordVPN calls VPN bypass prevention.
• The macOS version you download directly from NordVPN has an app kill switch.
• The Fire TV Stick app has no kill switch.

So every desktop and mobile platform has a way to stop traffic when the VPN drops, but they do not all behave the same way. After you install the app, test it with our VPN check tool.

Split tunneling lets you choose which apps or sites use the VPN and which use your normal connection. NordVPN offers it on Windows, Android and Android TV. The browser extensions can also exclude domains. The macOS and iOS apps do not have it. This is the complaint about NordVPN we see most often from Apple users. ExpressVPN offers split tunneling on both.

NordVPN also offers these extras:

• Double VPN sends your traffic through two servers instead of one.
• Onion over VPN sends your traffic through the VPN and then on to the Onion network.
• Meshnet is an encrypted private network between your own devices. It is useful for remote access and LAN gaming.
• A dedicated IP is available as an add-on.
• Threat Protection Pro blocks ads, trackers, malicious sites and malicious downloads.

The apps automatically use NordVPN’s own DNS servers, which look up the addresses of the sites you visit. They also include DNS leak protection, which stops those lookups from going outside the VPN.

NordVPN has two gaps. The first is port forwarding, which opens a port so other devices can connect to yours. It is not available on standard servers. You can get it only through the separate paid Dedicated Server add-on. That rules NordVPN out for torrent users who need an open port for seeding.

The second gap is IPv6, the newer format of internet address. NordVPN does not support it. The help center says only that the company does “not support IPv6 yet”. No official page says whether the apps block IPv6 traffic. A dual-stack connection uses both the old and the new address formats. If you have one, run our IPv6 leak test before you rely on NordVPN.

Apps and usability

NordVPN has apps for:

• Windows, macOS and Linux
• iOS and Android
• Android TV, Apple TV and Fire TV

On Linux there is a command-line client and, since 2025, a graphical one too. The Fire TV app is not available on first- and second-generation Fire TV Sticks. Browser extensions exist for Chrome, Firefox and Edge. Routers work through manual setup, including DD-WRT and an OpenWrt package.

A plan covers 10 devices at the same time. That is enough for a household, but Surfshark and IPVanish both allow unlimited devices. SmartDNS, branded SmartPlay, is included for devices that cannot run a VPN app.

Only the Linux client is open source, which means anyone can read its code. The code is on GitHub under NordSecurity. The other apps are closed source, and the Cure53 audits partly make up for that. If you want fully open-source apps, look at Proton VPN, Mullvad or IVPN.

We have not yet published our own usability tests or screenshots. They will come with the lab described on our how we test page. The feature table above shows what NordVPN documents on its official pages as of 31 October 2026.

Support

Live chat is available 24/7. There is also email support and a large help center, which is the source for most of the facts on this page. We have not yet measured how fast support answers tickets. So the support score reflects what is available, not how good it is. The no-logs reports are also behind the customer login, so support cannot send them to people who are still deciding.

Plans and the renewal trap

NordVPN sells three tiers:

• Basic is the VPN plus Threat Protection.
• Complete adds the NordPass password manager and encrypted cloud storage.
• Prime adds identity-protection features.

We checked prices on 31 October 2026, during a Black Friday promotion that added three free months to every long plan. The 27-month plans cost $3.49, $3.99 and $6.99 a month for Basic, Complete and Prime. They are billed as $94.23, $107.73 and $188.73 up front. The 15-month plans cost $4.99, $5.99 and $8.99 a month. The monthly plans cost $14.99, $19.99 and $29.99.

Check the renewal price before you buy. The 27-month Basic plan renews at $139.08 for a year. That works out at $11.59 a month, 3.3 times what you paid for the first term. Complete renews at $219.48 a year and Prime at $296.28. Most providers charge more at renewal, but NordVPN’s jump is among the steepest we track. Our NordVPN pricing page keeps a price history, so you can see if it changes. Set a calendar reminder for the renewal date. You can also turn off auto-renewal and buy again at the promotional rate.

There is no free tier. New users in listed countries can get a seven-day free trial on the one- and two-year Prime plans. The trial needs a card or PayPal, and it becomes a paid plan unless you cancel. Our NordVPN free trial guide shows how to start it and how to cancel in time. The 30-day money-back guarantee applies to your first purchase only. Apple refunds App Store purchases under its own rules.

Who it is for and who should skip it

NordVPN suits people who want:

• one subscription that covers phones, laptops, a smart TV and a router
• streaming support that NordVPN claims for the main US services
• strong audit evidence behind the no-logs policy
• tools that most competitors lack, such as obfuscation and Meshnet

If you can accept a long term paid up front, the introductory price is competitive.

It is a poor fit for:

• torrent users who rely on port forwarding
• anyone on an IPv6-only or dual-stack network who wants IPv6 traffic sent through the VPN rather than ignored
• macOS and iOS users who need split tunneling
• anyone who wants to pay month to month, where $14.99 is near the top of the market

Some privacy purists object to apps full of upsells and to closed-source apps. Some want to pay without giving an email address for the account. They will be happier with Mullvad or IVPN.

Alternatives

Surfshark shares an owner with NordVPN, because both belong to Nord Security. It costs less on its long plans and allows unlimited devices at the same time. But it has no port forwarding either, and it discontinued its SmartDNS in February 2026. Our NordVPN vs Surfshark comparison goes through the differences line by line.

ExpressVPN matches NordVPN on audits and RAM-only servers. It adds split tunneling on every platform. Its own Lightway protocol has post-quantum protection switched on by default. Its order page sells only a 28-month introductory plan. See ExpressVPN vs NordVPN.

Proton VPN is the choice for open-source apps, a free tier you can really use and Swiss jurisdiction. The trade-off is fewer streaming claims on the free plan. See NordVPN vs Proton VPN.

Private Internet Access offers port forwarding, open-source apps and a 39-month plan at $2.03 a month. It operates under US law. See NordVPN vs Private Internet Access.

Mullvad charges a flat €5 a month. It needs no email address, accepts cash and now runs WireGuard only. It does not market streaming and does not run an affiliate program. See Mullvad vs NordVPN.

How we verified this review

We read every price, plan term, renewal amount, server count and feature on this page from NordVPN’s official pages on 31 October 2026. Our automated fetcher got an error from nordvpn.com. So we loaded the pages with a standard request and read them from the saved HTML. Audit dates come from NordVPN’s own announcements. The two incidents are sourced to NordVPN’s own statements. We have not yet run speed or streaming tests. That is why speed is left out of the score and streaming entries are labeled as claims. The data record behind this page is public.