VPN Chooser: pick by threat model
The VPN Chooser turns six multi-select questions about who you hide from, where you connect and how much setup you will do into one recommended approach, ordered next steps, and the list of things that approach does not solve.
Your answers are worked out in this tab and kept in the link, so the result can be shared. Provider reachability is fetched from the pwnsy censorship API only when censorship is part of your answer.
How the VPN Chooser works
Each question is multi-select, and the answer recomputes on every tick. Rules run top to bottom and the first match wins:
- Adversary with legal reach (goal: a state adversary, or linkability: a national authority) leads to Tor, with the VPN question treated separately.
- Censorship (place: a heavily filtering country, or goal: national censorship) leads to an obfuscated transport picked on local evidence.
- Streaming (goal: geo-restrictions, or needs: streaming catalogues) leads to a commercial provider chosen on address inventory.
- Public Wi-Fi leads to the free protections first: encrypted DNS and HTTPS-Only mode.
- Own server (setup: run a server) leads to a self-hosted VPS.
- Everything else leads to a commercial provider chosen on audits and payment terms.
Your other answers then add cross-checks, such as latency advice, bandwidth terms, or a warning when two answers pull against each other. When censorship is in play, the result adds a table of providers with a reachability verdict per country, built from OONI measurements over the last 90 days by the pwnsy Censorship Radar.
How to read the result
- The verdict card names the approach. Its colour follows the path the answers lead to: green for the free fixes on public wifi and for a self-hosted server, amber for a commercial provider, an obfuscated transport, or a self-hosted server when a tracker must not link the traffic to you, and red for Tor, where a VPN is the wrong tool.
- Next steps are ordered, because sequence matters. Tick them off as you go; the Steps done tile counts them.
- What this does not solve is never empty. Every approach lists its failure modes.
- Cross-checks are notes on your specific combination of answers.
- The decision trace shows which rule picked the answer and which lower rules would also have applied.
FAQ
How does the VPN Chooser pick an answer?
Rules run top to bottom and the first match wins: an adversary with legal reach leads to Tor, then censorship leads to an obfuscated transport, then streaming leads to a commercial provider chosen on address inventory, then public Wi-Fi leads to free protections first, then running your own server leads to a self-hosted VPS, and everything else leads to a commercial provider chosen on audits and payment terms. The decision trace in the result shows which rule fired.
Does the chooser send my answers anywhere?
The recommendation is computed by this page's JavaScript, and no pwnsy API receives your answers. Your ticks are kept in the link after the # sign, so the result can be shared, and in this browser's local storage, so they are still there next time. The only lookup is the country list and provider results from the pwnsy censorship API, made when censorship is part of your answer.
Why does it recommend Tor instead of a VPN against a state adversary?
A commercial VPN moves trust from your ISP to the VPN company, which has a registered address, a payment processor and a jurisdiction, and can be compelled. Tor splits the path across three relays run by unrelated volunteers, so no single operator knows both your address and your destination.
Does the chooser rank VPN brands or earn affiliate fees?
No. There is no affiliate ranking. Providers are named only where a checkable property fits your answers, such as Mullvad and IVPN meeting the account and audit criteria, and every answer lists what it does not solve.
Where does the provider reachability data come from?
From OONI measurements over the last 90 days, scored per provider by the pwnsy Censorship Radar. It appears when you choose a filtering country or national censorship. A reachable provider website is weaker evidence than a working tunnel.
Country-level blocking evidence referenced here is measured by OONI and surfaced in our Censorship Radar. The protocol fingerprinting claims (WireGuard's fixed-length handshake, OpenVPN's opcode byte, active probing of Shadowsocks) come from the published measurement work of the GFW Report and the censorship research community. Provider properties are taken from the providers' own published audits and account terms, which you can check at the source.