The best VPNs (and how affiliate links broke the web)

Confessions and recommendations from an ex-Editor-in-Chief.

Want to pay for a VPN? I recommend Mullvad. But that wasn’t my top recommendation when I ran How-To Geek. Like many other websites, we recommended ExpressVPN.

You won’t read about Mullvad in most VPN roundups — it doesn’t offer affiliate links, so websites don’t get paid to link to it. ExpressVPN does offer affiliate links — with very good rates. Most VPNs do.

This post contains zero affiliate links. I won’t get paid a cent for linking to a single VPN here. These are my unfiltered, real recommendations.

I’ll tell you how the sausage is made. And I’ll explain what I’ll do going forward.

The best VPNs (without affiliate links)

One of my awesome paying subscribers asked about VPNs in this month’s Ask Me Anything thread. He noted his ExpressVPN renewal was looking expensive. Here’s what I recommended to him instead:

• Mullvad VPN: Mullvad costs €5 per month (about $5.82) with no price increases. You can pay for a month or a year at the time, and they don’t play pricing games. More importantly, it has an excellent privacy reputation.

• Proton VPN Free: From the company that brought you ProtonMail, the free version of Proton VPN has no bandwidth or usage limits. You can get more speed and other features with a paid plan, but this is good in a pinch.

• Windscribe Free: Windscribe has a decent reputation and offers 10 GB of data per month for free. If you don’t need much data, this could be excellent.

The above VPNs don’t offer affiliate links. (Well, Proton VPN does — but I didn’t use them.) Read why Mullvad doesn’t provide affiliate links, and why Windscribe doesn’t.

Here’s the thing about ExpressVPN: It wasn’t bad. As far as I know, it’s a good VPN. But it’s very expensive after the promotional period, and it’s more than most people need.

So much of the messaging around it is vague, fear-based marketing about “staying private online.” And those people recommending you ExpressVPN and the other big VPNs — YouTube personalities, podcasters, and VPN buying guide web pages — are making serious money from pushing those VPNs. But there’s a good chance you don’t need a VPN at all. Don’t assume you do!

How the sausage is made

When I started writing for How-To Geek as a freelancer in the early 2010s, I wrote some pieces about VPNs. They did well. Later, the site owners added recommendations — and affiliate links — to those articles.

When my boss said he believed in ExpressVPN — that he had used it for a long time, that he had spoken to the company, and that it had a good reputation — I believed him. It was his website, he set the editorial direction, and I was just a freelancer. But I also know that How-To Geek must have made lots of money from those VPN affiliate links.

This isn’t a takedown of ExpressVPN in particular. This is just how the VPN industry works. Companies pay to play. For most websites, the idea that a VPN buying guide would recommend a VPN that doesn’t have a high affiliate rate is nearly unthinkable. (Props to Wirecutter, which recommends Mullvad as their top paid VPN and Proton VPN as their top free VPN.)

But your favorite YouTuber or podcaster probably isn’t going to do a segment about Mullvad. It doesn’t pay. And, if How-To Geek suddenly decided that Mullvad was the best VPN, I bet the company would have lost a significant amount of revenue.

When I became Editor-in-Chief of How-To Geek, the site had recommended ExpressVPN as its top pick for a long time. Lots of other websites did, too. My boss didn’t have to say anything about our VPN picks — I understood that if I were to change our top VPN pick to something without an affiliate link, that could have serious financial consequences. And the goal was to keep the company strong and growing so it could make payroll and pay for people’s health insurance.

When I brought on a new VPN freelancer and he said he preferred Mullvad, I wasn’t surprised — I had seen Mullvad recommended in some circles. I also bristled because we couldn’t suddenly start writing pieces that endorsed Mullvad over ExpressVPN. We wrote about Mullvad, but we couldn’t suddenly start saying it was our top pick over ExpressVPN. After all, ExpressVPN was historically our top choice. I never re-evaluated it. (And why would I? I was running a website, and I was too busy to review every VPN out there. The owner was confident about his editorial choice. And, of course, it would be silly for a new freelancer to immediately change the site’s long-running VPN recommendation—)

That’s all true. But I also knew that Mullvad didn’t have affiliate links.

Dear reader, let me be clear: I never gained a single extra cent because How-To Geek used VPN affiliate links. There was no kickback to me personally. Those affiliate links were just one reason I was able to hire employees, provide them with health insurance, pay freelance writers — and get my own paycheck to pay my own bills.

At How-To Geek, we once dreamed of a future where we recommended good products and could use less ads on the website — no auto-playing videos, fake download buttons, and all that other junk. Lots of sites saw affiliate links as a way to pay their bills.

How much money did ExpressVPN pay per reader we sent their way? Even I don’t know. Websites say “we may earn a commission” if you buy something, but you’ll never see a disclosure of how much. One product might pay twenty times the rate of another product.

Affiliate links probably shouldn’t exist at all — not in media. But programmatic advertisements probably shouldn’t exist on media websites, either. The “original sin” of the web is the idea that everything would be free and advertising supported. It would be best if publications were directly reader-supported and they weren’t incentivized to sell you specific products. That’s the future I’d like to see. I wish that was the past we lived through.

What I’ll be doing

This piece contains no affiliate links. I will gain no financial benefit from recommending the VPNs I recommended above.

I’d make a lot more money from recommending ExpressVPN or another big VPN with good affiliate rates. ExpressVPN is fine. Many other VPNs you’ll see recommended all over the place are also fine. But, if you’re asking me what I personally recommend, the answer is Mullvad.

I’m leaving money on the table here because I want to tell you what I actually believe.

It would be emotionally satisfying to end this post by saying I’ll never use an affiliate link. But, instead, I’m going to extend a hand and ask for your trust.

Here’s my plan: I’ll be writing an occasional extra piece about products and services I actually use. Things I use, love, and would recommend regardless of affiliate links. You might see an extra email or two every month — these won’t replace the weekly Windows newsletters. I’ll be using clearly marked affiliate links in these pieces. And I’ll tell you exactly how to set up an email filter so you’ll never see one of these pieces if you don’t want to see them — seriously.

I’m grateful for all the awesome people that are chipping in a few bucks each month to support me. This is just another way you can support me at no cost to yourself. And I hope you’ll discover awesome new things.

Most media websites, YouTubers, podcasters, influencers, and online creators are doing this. But they won’t tell you how the industry works. I will.

We’re all doing our best

It would be fun to write this piece as a takedown! But it’s not a takedown. As far as I know, ExpressVPN is a good VPN — it’s just expensive. My boss was a good boss, and he ran How-To Geek with a real ethical backbone. I’m sure we could have made worse recommendations at How-To Geek — but there was a financial benefit from the recommendation.

And maybe I’m the one who’s wrong. Maybe my boss would have recommended ExpressVPN no matter what. Maybe I would have concluded it was the best option if I did the research.

The problem with affiliate links is that we’ll never really know. They create an incentive to recommend one particular product over another one.

Time to touch grass

Here’s the forest I was walking through while I planned this email in my head. Have a great weekend.

The latest from Thurrott.com

Microsoft wants to remove ways to create a local user account while setting up a Windows 11 PC, but Paul Thurrott has a collection of workarounds. Meanwhile, there was just a Patch Tuesday update this week.

Lots of AI news this week. After years of trying to sell new “AI PCs” with its PC partners, Microsoft now wants to “make every Windows 11 PC an AI PC.”

Copilot is getting the ability to change settings in Windows — a feature it had years ago that Microsoft removed. And Microsoft is talking about how it will secure AI agents.

For Thurrott Premium subscribers, Paul’s take on AI being “the end of apps” is definitely worth a read, too.

**** Command Prompt ****

C:\> logoff HOWTOGEEK\chris