Lila leans in the office doorway with two mugs of coffee, eyeing the whiteboard where I've wiped the same row of speed-test numbers three times this week. "Which one broke this time?" she asks. Two years into this project, she skips the setup questions and goes straight for results, same as most of my Seattle tech friends do whenever NordVPN or privacy tools come up at a cookout.
Quick disclosure before the numbers: some links below are affiliate links, and I earn a commission if you subscribe through one, at no extra cost to you. I paid full price for every subscription in this piece myself, specifically so nobody could accuse the results of being sponsored.
Here's the short answer, the one that actually matters if you're deciding what to pay for: after two years of running my own numbers from a home lab office on Beacon Hill, VPN speed loss almost always comes down to three things — which protocol you're using, how far your traffic has to travel to reach a server, and how your ISP routes things at that hour. The provider's server count, the number every homepage brags about, barely moves the needle on a single session. Everything past that point is either marketing or noise, so the rest of this is me answering the questions people actually email me, roughly in the order they usually ask them.
How Do You Actually Test VPN Speed From a Seattle Home Office?
The honest answer is: repetitively, and with more coffee than is probably healthy. Over one month I ran fifteen tests a day across five providers — morning, evening, and the 8 p.m. stretch when half the neighborhood is streaming something at once — for 450 tests total, all on a symmetrical gigabit fiber line. I track more than raw throughput, too; jitter matters just as much if you're on a video call and don't want your voice sounding like it's underwater. Two mini-PCs on a shelf behind my desk log connections around the clock, and there's a whiteboard next to the monitor stack that's less a productivity tool at this point than a graveyard of crossed-out configs.
Protocol choice turned out to matter more than anything else I measured. Running NordVPN's NordLynx, which is their tuned build of WireGuard, I held around 912Mbps on a 950Mbps baseline — call it 96% retention, a number that would have been a rounding error before WireGuard-based protocols existed. Distance to the server and how my ISP was routing at that hour explained almost all the rest of the variance I saw; the total server count a provider advertises had close to zero relationship with what showed up on a single test. I've also run the same suite from a laptop at Gasworks Park just to rule out my own router padding the numbers, and the ranking between providers barely moved, which told me the difference really was the protocol, not my hardware. The one moment that sticks with me from that stretch is watching the WAN port's status light shift to a slow amber pulse right as a transfer stalled. That small, dumb detail somehow announces a failed test faster than the app itself does.
The Kill Switch Almost Left Me Exposed During a Reboot
I assumed a kill switch's protection carried through a full system restart the same way it does through a manual disconnect. It doesn't, always. I was running Private Internet Access, the pick for people who like open-source apps and a lot of dials to turn, and after a routine reboot I found a short window — after the OS finished loading but before the VPN app had relaunched and rebuilt its tunnel — where a few requests slipped out over my raw ISP connection. I only noticed because I happened to be watching a packet capture at the time, not because the app flagged anything.
Nothing catastrophic went out in that window, but it cost me an afternoon of testing every other provider's behavior after a cold restart instead of trusting whatever the settings page claimed. It's the kind of gap you only find by actually rebooting mid-test, not by reading a feature list.
Does Speed Actually Matter for Remote Software Work, or Is That Overblown?
It matters more than people expect, though not in the dramatic way marketing implies. What actually kills productivity isn't average throughput — it's a connection that stutters under load, which is exactly the risk for remote software developers pushing large builds or holding an SSH session open for hours. A VPN that averages a great number but has occasional stalls will drop that session at the worst possible moment, while one with a slightly lower average and flat, boring consistency just works in the background all day. I care less about which VPN hits the fastest peak and more about how it behaves under whatever your ISP is doing to classify and route traffic at that hour, since that's usually the real bottleneck, not the VPN software itself.
None of this replaces actually thinking through what you're protecting against in the first place — a freelancer working from unfamiliar networks while traveling has a different risk profile than someone on symmetrical fiber at home, and matching the tool to that situation matters more than chasing a benchmark number.
Split Tunneling: Useful Until It Isn't
Split tunneling lets you route some traffic through the VPN and send the rest over your normal connection, which is handy if you need work traffic encrypted while your local backup server or printer stays reachable. I trust the feature. I don't trust myself configuring it at 11 p.m. I once set up a split-tunnel rule meant to exclude only my NAS backups from the tunnel, except I fat-fingered the scope and ended up excluding my main browser too. For the better part of a week, a chunk of my daily browsing went out over my raw ISP connection instead of the VPN, and I didn't catch it until I ran a routine IP check and saw my home address staring back at me instead of the exit server I expected.
The fix was simple once I found it — narrow the rule down to the specific application instead of a broad traffic category — but the lesson stuck. Split tunneling is only as good as your willingness to double-check it with an actual IP lookup after you set it up, not just trusting that the toggle did what the label said.
Consistency Beats Peak Speed, Every Time
Most reviews chase the biggest number a VPN can hit under perfect conditions. I care more about the floor: what happens at 8 p.m. when everyone nearby is streaming and the network is under real load. That's where ExpressVPN's Lightway protocol earned some respect from me, even though it rarely won the top-speed contest outright. I remember sitting in a coffee shop on Eastlake with the speed test open, half expecting the usual coffee-shop congestion to tank it, and watching the number hold flat at 185 Mbps through a lunch rush that should have wrecked it. That kind of boring reliability is worth more to me than a benchmark screenshot.
The tradeoff is price — Express costs noticeably more per month than the rest of this list, and unless you specifically need its RAM-only server setup or a slicker app across every device, the premium gets harder to justify once a competitor closes most of the speed gap. Picking a VPN by its top speed alone is a lot like picking a cloud storage plan by its fastest possible upload burst — nice on a spec sheet, meaningless the one time you actually need it under real load. Worth checking, too, is whether a provider's app actually shows a DNS leak warning when something's misconfigured, since that's a much bigger real-world risk than the half-second you might save picking the fastest protocol.
Device Limits Change the Math for Shared Households
Between my workstation, two laptops, a couple of phones, a tablet, and a smart TV that apparently needs its own opinion about which country it's in, device limits turned into a real constraint fast. This is where Surfshark made the most sense of anything I tested — unlimited devices on one account means I stopped playing a small game of musical chairs every time a new gadget needed covering. For a shared house, that math matters more than an extra few Mbps of peak speed ever will.
Do You Actually Need to Hide That You're Using a VPN?
For most people reading this from a normal home network, no — nobody's flagging your traffic for looking encrypted. I still tested Surfshark's Camouflage Mode, which relies on obfuscation to make VPN traffic look like ordinary HTTPS browsing, mostly to see what it cost in latency (a little, but not much). That feature matters far more to someone working under heavy censorship than it does to me deciding what to watch on a Tuesday, and if your actual problem is geo-restrictions while traveling, that's its own can of worms I'm not opening here. The question I get asked more often is about managing a household full of devices, and if that's you, the multi-device VPN comparison is more useful than chasing an extra few Mbps.
Two Mistakes That Skewed My Own Data
The first was adding a dedicated IP add-on to skip the CAPTCHA wall my bank's site kept throwing at me. It worked for that one purpose, but it also meant every session I ran through that connection came from the same address every time — precisely the kind of consistency that lets a site build a profile of you over months, the opposite of what most people want a VPN for in the first place. A dedicated IP is a legitimate tool for a specific job, not something to default to for general browsing.
Second, I nearly published a bad batch of numbers as a real result. A few days into testing, one provider's evening results looked dramatically worse than everything else, and I almost wrote it up as an inconsistent performer before noticing one of my mini-PCs was mid-sync on a large backup job during that exact test window. The bandwidth contention had nothing to do with the VPN and everything to do with my own network being busy — and if I hadn't caught it, I'd have published a wrong conclusion about a provider that didn't deserve it. I rerun any result that looks like an outlier now before it goes anywhere near a final verdict.
Quick Answers to the Questions I Get Most
A few things come up often enough that they deserve a straight answer instead of a full section. Whether a provider's no-logs claim means anything comes down to whether it's been independently audited, not just stated in a privacy policy. Port forwarding matters a lot if you're running your own server or seeding something legally, and barely at all for everyone else, so don't let its absence or presence be the deciding factor unless you already know you need it. A VPN client on your laptop only protects that one device, while running the tunnel at the router level covers everything on the network at once, including gadgets that can't run VPN software themselves — worth knowing before you assume your smart TV is covered. And a browser-only proxy extension is a much thinner shield than a full system tunnel; it's fine for quick, low-stakes browsing but it isn't doing anything for the rest of your traffic.
The other thing worth admitting: not every VPN I've tried made the cut for a good reason. Early on I ran a free app for a few weeks because it was free, and it throttled me down to nothing once I crossed 500 MB for the month — then I found out later it was selling browsing data on the side, which is the exact opposite of what I was trying to pay to avoid. I stopped using it the day I read that in its privacy policy, and it's a big part of why "free" is no longer a starting point for anything that touches my traffic.
So Which VPN Actually Wins?
For a Seattle setup on gigabit fiber, it's still NordVPN. The 912Mbps average on a 950Mbps line is the headline number, but what actually earned my money was the consistency — no local network lockouts once I fixed my own split-tunnel mistake, no random collapses to a fraction of my bandwidth during peak hours, and an app that connects every time I click it even if the interface feels a little busy. If budget is the deciding factor and you don't mind a more corporate parent company behind the brand, CyberGhost is the one I'd point a budget-conscious reader toward — its long-term pricing is hard to beat and the use-case-specific servers are a nice touch, even if speeds outside the US and EU can be inconsistent depending on load.
Lila still thinks the whiteboard needs to go. I've told her it's staying until a provider gives me a reason to stop testing, and two years in, none of them have yet.