Every resolver in a DNS leak test is supposed to point back to the VPN's own servers, not your internet provider's. For longer than I'd like to admit, mine didn't, because I'd assumed Chrome's incognito mode was already doing that job on its own. It wasn't. Incognito clears cookies and local history; it does nothing to your actual IP address or the DNS queries leaving your machine, which is exactly the kind of gap that matters when you're a remote software developer pushing code and SSH sessions across networks you don't control. Once I ran an actual VPN and reran that same leak test, every resolver came back listing the VPN's own servers — a small, unglamorous check that told me more than any padlock icon on a pricing page ever has.
Quick disclosure before the comparison: this page contains affiliate links, and if you subscribe through one I earn a commission at no extra cost to you. I paid for every subscription mentioned here myself and ran the tests on my own connection in Seattle — nobody sent me a review unit or a script to follow. That matters more in this niche than most, because a lot of the marketing copy in the VPN industry promises "unbreakable" security, which in practice usually just means standard AES-256 encryption (the same thing every competent provider already ships).
Why Latency Matters More Than Marketing Speed Claims
For most people shopping for a VPN, the pitch is about streaming libraries or keeping an ISP from seeing which sites they visit. Developers run into a different failure mode entirely. Add enough latency and an SSH session starts to feel like a badly delayed phone call — you type, there's a pause, and the characters catch up all at once a beat later. Add too little throughput and pulling a fresh multi-gigabyte Docker image, or syncing a monorepo that's grown well past reasonable, turns into a coffee break you didn't plan for. Figuring out what actually needs protecting is narrower than "everything," too. Sorting out whether that's SSH traffic to client infrastructure, source syncs, or just general browsing is basically a threat-modeling exercise, and it's worth doing before you pick a plan rather than after. Local network access matters here as well, since half the point of working from home is not losing the ability to print a design doc or reach a NAS just because the VPN is on. If that's biting you, the case for split tunneling is worth reading on its own: it lets you route only the sensitive repo and SSH traffic through the tunnel while Slack and Zoom go direct, which cuts a surprising amount of lag.
NordVPN vs. Self-Hosted WireGuard: What Actually Held Up
NordVPN is the one that survived months of recurring benchmarks without embarrassing itself. Running NordLynx during a heavy testing stretch, I was consistently seeing throughput around 820 Mbps against a raw fiber baseline near 940 Mbps — call it roughly 87 percent of what I'd get with no VPN running at all. That gap matters more than it sounds: when you're pulling dependencies for a new project, the difference between 87 percent and something closer to 65 percent is the difference between staying in flow and drifting off to a browser tab while a progress bar crawls. Ping told a similar story. My baseline to a local Seattle server usually sits around 8ms; with NordVPN connected, it crept up to roughly 12ms, a gap too small to notice on a call or inside a remote IDE session.
The feature that actually earned its keep wasn't a speed number, though — it was Threat Protection catching a known malicious domain during a routine dependency audit that my regular DNS setup had let through without comment. That's the kind of "boring" feature that reads like filler copy until it flags something real on a dev machine. A reader named Darby Kuang, who never sends a question without pasting half a terminal session into it, emailed recently wondering what actually happens to an open SSH connection the instant a VPN drops mid-transfer — kill switch behavior is its own rabbit hole, and it's worth reading up on separately rather than assuming every provider handles that moment the same way.
Pricing works out sanely if you're willing to commit to a multi-year plan instead of paying month to month — think less "recurring expense" and more "thing you set up once and stop thinking about," similar to how a cloud storage subscription disappears into the background once it's configured. What's worth checking before committing, though, is whether a provider's no-logs claim has actually been verified by someone outside the company. Developers handling client source code especially should look for independently audited providers rather than taking a marketing page's word for it — that's the whole argument behind the case for an independently audited no-logs VPN, worth a read if privacy is the deciding factor for you rather than raw speed.
Before settling into a subscription, I tried the obvious developer move: rolling my own WireGuard instance on a small VPS. For a while it felt great — full control over the configuration, no third party in the logs, nothing to trust but my own setup. Then a kernel update on that VPS broke the configuration on a morning I was supposed to be squashing a production bug, and I spent an hour debugging my own infrastructure instead of the actual problem I was being paid to fix. That's the trade-off nobody mentions when they talk about "sovereignty": you're not just avoiding a third party, you're volunteering to be your own sysadmin, unpaid, usually at the worst possible time. Commercial services like NordVPN or ExpressVPN hand that maintenance burden back to someone else, the same logic behind choosing a managed database over running Postgres on a laptop that lives in a closet. If you want to push reliability further than a subscription, there's a separate case for handling VPN configuration at the router level instead of per-device — different trade-offs, worth its own comparison rather than a paragraph here.
ExpressVPN or Private Internet Access: The Power-User Alternatives
ExpressVPN is the other one I keep paying for, even though it wasn't the fastest in raw testing. Their Lightway protocol is remarkably battery-efficient, which matters more than benchmarks suggest once you're away from a desk. I'll set up at a table near Pike Place Market with a laptop and no charger in sight, and Lightway routinely buys me twenty or thirty extra minutes of coding time before the battery icon turns red (a real concern when your charger is sitting on a desk half a city away). It costs noticeably more than the rest of this list, and I'd like a bit more transparency in their annual reporting, but the app itself is the most polished piece of software in the category — true whether you're running the full desktop client or just the browser extension, though a browser-only proxy and a full system tunnel protect very different slices of your traffic, a distinction worth understanding before assuming one covers the other.
Then there's Private Internet Access, the pick for anyone who actually enjoys tuning connection settings instead of clicking "Connect" and moving on. Their apps are open source, which for a developer audience is close to a mandatory feature rather than a nice-to-have — you can go read the code instead of trusting a claim. You can also adjust encryption levels to favor speed over overhead on a network you already trust, and dig into protocol selection yourself instead of accepting whatever the app defaults to, though picking the right protocol for a given connection is a big enough topic to deserve its own comparison rather than a paragraph here. Large file transfers are where a lot of people start caring about port forwarding specifically, and that's another rabbit hole PIA lets you go down if you want to. The same goes for dedicated IP setups, which solve a narrower problem — consistent access for remote infrastructure — worth its own separate look rather than a footnote. None of this is beginner-friendly by default, and PIA's settings screen can feel like stepping into a stranger's terminal config, but for someone who wants that level of control, it's the closest thing on this list to a power tool.
Surfshark and CyberGhost: Where the Budget Picks Land
For anyone counting devices instead of dollars, Surfshark and CyberGhost are the two worth knowing about. Surfshark's unlimited-device policy sounds like a marketing throwaway until you actually have a home lab's worth of gear needing coverage. A neighbor a couple houses down spends most weekends homebrewing IPAs and running a kegerator setup in his garage, complete with temperature probes, a small controller board, and the works. When he asked what to do about all of it sitting on his home network, unlimited-device plans were the obvious answer, since providers that cap you at five or six connections start feeling stingy fast once smart devices enter the picture.
CyberGhost's selling point is the 45-day money-back window, longer than anything else on this list and an easy way to actually test a provider properly before committing. Speeds outside the US and EU were noticeably less consistent in my testing than Nord or Express managed, though for someone working domestically most of the time, that gap won't show up often enough to matter. Neither Surfshark nor CyberGhost topped my benchmark sheet, but price-to-performance is a different ranking than raw speed, and on that scale they both hold up fine.
What the Raw Benchmarks Actually Show
These numbers come from a hardwired Cat6 connection with nothing else on the network competing for bandwidth — no background 4K streams, no big downloads running in another window. Base speed with no VPN active sat around 940 Mbps. NordVPN's NordLynx protocol held roughly 820 Mbps with ping around 12ms. ExpressVPN's Lightway came in at about 745 Mbps with 15ms ping. Private Internet Access measured close to 690 Mbps at 19ms. Surfshark landed around 615 Mbps with 23ms ping, and CyberGhost trailed at roughly 590 Mbps with 26ms ping. Each figure is an average of five runs per provider during peak working hours, not a single lucky test.
One architectural detail matters more than the leaderboard order: RAM-only server infrastructure, which both Nord and Express run. If a server is ever physically seized, there's nothing on a hard drive to recover, because nothing was ever written to one in the first place. That's a more convincing trust signal than any "no-logs" badge sitting on a landing page. Whether your ISP is quietly treating VPN traffic differently from everything else on your connection — throttling it, deprioritizing it during peak hours — is a separate question worth investigating on its own, and the answer varies enough by provider and region that it doesn't fit neatly into a benchmark table.
So Which VPN Should a Remote Software Developer Actually Install?
Picking a VPN ends up feeling a lot like picking a framework for a new project — the right answer depends on what you're optimizing for, not which option has the loudest marketing page. Choose NordVPN if raw throughput and ping matter most and you want the closest thing to "set it and forget it" reliability; it's the one that's stayed installed on my primary machine after months of side-by-side testing. Choose ExpressVPN if you're regularly working untethered from a charger and app polish matters as much as the numbers. Choose Private Internet Access if you actually want to tune protocol and encryption settings yourself and don't mind a steeper learning curve. Choose Surfshark or CyberGhost if the deciding factor is price relative to how many devices you're covering, not shaving another 100 Mbps off a benchmark.
None of these are the boring choice in a bad way — in software, infrastructure that doesn't page you at 2am is usually the entire goal. If you're still deciding, start with whichever trade-off you actually care about, run your own speed test for a week, and keep the one that disappears into the background instead of reminding you it's there.