NordVPN Review 2026: Is It Safe, and Is It Worth the Renewal Price?

NordVPN is safe to use and, for most people, worth the money, with one big condition: budget for the renewal price, not the headline deal. Its no-logs claim has been through six independent assurance engagements, the most recent run by Deloitte between 10 November and 12 December 2025, and nothing in its incident record shows user activity being exposed. It scores 90 on our Gauge Score, a point behind Proton VPN.

Buy it if you want one audited app that covers ten devices and does nearly everything. Skip it if you need fully open-source apps on every platform, or if a renewal of $139.08 a year for the Basic plan (US, before tax, read 9 Oct 2026) would make you resent the purchase in year three.

Is it safe? The short answer, with receipts

Yes, on the evidence a reader can check. "Safe" for a VPN means three things: it does not keep a record of what you do, its infrastructure has not leaked that activity, and its apps protect you when the connection drops. NordVPN has outside evidence for the first, a mixed but disclosed record on the second, and strong tools for the third that you sometimes have to turn on yourself.

The receipts are below in order: who audited the no-logs promise and when, what went wrong in 2018 and what was claimed in 2026, what the company still holds about you, and which protections are off until you flip them. We have not run speed tests and do not quote any; this review rests on audit reports, NordVPN's own support documentation, dated press coverage and prices read on 9 October 2026.

Keep one idea in mind with any VPN: you stop trusting your broadband provider with your traffic and start trusting the VPN firm instead. Anonymity is not on offer. The question is whether NordVPN deserves that trust, and that is a question about evidence.

The audit record, 2018 to 2026

NordVPN has now commissioned six independent checks of its no-logs policy. Press coverage of the company's announcements dates them to 2018 and 2020 (both reported as PwC engagements), then Deloitte in 2022, 2023, late 2024 (18 November to 20 December) and late 2025 (10 November to 12 December, announced on 3 February 2026). The latest was an assurance engagement under the ISAE 3000 (Revised) standard.

Scope matters more than the count. Coverage of the sixth engagement says it looked at standard VPN servers and obfuscated servers as well as the Double VPN and Onion Over VPN types, and that the auditors interviewed staff and reviewed configuration files and live system logs. That is a check of how the service is set up and run during a window, not a guarantee about every day since. No audit can prove a negative forever; what repeated engagements do is make a quiet change of policy harder to hide.

How it compares: Proton VPN's latest Securitum no-logs audit put auditors on site at its Zurich offices for a week in May 2026 (20-27 May), and its apps are open source on every platform. Surfshark, NordVPN's sister brand, has two Deloitte reports (2023 and June 2025). ExpressVPN's most recent KPMG assurance looked at its systems as of 28 February 2025. NordVPN's cadence is the longest unbroken run of the group, which is why it scores 9.2 out of 10 on our privacy pillar. Read the Proton VPN review for the provider that edges it on transparency.

Incidents: the 2018 Finnish server breach and the 2026 claim

Two events belong in any honest NordVPN review, and most ranking pages either skip the second or tell the first as stale news.

March 2018: one rented server in Finland

A server NordVPN rented from a Finnish data-centre provider had been running for about a month when an intruder accessed it in March 2018 using a remote-management tool the data-centre company had left exposed, which NordVPN says it did not know existed. The intruder made off with an expired internal private key. NordVPN's account is that the server kept no logs of user activity, the key could not be used to decrypt traffic on its other servers, and no other server was affected; it ended its relationship with that provider. The company disclosed the breach publicly in October 2019, months after it found out, which drew fair criticism at the time (TechCrunch, 21 October 2019). The account of what the key could and could not do is NordVPN's own; no independent forensic report has been published.

What it tells you today: the risk was a third-party server, not logging, and the audit run since then is the response a reader can check. The slow disclosure is the real mark against the company, and it is part of why our transparency pillar sits at 7.5.

January 2026: the "1011" leak claim

Over the weekend before 5 January 2026 a user calling themselves "1011" posted on a hacking forum that they had brute-forced a misconfigured NordVPN development server and taken more than ten databases, including Salesforce API keys and Jira tokens. NordVPN denied it the next day, saying the material came from a test setup it had trialled with an outside vendor of automated-testing tools, "containing only dummy data used for functionality checks", that "was never connected to our production systems" (BleepingComputer, 5 January 2026).

We found no independent confirmation either way, and no evidence of real customer data has been reported in the coverage we read. On the evidence available on 9 October 2026, this is a disputed claim about a test environment, not a confirmed breach of user data. We will update this section if that changes.

Privacy policy: what the company still keeps

A no-logs VPN still knows who its customers are. NordVPN says it keeps no logs of what you do while connected, and the no-logs engagements above test exactly that promise. What it cannot avoid holding is your account: a Nord Account is tied to an email address, and a card or PayPal payment leaves a billing record with the payment processor.

If that matters to you, NordVPN's support pages list cryptocurrency, prepaid cards and, in some countries, cash purchases at retail stores as payment options. That narrows what is linked to your name, but it does not make the account anonymous: you still sign in. If you want an account with no email at all, Mullvad uses a random account number instead, and our Mullvad review covers that model.

Security features to check after you install

NordVPN's tools are strong, but the protection you get depends on what you switch on and which build you run. Rather than trust any review's claim about defaults, which change between app versions, open Settings once after installing and confirm each item below.

Post-quantum encryption is the clearest example. NordVPN's support article lists seven platforms for it (Windows, macOS and Linux, plus Android, Android TV, iOS and tvOS), says it works only with NordLynx (not OpenVPN), and NordVPN describes it as something you enable yourself on each device. The old wording on many review sites, including an earlier version of this page, implied it was automatic. It is opt-in.

On a Mac, the build you install changes your kill switch. NordVPN ships two macOS apps, both needing macOS 14 Sonoma or later. The website ("direct download") build has the per-app App Kill Switch, full Real-time protection, full Meshnet and custom DNS. The App Store build swaps the per-app kill switch for "VPN bypass prevention", has limited Real-time protection and Meshnet, and no custom DNS. On Linux, NordVPN's kill switch keeps blocking traffic even after you disconnect manually, and the Linux client, the one part of NordVPN's software that is open source, is published on GitHub under GPL-3.0.

Price: what NordVPN costs after the first term

NordVPN's renewal price is the number to plan around. Its renewal page (my.nordaccount.com, last updated 10 June 2026) lists Basic at $139.08 a year and Complete at $219.48 a year in the US, before tax, and every 1- and 2-year plan renews into a 1-year term at those rates. Prime, the top plan for new US buyers, renews at $296.28 a year, and customers still on older plan names renew at their own rates, for example Plus at $179.88.

The introductory prices are the volatile part. NordVPN's US pricing page listed Basic at $3.49 a month on the 2-year plan ($94.23 for a 27-month first term), Complete at $4.49 a month ($121.23) and Prime at $7.49 a month ($202.23) as of 12 October 2026. Those figures differ by country and shift often, so read the total in your cart before paying. Long plans are billed upfront, and tax is added on top.

The pattern that matters: a Basic subscriber who pays about $94 for the first 27 months then pays $139.08 for each following year unless they cancel auto-renewal or switch plans. That jump is steeper than most rivals, as the chart shows.

Refunds and trials have fine print too. The 30-day money-back guarantee covers first purchases only; renewed periods are not refundable. App Store purchases must be refunded by Apple, and Google Play gives its own 48-hour window. NordVPN's support pages describe a 7-day free trial on selected 1- and 2-year plans in the US and 14 other countries, needing a card or PayPal and converting to a paid plan unless you cancel, plus a separate 3-day trial for first-time Android users through Google Play. There is no iOS trial.

How to avoid paying the renewal by accident: in Nord Account, open the Billing tab and select cancel next to auto-renewal; the status should read Off and you get a confirmation email. If you bought through Apple, Google or Amazon, cancel in that store instead. Cancelling auto-renewal is not a refund; it only stops the next charge, so there is no reason to wait until the last week of your term.

If you have weighed the renewal and still want it, you can check NordVPN's current price on its own site. That is an affiliate link: we earn a commission if you buy, and it has no effect on the score above.

Who should skip it

NordVPN is a strong default, not a universal one. Skip it if any of these describes you.

• You want to read the code. Only the Linux client is open source. Proton VPN publishes its apps on every platform.
• You want the lowest renewal. Surfshark Starter renews at $79 a year and CyberGhost's 2-year plan at $56.94 a year (US, before tax, read 9 Oct 2026).
• You want an account with no email. Mullvad issues a random account number and charges a flat €5 a month.
• You are buying for a big household. Surfshark and IPVanish allow unlimited devices; NordVPN stops at ten.

For price-first readers, our best value VPN guide runs the per-device arithmetic, and the Surfshark review covers the sister brand that undercuts NordVPN on renewal.

Devices, platforms and the ten-device limit

One NordVPN account covers ten devices at once, on any plan, per NordVPN's support article; older reviews that say six are out of date. Two limits sit inside that number: no more than five of your devices can share one server at the same time, and a router running NordVPN uses a single slot while protecting everything behind it. That router rule is the practical way past the cap for smart TVs and consoles.

Apps cover Windows, macOS (two builds, above), Linux with a GUI and CLI, iOS, Android, Android TV, Apple TV on tvOS 17 or later, and Fire TV devices including the newer Vega OS sticks through the Amazon Appstore. NordVPN does not run on Roku; its support pages point Roku owners to a router or a shared hotspot instead.

Gauge Score breakdown

The Gauge Score is computed, not typed in. Each provider gets five pillar scores out of 10 from published evidence, the pillars are weighted, and the weighted sum becomes a score out of 100. NordVPN's inputs are below; anyone can redo the arithmetic.

Privacy and trust (9.2) reflects six audits and a no-retention policy, held back by the slow 2019 disclosure. Security (9.4) is the highest security mark we give: NordLynx, an opt-in post-quantum mode, two kill-switch designs and NordWhisper for restrictive networks. Value (8.5) credits ten devices and frequent long-plan discounts against renewal prices among the highest in our set. Features (9.5) is the top mark on the board. Transparency (7.5) is the weak pillar: closed-source apps outside Linux, and an incident made public more than a year after it happened.

That totals 90, one point behind Proton VPN and ahead of Mullvad, Surfshark and the rest of the best VPN ranking.

Edge cases worth knowing

A few situations change the advice. If you travel to a country that restricts VPNs, the obfuscated servers now run on NordWhisper, NordVPN's own protocol for restrictive networks, rather than on OpenVPN; check local law before relying on any VPN there, and note that NordVPN's help centre describes its apps as fully blocked in China. If you need a fixed address for work logins, the dedicated IP add-on renews at $81.48 a year in the US on top of your plan, and it disables post-quantum mode on that connection. If you buy through the iPhone App Store, Apple, not NordVPN, handles your refund. And if you use Linux, note that NordVPN's Linux app dropped IPv6 support in version 4.0.0, citing WebRTC leak risk, so IPv6-only networks need care.

The verdict: is NordVPN worth it?

For most buyers, yes. NordVPN has the longest audit run in the category, a breach it disclosed late but contained, a 2026 leak claim that remains unproven, and the broadest feature set we score. Set it up properly: confirm the kill switch is on, enable post-quantum mode, pick the Mac build that matches your needs, and cancel auto-renewal on day one so the $139.08 Basic renewal is a decision rather than a surprise.

If open-source apps or a cheaper renewal matter more to you, compare it with Proton VPN and Surfshark on our best VPN 2026 ranking, or see the best VPN for privacy if your threat model is strict.