Is NordVPN worth it? Renewal price, audit and 2018 breach

What it costs to start, and what it costs to stay

Tom’s Guide’s NordVPN review, updated on 20 October 2026, lists three US plans in dollars. For Basic, which it describes as the VPN and nothing else, one month costs $14.99, one year $65.88 and two years $94.23, which the page works out as $3.49 a month over 27 months, paid upfront. Complete costs $19.99, $77.88 and $121.23, and Prime $29.99, $113.88 and $202.23. The first figure sets them beside the renewal prices. According to the page, Complete adds malware and ad-blocking software, a password manager, a data breach scanner and cloud storage, and Prime adds a dedicated IP address and an identity theft protection service. Text elsewhere on the page calls the middle plan Plus.

The renewal is where the page puts its warning. It lists a big price hike on renewal among its drawbacks and says prices “more than double” when a plan auto-renews. Its own table gives Basic at $139.08 for 12 months, or $11.59 a month, Complete at $219.48, or $18.29 a month, and Prime at $296.28, or $24.69 a month. Dividing Basic’s two monthly figures, 11.59 by 3.49, gives a little over three times, which is our arithmetic and not a figure from the page. Tom’s Guide suggests unticking the auto-renewal box at once, setting a reminder near the end of the term, and watching for an email with a special deal.

NordVPN’s own pricing page, which we read as a saved copy showing euros, gives Basic at €94.23 for the first 27 months and €139.08 a year on renewal. It gives Complete, labelled “Most popular”, at €107.73 and €219.48, and Ultimate Max at €215.73 and €338.28, with a 30-day money-back guarantee beside each plan and a note that VAT may apply. Basic’s figures match Tom’s Guide’s dollar figures digit for digit; Complete’s two-year price and the top plan’s figures do not, and the plan names differ. The pages we read do not say why.

Tom’s Guide adds that NordVPN applies local tax on top of the headline price, while other top VPNs generally include it, so that depending on where you live NordVPN could cost more than Proton VPN. Its comparison table lists the cheapest monthly price as $3.49 for NordVPN Basic, $2.49 for Surfshark Starter, $2.99 for Proton VPN and $1.79 for Private Internet Access. It scores NordVPN’s price 8 out of 10 and writes that NordVPN is “worth what you pay”, especially on the middle plan, with better choices for anyone pinching pennies. Tom’s Guide carries affiliate links. Our Surfshark page sets out that service’s renewal terms in the same way.

The refund covers the first purchase only

NordVPN’s page on cancelling and refunds says the 30-day money-back guarantee applies to auto-renewal subscriptions bought directly from NordVPN’s website, and only to the initial purchase. If the subscription has already renewed, the page says the renewed payment is not eligible unless local law requires it. A payment that qualifies shows a Refund button in the Nord Account dashboard; the page gives three reasons the button may be missing: the payment is more than 30 days old, a refund was already issued, or the payment is a renewal. Cancelling stops future charges but leaves access in place until the end of the billing period. NordVPN says refunds are normally processed within four hours and take up to 10 business days to reach the account, depending on the payment method.

Where you bought matters. The page says purchases through the Apple App Store, the Amazon Appstore or a retailer such as Best Buy or StackSocial are refunded by that seller, under its own policy, and that Google Play gives a 48-hour window, after which NordVPN’s support team is the contact. The second figure lists them.

Tom’s Guide covers the same ground from a reviewer’s side. It says there is a free trial of seven days on Android and iOS, usable on any device once activated, but that refunds for plans bought through app stores can be awkward, with Apple rather than NordVPN doing the refunding. It recommends paying on NordVPN’s website and using the 30-day guarantee to test the service. It also says some people online report difficulty cancelling, and that Tom’s Guide tried the refund and it worked. It adds that a live chat agent is a better route than email. The pages we read do not say how many customers use the guarantee.

What the no-logs audit says, and where NordVPN is based

NordVPN says it commissioned Deloitte Lithuania, which it calls a Big Four audit firm, for the sixth independent verification of its no-logs policy. The work ran from 10 November to 12 December 2025 under the ISAE 3000 (Revised) standard, and the report was issued on 12 December 2025. NordVPN says Deloitte’s practitioners interviewed employees and inspected server infrastructure, configurations and deployment processes, across standard, Double VPN, obfuscated and Onion Over VPN servers. Deloitte’s conclusion, as NordVPN reports it, is that the systems are designed and implemented in line with the no-logs statement. NordVPN calls the assessment point-in-time and says the full report is for users who log in to a Nord Account, in place of public excerpts. The vendor describes its own audit, and we did not read the report.

The dates differ from page to page. Tom’s Guide writes that Deloitte Lithuania carried out a fifth audit in December 2025 and a sixth in February 2026, and its list of recent developments gives the sixth as February 2026. Wikipedia gives a first audit by PricewaterhouseCoopers in November 2018, a second in 2020, and Deloitte audits in 2022, 2023 and 2024, which adds up to five before the December 2025 report. It also lists an application security audit by VerSprite in 2021. Tom’s Guide says NordVPN has had 12 other audits, covering its apps, API and web services, threat protection and browser extensions. We cannot tell from these pages which count is right.

On what is kept, Tom’s Guide writes that NordVPN is not truly zero-logs: it keeps a list of usernames, records connection timestamps to enforce its limit of 10 simultaneous connections, and stores the last time you used the service. The same page says this data cannot be used to link you to your activity, and that every server runs on RAM only, so that data is wiped on a reboot.

On where it is based, NordVPN’s support page says the service operates under the jurisdiction of Panama, that Panama has no mandatory data retention law, so it does not need to store logs, and that its parent company, Nord Security, is based in the Netherlands. Wikipedia describes a Lithuanian service incorporated in Panama, and Tom’s Guide lists Panama as the country of registration. Wikipedia adds that in 2022 NordVPN closed its servers in India after an order that VPN companies store customer data for five years.

The 2018 breach, in three accounts

NordVPN’s account gives a timeline. The affected server in Finland, rented from a data center, went online on 31 January 2018. Evidence of the breach first appeared on 3 May 2018 and pointed to about 5 March 2018. The data center deleted the unsecured management account on 20 March 2018, and NordVPN says it was notified on 13 April 2019 and destroyed the server that day. NordVPN says the intruder came in through a remote management account the data center had added without its knowledge, and that the server held no user activity logs. It says the TLS key the intruder took had already expired, could not decrypt NordVPN traffic, and could only serve a targeted man-in-the-middle attack on a single web user that would need extraordinary access to the victim’s device or network. It says it checked more than 5,000 servers before telling the public.

TechCrunch reported the breach on 21 October 2019. It wrote that an expired internal private key had been exposed, potentially allowing anyone to spin up servers imitating NordVPN. A NordVPN spokesperson told TechCrunch that the server held no activity logs, that no other server was affected, and that the news was held back until the company was sure the rest of its infrastructure was secure. An unnamed senior security researcher, who asked not to be named, called the findings “troubling” and said NordVPN was ignoring the larger issue of the attacker’s possible access. NordVPN replied that it treats VPN servers as untrusted within the rest of its infrastructure. TechCrunch also reported that similar records suggested TorGuard and VikingVPN may have been compromised around the same time.

Wikipedia writes that the attack gave root access, which was used to generate an HTTPS certificate suited to man-in-the-middle attacks, and that there was no evidence such an attack happened. It adds that security researchers and media outlets criticised NordVPN for not disclosing sooner, that audits and a bug bounty were announced on 29 October 2019 with the bounty launching in December, and that NordVPN began rolling out its own colocated servers in Finland in October 2020. It lists a separate incident from 1 November 2019, in which about 2,000 account logins were exposed through credential stuffing.

The third figure puts the three side by side. The public date is 21 October 2019 in TechCrunch and Wikipedia and 13 April 2019 is when NordVPN says it learned of it. That the data center deleted the accounts rather than tell NordVPN is NordVPN’s reading, which it frames as “evidence suggests”. The pages we read do not say whether anyone outside NordVPN checked its response.

Speed, streaming and features

Tom’s Guide tested from a Windows cloud PC on a 10 Gbps line in March 2026 and reports an average NordLynx speed of 1,249 Mbps between two East US points and 688 Mbps from the East US to the UK. In its table Proton VPN scores 1,475 and 1,548, Surfshark 1,021 and 935, and ExpressVPN 1,177 and 1,117, and the text says ExpressVPN, Proton VPN, Surfshark and Norton VPN were all faster on the UK route. On latency it gives NordVPN 48 ms locally and 57 ms to the UK; the text puts ExpressVPN at 103 ms, though its table lists 105. On home Wi-Fi measured at about 820 Mbps without a VPN it saw about 620 with NordVPN, and on a line that moved between 30 and 60 Mbps it saw a peak of 43. It scores speed 9 out of 10.

TechRadar, which carries an affiliate-commission notice, reported on 11 August 2026 on two tests. Artifact Security’s 2026 VPN Performance World Tour compared NordVPN, Surfshark, ExpressVPN, Proton VPN and Mullvad over 55 routes; TechRadar writes that NordVPN finished first with an overall score of 91 and the only Platinum award, with an average Windows download of 271.9 Mbps and a tunnel in 1.8 seconds on average. It adds that every provider passed every leak scenario. West Coast Labs detected 926 of 934 malware samples with NordVPN’s antivirus, 99.1 percent against a 95 percent threshold, which is a test of the antivirus and not of the VPN. TechRadar also quotes NordVPN’s chief technology officer. We did not read either lab’s own report. The two tests used different providers, routes and lines, so the figures do not sit on one scale.

On streaming, Tom’s Guide says NordVPN unblocked almost every Netflix library it tried and most Disney+ regions. In a September retest it struggled with Netflix Japan and Disney+ in Canada, and it unblocked every Amazon Prime Video region tried. Norton VPN unblocked every site, the page says.

On features, Tom’s Guide lists more than 8,000 servers in 167 countries, 10 simultaneous connections, and the NordLynx (WireGuard), NordWhisper and OpenVPN protocols. Wikipedia gives 8,000-plus servers covering 224 countries as of January 2026, a different country count that the pages do not explain. Tom’s Guide says the kill switch exists on Windows, Mac, iOS and Android but works only at application level on Mac, and that split tunneling is missing on Mac and iOS and port forwarding on every platform. It found that Double VPN cut download speed to about half. Our pages on the kill switch and on WireGuard and OpenVPN cover those terms.

What the pages leave for you to weigh

Tom’s Guide answers the question in its own words: it gives NordVPN a final rating of 89 out of 100 and calls it, as a package, the best VPN for most people available right now, while also listing the renewal price hike among its drawbacks. That is one affiliate-linked reviewer’s verdict; the pages do not turn it into a yes or a no for every reader, and neither does this one. They do give things to check on the day you buy: the price you pay now and the price on renewal, shown in the first figure; the date the 30-day window ends; where the plan was bought, which decides who refunds it; and the different accounts of the audit and of the 2018 breach.

Wikipedia records two further items. In 2022 Surfshark and Nord Security merged under one holding company, which is why our Surfshark page mentions NordVPN. And the UK Advertising Standards Authority advised NordVPN in 2019 not to repeat its public Wi-Fi claims, and ruled against it in 2023 over an ad about switching off malware; in 2019 it ruled that HTTPS already provides “a significant layer of security”. Our page on what a VPN is used for looks at public Wi-Fi and the limits of a VPN.

The pages come with different interests. NordVPN sells the service. Tom’s Guide and TechRadar both carry notices that they may earn a commission from links. Wikipedia has no such notice, and it depends on its own cited sources. We did not subscribe to NordVPN or run any test. We did not read other review sites, blogs or forum threads about NordVPN, or NordVPN’s own review page. The pages we read do not give the text of Deloitte’s report or say how many customers renew.