Skip to content
LunoVPN
Honest assessment

We might tell you not to buy a VPN.

Every VPN site insists you need one. This one doesn’t. Answer five questions and we’ll work out what genuinely protects you — which might be Tor, might be a competitor, might be a browser setting, and might be nothing at all. Selling the wrong tool to someone who is actually at risk is not a sale we want.

Takes about a minute Nothing is recorded Competitors included
// your profile so far
Concern
awaiting answer
Adversary
awaiting answer
Consequence
awaiting answer
Identity to provider
awaiting answer
Priority
awaiting answer
risk level—

This assessment runs entirely in your browser. Nothing you click is transmitted, stored or associated with anything — there is no analytics call behind it and no result saved anywhere. It is guidance from people who build one of these tools, not professional security consultancy; if your safety genuinely depends on getting this right, talk to a specialist organisation in your field.

The idea

What a threat model actually is

Security advice usually arrives as a list of products. That is backwards. Before any tool makes sense you need to answer four unglamorous questions, and they take about a minute to think through honestly.

What are you protecting? Not “my privacy” in the abstract, but the specific thing: which sites you visit, where you physically are, who you are talking to, what you bought. Who would want it? An advertiser, an employer, a person in your household and a government are four completely different opponents with different budgets and different powers. What happens if they get it? Mild embarrassment and imprisonment are not the same risk and do not deserve the same response. How much inconvenience can you actually sustain? A perfect setup you abandon after a fortnight protects you less than a modest one you keep using for years.

The right tool is the one that matches your answers. Everything else is shopping.

This matters commercially too, which is why almost nobody in our industry says it. A VPN is genuinely useful against a network operator, an ISP, or a website that would otherwise log your home address. It is close to useless against an adversary who already has access to your device, and it is the wrong tool entirely when being identified could put you in physical danger. Those are not caveats hidden in a footnote; they are the difference between a product working and a person getting hurt.

The limits

What a VPN will not do for you

We would rather you knew this before subscribing than discovered it afterwards. A VPN moves and encrypts your connection. Here is everything that stays exactly where it was.

Accounts you log into

Signing into a service identifies you to it completely, whatever your IP address says.

Browser fingerprinting

Your fonts, screen, timezone and extensions form a recognisable signature that survives an IP change.

Malware and phishing

An encrypted tunnel carries hostile files just as faithfully as good ones.

A compromised device

If something is already reading your screen or keystrokes, the tunnel is irrelevant.

What you publish yourself

Photos, posts and metadata identify people far more reliably than IP addresses ever did.

Payments that carry your name

A card ties a purchase to a person no matter how private the connection was.

None of this makes a VPN pointless — it makes it a layer. Layers work together: a VPN for the network, a browser configured sensibly for tracking, a password manager for accounts, device encryption for physical loss, and private payment so the purchase itself doesn’t undo the rest.

Marketing vs reality

Five things the ads get wrong

Our own industry is responsible for most of the confusion here. These are the claims we would like to see retired.

“A VPN makes me anonymous online”

It changes your IP address and encrypts the first leg of your traffic. Every account you log into still knows exactly who you are, and your browser still carries a recognisable fingerprint. Anonymity is a discipline, not a subscription.

“I need a VPN or public Wi-Fi will steal my banking details”

This was true in roughly 2012. Almost all traffic today is encrypted with HTTPS, so a café network cannot read your banking session. A VPN still hides which sites you visit from the network operator, which is a real benefit — just not the emergency the ads imply.

“Incognito mode is basically the same thing”

Private browsing only clears local history and cookies when you close the window. Your ISP, your network and the sites you visit see exactly what they always did. It hides your browsing from the other people using your computer, and from nobody else.

“If I have nothing to hide, none of this matters”

Privacy is about consent, not concealment. You lock the bathroom door without any wrongdoing to conceal. The information you shed is valuable precisely because it is ordinary: where you go, what you buy, who you talk to and when.

“Any no-logs VPN is as good as another”

‘No logs’ is a marketing phrase until somebody independent has checked it. What matters is whether the claim has been audited, whether the audit was published in full, and whether the company collects an identity at signup that makes logs unnecessary anyway.

FAQ

Threat model questions

What is a threat model?
A threat model is a plain answer to four questions: what are you protecting, who might want it, what happens if they get it, and how much effort you can realistically sustain. Security advice only makes sense once those are answered — which is why the same tool can be essential for one person and pointless for another.
Does a VPN make me anonymous?
No, and anyone telling you otherwise is selling badly. A VPN replaces your IP address and encrypts traffic between you and the VPN server. It does not hide who you are from sites you log into, it does not stop browser fingerprinting or cookies, and it does not protect a device that is already compromised. It is one useful layer, not a cloak.
Why would a VPN company tell me not to buy a VPN?
Because selling the wrong tool to someone in real danger isn’t a sale, it’s a liability with a receipt. If your situation calls for Tor, or for browser hygiene, or for nothing at all, we would rather say so and keep our credibility than take your money for something that won’t help.
When is Tor the better choice?
When being identified could cost you your freedom or your safety, and when you are willing to accept slower browsing in exchange. Tor distributes trust across several relays run by different operators, so no single party sees both who you are and what you are doing. A commercial VPN, however good its policies, is still one company you have to trust.
Can I use a VPN and Tor together?
Yes, and connecting to Tor through a VPN is a common arrangement: your ISP sees a VPN connection rather than Tor use, while Tor still provides the anonymity. It is not a magic upgrade, though — for genuinely high-risk work, the Tor Project’s own guidance should outrank ours.
Is a free VPN good enough for my threat model?
It depends entirely on who is paying for the servers. Running a VPN costs real money, so if you are not paying, the business model is usually advertising, data, or an upsell. Proton VPN is the notable exception with a genuinely usable free tier funded by paid subscriptions. Most other free VPNs are worse for your privacy than no VPN at all.
How often should I revisit my threat model?
Whenever your circumstances change — a new job, a move, a new country, a change in who has access to your home or devices. Threat models go stale quietly, and most people are still protecting themselves against last year’s situation.

If we’re the right fit, we’d love to have you.

And if we’re not, we hope you found the thing that is. Either way you know more than you did five minutes ago.

Get LunoVPN Read our audit
© 2025 LunoVPN — We don’t know who you are, and that’s by design.