Software you pay for
should still be getting fixed
A VPN subscription is a promise that someone is still working on the software. That promise quietly expires more often than anyone admits, and the billing never does.
Abandoned does not look abandoned
When a VPN stops being maintained, nothing visibly changes. The website stays up. The marketing copy still says military-grade encryption and no-logs policy. Support still replies. The app still connects. The card still gets charged every month.
What stopped is the part you cannot see: someone being paid to fix it. Today, 4 of the 28 providers on this site have not shipped an update on any platform in six months, and all of them are still selling subscriptions.
Why updates are the thing to watch
A VPN client is not an ordinary app. It installs network drivers, edits routing tables, and on most systems runs with administrator or root privileges. It is the software your entire connection passes through. A flaw in it is not a cosmetic bug.
It also cannot stand still, because everything around it moves:
- The crypto underneath it gets vulnerabilities. Clients bundle OpenSSL, WireGuard and OpenVPN. When those get patched, someone has to ship the patched version to you. An unmaintained client keeps shipping the old one indefinitely.
- Operating systems change. Apple reworks network extensions, Android raises API requirements, Windows changes driver signing. Software nobody is updating degrades, then breaks — sometimes by silently failing to protect you rather than by failing to connect.
- Releases cost money. Shipping a build means engineers, code signing, store review, QA. It is the most visible sign that a budget still exists. When the releases stop, the budget usually stopped first.
The honest version of the argument
It would be convenient to claim that more updates mean fewer vulnerabilities. That is not quite right, and this site is not worth much if it overstates its own case.
The signal is asymmetric. Silence is strong evidence: software nobody has touched in two years is accumulating unpatched flaws, and there is no innocent version of that. Frequent releases are much weaker evidence in the other direction — a vendor can ship every week and still keep logs, run a thin server network, or be dishonest about ownership.
Use this site to rule providers out, not to pick a winner.
Mullvad is the example that keeps us honest. They release deliberately and unhurriedly, which costs them points here, and they remain one of the most respected providers in the industry. A ranking that called them bad would be a broken ranking.
The part nobody shows you
Providers ship six or seven different apps, and they do not abandon them all at once. The phone app — the one most people judge them by, and the one app stores make hardest to neglect — keeps getting routine updates, while the desktop client and the browser extension quietly rot.
Right now 10 providers have at least one platform more than six months behind their freshest one. Judged on their newest release they look active. These are their oldest:
| Provider | Looks like | Actually, their oldest platform |
|---|---|---|
| TunnelBear | updated 3 days ago | Firefox — over 3 years ago |
| TorGuard | updated 7 months ago | Firefox — over 2 years ago |
| PureVPN | updated 16 days ago | Firefox — over 2 years ago |
| PrivateVPN | updated 26 days ago | macOS — over 2 years ago |
| FastestVPN | updated 46 days ago | Firefox — over a year ago |
| VyprVPN | updated 4 months ago | Windows — over a year ago |
| IPVanish | updated 24 days ago | Firefox — over a year ago |
| CyberGhost | updated 4 days ago | Firefox — over a year ago |
7 individual apps across the whole index have gone more than two years without a release. Every one is still listed as a supported platform by the provider selling it.
Does any of this show up in the market?
Partly. Abandonment and obscurity travel together — the providers nobody maintains are largely the providers nobody searches for. But the causation runs in every direction at once, and big companies both ship more and get searched for more simply because they are big.
Maintenance and attention, plotted against each other
Every brand with enough search volume to measure. Horizontal is the maintenance index; vertical is average search interest. The two move together closely — Spearman ρ = 0.82 across 15 brands.
Related is not the same as caused. Big companies both ship more software and get searched for more, so size explains part of this on its own. The useful part of the chart is not the trend — it is anything sitting far off it.
What we actually do
Every day at 5 PM Pacific we check every app each provider ships — phone, desktop, browser — against public app stores and package registries, and record what we find. Nothing here is an opinion, a review, or a sponsored placement. It is a release log, made legible.
The formula is published, the data is downloadable, and every figure links back to the source it came from, so you can check any single number yourself rather than taking ours for it. Some outbound links earn us a commission; the ranking code cannot read which ones, and the methodology page explains exactly how that is kept separate.
Start with the index, or go straight to the graveyard to see who has stopped shipping.