Best VPN for Vietnam 2026: Four Laws in Nine Weeks
Proton sign-ups from Vietnam jumped 450% when new crypto and ISP-logging rules took effect. VPN use is legal; a new law fines showing others how to bypass blocks.
Published September 10, 2026· By Juan Martinez
On 1 September 2026, the day new rules on crypto trading and internet-provider data logging took effect, Proton VPN says daily sign-ups from Vietnam ran 450% above their normal level — the third such jump since July. Vietnam isn’t blocking VPNs the way China does; it’s stacking laws. Four instruments in nine weeks — one of them the framework Cybersecurity Law, three of them decrees that put a fine on an ordinary online action: a Facebook comment, a crypto trade, explaining how to reach a blocked site. So the best VPN for Vietnam isn’t about defeating a firewall. It’s about what your provider keeps now that your ISP is required to keep a record of you.
Using a VPN in Vietnam is legal — teaching people to bypass blocks is not
There is no law against using a VPN in Vietnam, and enforcement against individual users, especially foreign travellers, is essentially non-existent. What changed in August 2026 is narrower and stranger: Decree 330/2026 now fines individuals VND 10–20 million (roughly $380–$765) for instructing or sharing methods to reach websites or apps whose access has been restricted “in accordance with law.” Using the tool is fine; publishing a how-to is an administrative offence. And because no government agency publishes a list of which sites are blocked, or the orders behind them, there is no way to know in advance which “how-to” crosses the line.
What the government blocks is destinations. Several major VPN company websites — ExpressVPN’s and NordVPN’s among them — are unreachable from inside Vietnam, so signing up or downloading the app is best done before you arrive. Once the app is installed, a standard connection works. That’s a blocked webpage, not a detected tunnel.
The blocking method, and the machine being built next to it
Vietnam filters at the internet-provider level. The most detailed public measurement study, by OONI in 2022 across ten ISPs, found 1,108 inaccessible websites and concluded that blocking is done “primarily through DNS and http requests which serve block pages” — political criticism, foreign news outlets like the BBC and RFA, human rights sites, pornography. No equivalently detailed study has been published since, so that 2022 finding is the current baseline, with the caveat that it predates everything below. In May 2025, ISPs were ordered to block Telegram after the Ministry of Public Security said most Vietnamese channels on it carried criminal or “anti-state” content; OONI’s measurements track that block from late May 2025.
The new element is a national firewall. The Law on Cybersecurity that took effect on 1 July 2026 is the first Vietnamese statute to mention “a national firewall system” at all, directing authorities to study its development. The Ministry of Public Security then circulated a draft technical standard describing what that system would do: deep packet inspection, SSL/TLS inspection that decrypts encrypted traffic before re-encrypting it, and web-filter blacklists of at least 100,000 domains. A separate draft would require ISPs to keep records linking IP addresses to subscriber identities for a minimum of twelve months and pipe that data directly to the ministry. None of this is deployed. But it is the direction of travel, and it is why an obfuscation option is worth having even though today’s blocking doesn’t require one.
The part that shapes the picks: your ISP is now the logger
The Law on Cybersecurity requires providers operating in Vietnam to store users’ personal information and activity data — account names, session times, payment details, IP addresses — inside the country, to verify account identities, and to hand user information to the Ministry of Public Security’s cybersecurity forces within 24 hours of a request, or 3 hours in an urgent national-security case. Decree 147, from late 2024, already requires platforms to confirm user identities with official documents or a local mobile number.
Then came the fines. Decree 174/2026, effective 1 July 2026, sets penalties of VND 20–50 million (about $785–$1,960) on individuals for social media posts authorities judge false, defamatory, or “causing public panic.” The first fine landed on 7 July: a man in Lào Cai province, identified as P.V.S., was fined 12.5 million đồng for a single crude comment about local police. Decree 284/2026, effective 1 September, adds VND 30–50 million fines for trading crypto through platforms not licensed by the Ministry of Finance. Proton VPN’s General Manager, David Peterson, told TechRadar the September spike wasn’t traceable to any single rule: “A flurry of laws and fines — from social media penalties to crypto crackdowns and ISP logging requirements — have compounded one another.”
For a VPN user, the shift is concrete: the record of what you connected to now lives with your ISP by legal mandate. The question worth optimising for is how little your VPN provider adds to that — a public audit history, and a home jurisdiction with no data-retention law of its own.
Best VPNs for Vietnam
| VPN | Rating | From | Protocols | Devices |
|---|---|---|---|---|
| Proton VPN | 8.8 | $2.99/mo | WireGuard, OpenVPN, IKEv2, Stealth | 10 |
| Mullvad | 8.4 | $5.72/mo | WireGuard, OpenVPN | 5 |
| ExpressVPN | 8.2 | $2.49/mo | Lightway, WireGuard, OpenVPN | 14 |
| NordVPN | 8.3 | $3.49/mo | NordLynx (WireGuard), OpenVPN, NordWhisper | 10 |
| Surfshark | 7.9 | $1.99/mo | WireGuard, OpenVPN, IKEv2, Dausos (macOS only) | Unlimited |
Because Vietnam’s current block clears with almost any solid VPN, the ordering here follows what matters once your ISP is logging you: how little the provider retains, how well its no-logs claim has been tested, where it’s based, and — as a tie-breaker for the firewall that’s being drafted — whether it has a working obfuscation mode. The “From” figure in the table is each provider’s cheapest intro rate on a multi-year plan; the renewal price is what counts over time, and it’s in each section below.
Proton VPN
the one that keeps least, and the one that flagged the spike
From $2.99/mo
The pick for the ISP-logging question. Proton VPN has completed five consecutive annual no-logs audits by Securitum, and every report is a direct public download — no account, no login. Its apps are 100% open source, so the client code is independently inspectable rather than taken on trust. It’s based in Switzerland, outside the Five/Nine/Fourteen Eyes arrangements and with no data-retention law behind it. Its Stealth protocol wraps traffic in obfuscated TLS, which today’s DNS-based blocking doesn’t require but the drafted national firewall might. There’s a genuine free tier (one device, no time limit), and paid plans renew at around ~$6.99/mo, one of the lower steady-state rates on this site. It carries the highest overall rating here — and it’s Proton’s own Observatory data that recorded the 450% signup jump. Read the full Proton VPN review for the details.
Best for: anyone whose real concern is what a provider would add to the log their ISP is now legally required to keep.
Mullvad is the option that has actually been tested against a data seizure. In April 2023, Swedish police arrived at its Gothenburg office with a search warrant seeking customer data — and left with nothing, because none existed. Accounts are a 16-digit number generated on your device, with no email required; you can pay in cash by mail or in Monero. Pricing is a flat ~$5.72/mo regardless of term, with no renewal jump. The trade-offs are real, and one matters specifically here: there is no obfuscation protocol, so if Vietnam’s drafted firewall starts inspecting protocols, Mullvad is the first of these five to stop connecting. Streaming unblock is also unreliable, and support is email-only. Read the full Mullvad review for the rest.
Best for: people who want the least possible information tied to their identity in the first place.
ExpressVPN has published more independent audits than anyone else on this site — 23-plus since 2009 — with repeated KPMG engagements verifying that its RAM-only TrustedServer architecture doesn’t retain logs. It’s incorporated in the British Virgin Islands, with no data-retention law, allows 14 devices per account, and its Lightway protocol runs with obfuscation on by default — the strongest fallback of the five if the drafted firewall’s traffic inspection is switched on. The full audit report isn’t a completely open download — you have to accept KPMG’s terms to read it. ExpressVPN’s website is one of those blocked from inside Vietnam, so install it before you travel. Pricing is the trade-off: it renews at around ~$8.33/mo, above the budget options. Read the full ExpressVPN review.
Best for: people who want the longest audit track record and obfuscation that’s always on, not a setting to find.
NordVPN is a solid all-rounder: six independent no-logs assurance engagements (Deloitte since 2022), Panama jurisdiction with no retention law, and reliable streaming access across Netflix, BBC iPlayer, Disney+, and Hulu — useful if reaching your home-country library is part of why you’re getting a VPN. It has obfuscated servers for networks that block VPN traffic, though you enable them manually rather than getting them by default. The caveat, same as everywhere on this site: Nord publishes only a summary of its audit, not the full technical report, which requires logging into a Nord Account. Renewal is around ~$11.59/mo, the steepest jump of the five here. Read the full NordVPN review.
Best for: people who want a well-known all-rounder with reliable streaming alongside the privacy record.
Surfshark covers an unlimited number of devices on a single plan, which makes it the practical choice for a family or a shared household rather than one person. It’s been audited by Cure53 and Deloitte and is based in the Netherlands with no stated data-retention obligation. Two things to weigh: the Netherlands is a Nine Eyes member, and Surfshark doesn’t show its renewal price on its own pricing page — third-party trackers put it at $79/year (about ~$6.58/mo), which is competitive, but you have to go looking for it. Read the full Surfshark review.
Best for: households that need to cover a lot of devices on one cheap plan.
Practical notes
- Install before you arrive. ExpressVPN’s and NordVPN’s websites are among those blocked from inside Vietnam. Download the app and sign in while you have clear access — ideally before you travel.
- You don’t need an obfuscation mode today — but it’s worth having as a fallback. Standard WireGuard clears Vietnam’s current DNS-based filtering. Obfuscation and “stealth” protocols are built for countries that detect the tunnel itself — like China, where this site recommends Astrill for exactly that reason. Vietnam isn’t one of those today, but the drafted national firewall would change that. Proton’s Stealth, ExpressVPN’s Lightway (obfuscated by default), and NordVPN’s obfuscated servers all cover that case; Mullvad doesn’t.
- A VPN doesn’t cover ID-based sign-ups. It hides which sites you reach and from where. It does not remove the legal requirement to provide identification when registering a local social media or crypto-trading account.