AmneziaVPN
Show audit detailsHide audit details
Third white-box penetration test of the apps, the custom VPN protocols and the infrastructure, arranged by the Open Technology Fund's Security Lab; testing ran in December 2024 and January 2025 and the report was published in November 2025. Six issues found, two critical (remote code execution through OpenVPN config import; config tampering through an exposed admin API), all fixed and confirmed on retest. It is a software security test, not a no-logs audit
Published November 3, 2026· Updated November 3, 2026· By Juan Martinez
In This Article
AmneziaVPN is built for one job: getting a connection through on networks where providers block VPNs. For that it uses AmneziaWG, a modified version of WireGuard that hides the telltale signs of VPN traffic. The open-source app also lets you set up a VPN on your own server. The independent firm 7ASecurity has tested the apps and protocols three times, but the data-retention policy has never been checked. In summer 2026 the service was blocked and attacked in Russia for about a month and a half.
This review covers the paid Amnezia Premium: 20 countries with one location each, up to 7 devices. There is also a free version, Amnezia Free, with speeds up to 8 Mbps; YouTube does not work through it.
No-Logs Audit
AmneziaVPN has no independent audit of its no-logs policy. The firm 7ASecurity ran three penetration tests in 2022, 2024 and 2025: of the apps and protocols and, in 2025, of the infrastructure too. They look for vulnerabilities, not for what the service stores about its users.
The first test, in 2022, found 11 vulnerabilities and 5 hardening recommendations. The second came out in December 2024 and covered the Android, iOS and desktop apps, AmneziaWG and XRay. The report on the third was published in November 2025. It lists six issues, two of them critical: remote code execution when importing an OpenVPN configuration, and tampering with VPN configurations through an exposed admin interface. All were fixed, and a retest confirmed it. The Open Technology Fund names its own Security Lab as the commissioner of the third test. The FAQ on the site says that “no critical vulnerabilities were found”, which does not match the report.
The privacy policy, in force since 13 October 2026, says that activity logs are not kept and traffic is not recorded. But connection IP addresses are processed and, for some locations, “may be retained”; no retention period is given. Buying Premium requires an email address. The company says its servers run on RAM only and write nothing to disk; this has not been independently confirmed.
Pricing
The subscription does not renew automatically: you pay once for the chosen term, and nothing is charged later. To keep using the service you have to buy a new term. Premium costs $30 for 6 months ($5 a month), $50 for a year (about $4.17 a month) and $80 for 2 years (about $3.33 a month). There is no monthly plan. Visa, Mastercard and JCB cards and cryptocurrency are accepted; the Russian version of the page also lists a ruble card of a Russian bank and SBP. The site warns that paying in crypto does not guarantee full anonymity.
The refund period is stated inconsistently on the site: 14 days on the pricing page and in the payment terms, 7 days in one of the FAQ answers.
Security & Protocols
Premium uses AmneziaWG 3.1 by default. The encryption is the same as WireGuard’s; what changes is how packets are disguised: headers, sizes, the order of the handshake and timing. For networks where that does not help, there is XRay VLESS Reality. Premium has no other protocols. The open-source client is on GitHub under the GPL v3 licence.
The app settings include a kill switch, split tunneling by app and by address, and a choice of your own DNS. There are official apps for Windows, macOS, Linux, Android and iOS.
Servers & Torrenting
You can connect to servers in 20 countries, with one location in each. The service does not publish the total number of servers. In Tom’s Guide’s test, the “US (East)” and “Canada” servers turned out to be in Amsterdam. The “Russia” and “Kazakhstan” servers are in those countries, and the company confirmed this to the journalist.
Torrenting is allowed only when connected to the Swiss server.
In the same test, speed on a UK server was 251 Mbps against 276 Mbps without a VPN, 169 Mbps on a US server and 156 Mbps on a Kazakhstan server. The company says its servers are rated for 200 Mbps. BBC iPlayer detected the VPN even on a UK server, and the service failed a tricky YouTube test. The tester did not run a full streaming test.
Jurisdiction
The privacy policy names the Romanian company ANARCHY LAB S.R.L. as responsible for the data, while payments are taken by the Cypriot EUPHORIATECH LIMITED. ANARCHY LAB promises to comply only with requests from authorities that are consistent with the laws of Romania and the European Union. Neither Romania nor Cyprus is in the Fourteen Eyes (a group of countries that share intelligence).
Does It Work in Russia
According to the company, Premium currently works in Russia for most users. Between May and July 2026 it repeatedly stopped connecting for long stretches.
Blocking of Amnezia’s servers began on 20 May 2026, followed by DDoS attacks on the website and the payment gateway. According to Meduza, in early June the service barely worked for several days, for both Free and Premium users. The developers blamed Roskomnadzor for the attack, but neither the agency nor independent sources have confirmed this. New waves of blocking came on 7 July, after the app update of 10 July, and on 25 July. The company says the active phase lasted about a month and a half. In early August, according to IStories, Roskomnadzor blocked more than 20 VPN services, and Amnezia said Premium was not affected.
The company admits that new servers set up to replace blocked ones were found and blocked within hours. After a hasty app update, VLESS stopped working on some platforms. On some servers AmneziaWG and VLESS used the same IP address, so switching protocols did not help. The company restricted access for old versions of the app.
According to the company’s latest report, Premium works for most users if the app is version 5.0.1.5 or newer. When it fails, the advice is to switch between AmneziaWG and VLESS. If mobile internet runs in “whitelist” mode, where only approved sites are open, the company admits that even disguised VPN traffic may not get through. For that case Premium has a location in Greenland, but there are no guarantees. There is no independent data on how the service works now. Which other VPNs work in Russia is covered in the guide to VPNs for Russia.
Russians who have left the country will find the “Russia” location useful: through it, Russian sites and services, such as government portals and banks, open from abroad. The company explains these servers by demand from such users. The servers are physically in Russia, and the Tom’s Guide tester noted that the country has strict data laws. The company replies that the servers run on RAM and store nothing.
Pros and Cons
- Three independent security tests of the apps and protocols, with the vulnerabilities found fixed
- Open-source client under GPL v3, and you can set up your own server
- Its own AmneziaWG protocol and a XRay VLESS Reality fallback for networks that block VPNs
- The subscription does not renew automatically: you pay once for the chosen term
- Up to 7 devices, payment by card or cryptocurrency
- The data-retention policy has not been independently checked, and it does not state how long IP addresses are kept
- In summer 2026 the service was disrupted in Russia for about a month and a half
- One location in each country
- Torrenting is allowed only when connected to the Swiss server
- BBC iPlayer detected the VPN even on a UK server
- The refund period is stated inconsistently on the site (7 and 14 days)
Our Rating
- No-Logs Audit & Trust5.5/10
The company says it keeps no activity logs, but nobody has checked this independently: the three tests looked for vulnerabilities, not at what the service stores. How long connection IP addresses are kept is not stated
- Security Features7.5/10
Kill switch, split tunneling and open-source code, plus its own protocol and a fallback for networks that block VPNs. The 2025 test found two critical vulnerabilities, which were fixed
- Speed & Reliability5.5/10
In a test, speed on a UK server was almost the same as without a VPN, but the servers are rated for 200 Mbps. In summer 2026 the service was disrupted in Russia for about a month and a half
- Price & Value8.0/10
From $3.33 a month when paying for 2 years. You pay once for the chosen term. There is no monthly plan
- Support & Usability6.5/10
The app is simple and one subscription covers 7 devices. But there is one location per country, and the refund period is stated as both 7 and 14 days on the site. On Trustpilot the service has 3.7 from 16 reviews
No-Logs 30% · Security 20% · Speed 20% · Price 15% · Support 15%