ZoogVPN review

Updated 21 September 2026 · Based on vendor documentation and protocol specifications · Read our methodology

Quick verdict

ZoogVPN publishes six protocols, which is more than most consumer services expose and — importantly — they address genuinely different network conditions rather than being variations on one idea. Among the five providers reviewed on this site, that is the widest published range. Its documentation is clear on protocols and kill-switch availability, thinner on leak protection beyond DNS, and we could not locate a published third-party audit.

Documented facts

Protocols: 6 (incl. Shadow, ZoogTLS)
Kill switch: Windows, macOS, Android, iOS
Split tunneling: Not stated in reviewed docs
Simultaneous devices: Unlimited
Refund window: 30-day guarantee
Independent audit: None located

$2.49/month+ 3 months free

2-year plans

Get ZoogVPN Deal30-day guarantee · Unlimited devices

Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing as published on VPN Sherlock; confirm current terms at checkout.

How to read this review

Everything below comes from ZoogVPN's own published documentation, retrieved 21 September 2026, or from public protocol specifications, except where a section is explicitly marked as resting on our review-pass captures. We did not run a controlled lab benchmark: where we cite a screenshot or recording it supports the visible state at the moment of capture and nothing broader, and we publish no speed figures or scores. Where only the vendor supports a statement, we say so.

Protocol support in detail

Protocol breadth is ZoogVPN's strongest technical argument. Many consumer services ship WireGuard plus OpenVPN and stop there, which leaves you without an answer when a network drops UDP or actively fingerprints VPN handshakes. ZoogVPN's published line-up covers four distinct situations: a fast default, a mobility protocol, a firewall-tolerant fallback and two obfuscated transports.

ZoogVPN's published protocol matrix, retrieved from its help centre on 21 September 2026. Availability is stated by the vendor.

Protocol	Platforms (per ZoogVPN)	ZoogVPN's stated use case
WireGuard	Windows, macOS, iOS, Android, Linux, routers	Speed and modern use cases such as streaming and gaming
IKEv2/IPsec	Windows, macOS, iOS, Android, Linux	Mobile users and keeping a connection alive while switching networks
OpenVPN (UDP)	Windows, macOS, iOS, Android, Linux, routers	Balanced speed and security; torrenting and streaming
OpenVPN (TCP)	Windows, macOS, iOS, Android, Linux, routers	Stable connections in firewalled environments
Shadow	Windows, macOS, iOS, Android	Bypassing censorship in highly restricted regions
ZoogTLS	Windows only	Accessing restricted content in heavily filtered networks such as Iran

According to ZoogVPN

ZoogVPN rates WireGuard best for speed and modern uses such as streaming and gaming; IKEv2/IPsec as excellent for mobile users maintaining a connection while switching networks; OpenVPN UDP as a balanced option for torrenting and streaming; OpenVPN TCP as reliable in firewalled environments; Shadow as designed for bypassing censorship in highly restricted regions; and ZoogTLS as a Windows-only option for heavily filtered networks.

WireGuard

WireGuard is the sensible default on any network that allows UDP. Its reference implementation is around four thousand lines, it uses a single fixed cipher suite rather than negotiating one, and its handshake completes in a single round trip. The practical effects are fast reconnection after sleep and lower CPU cost per packet, which on phones tends to show up as better battery life. ZoogVPN lists it on every platform including routers. One design point worth knowing: WireGuard keeps the most recent endpoint address for each peer in memory, so commercial providers must add their own address-management layer. ZoogVPN's documentation does not describe how it handles that, and we could not verify it.

IKEv2/IPsec

This is the one to choose on a phone that moves between Wi-Fi and cellular. The MOBIKE extension lets either end change IP address while keeping the same security association, so the tunnel updates its endpoint instead of tearing down and rebuilding. If you run a kill switch, that difference is the difference between a brief stall and your traffic being cut. ZoogVPN lists it on Windows, macOS, iOS, Android and Linux — but not routers.

OpenVPN UDP and TCP

Having both transports available from the same provider matters more than it sounds. UDP is the faster choice; TCP on port 443 is often the only thing that works on hotel, campus and corporate networks, because it is hard to distinguish from ordinary HTTPS. The cost is the TCP-over-TCP problem, where the tunnel's retransmission timer fights the application's and throughput can collapse on a lossy link. ZoogVPN lists both on all platforms including routers, so switching is a setting rather than a migration.

Shadow and ZoogTLS

These are ZoogVPN's two in-house transports, aimed at networks that identify and drop VPN traffic rather than merely blocking ports. They differ in how much can be checked. Shadow has no public specification: no RFC, no independent implementation, nothing to review beyond the vendor's description. ZoogVPN describes ZoogTLS as based on OpenConnect with TLS encryption, and OpenConnect is open source and publicly documented - but what ZoogVPN has built on top of it is not published. Neither has been independently assessed for resistance to detection.

How a ZoogVPN connection is put together

How a ZoogVPN connection works

Encryption protects the path to the VPN server; the server then forwards traffic to its destination.

Your device
Original IP and traffic
ENCRYPTED
ZoogVPN server
Tunnel endpoint and IP exit
FORWARDED
Internet
Sites see the server IP

Important

A VPN protects network traffic in transit; it does not replace device security, strong passwords or account protection.

The same tunnel model described in how a VPN works, with ZoogVPN as the endpoint.

Encryption and authentication

Cipher choice follows from protocol choice rather than being configured separately. On WireGuard the suite is fixed: ChaCha20-Poly1305 for the data channel, Curve25519 for key agreement and BLAKE2s for hashing. On OpenVPN and IKEv2 the data channel is normally an AEAD construction such as AES-GCM, negotiated during the handshake. Both AES-256-GCM and ChaCha20-Poly1305 are unbroken; ChaCha20 tends to be faster on processors without AES hardware acceleration, which covers many older phones.

On "military-grade" language

AES-256 is a public NIST standard available to anyone, so the phrase carries no technical meaning. We mention it because it is common across this sector, including in vendor marketing. What actually matters is that sessions use ephemeral keys and therefore have forward secrecy — if a server's long-term key were later compromised, recorded past sessions would still not be decryptable. See VPN encryption.

Kill switch

According to ZoogVPN

ZoogVPN describes its kill switch as preventing a device from accessing the unprotected internet, stating that if the connection unexpectedly fails it "will block internet access for an affected device until the connection to the VPN node is restored". It is listed on Android, iOS, Windows and macOS, enabled with a toggle in the app settings.

Kill-switch availability as published by ZoogVPN, with the gaps in that documentation stated explicitly.

Platform	Listed by ZoogVPN	What the docs do not say
Windows	Yes	Whether it is enforced at the firewall layer
macOS	Yes	Behaviour across sleep and wake
Android	Yes	Whether it uses the OS-level Always-on VPN control, which is more reliable than an in-app toggle
iOS	Yes	How it interacts with system traffic the OS reserves
Linux	Not listed	—
Routers	Not listed	Router firmware rarely provides one

The documentation does not state whether the kill switch is enabled by default, nor how it behaves during a server change or after sleep. Those are exactly the cases where kill switches fail in practice, so they are worth checking yourself — the procedure is in VPN kill switch.

Kill switch: fail closed, not exposed

A kill switch is designed to stop unprotected traffic when the VPN tunnel drops.

Tunnel connected
Traffic follows the protected VPN route.
PROTECTED PATH ACTIVE
Tunnel drops
The app detects a failed or interrupted connection.
CONNECTION EVENT
Traffic blocked
Internet access stays blocked until protection returns.
FAIL-CLOSED STATE

Test it

Record OS, app version, protocol, traffic type, drop method, observed IP/DNS behaviour and recovery time.

What a firewall-level kill switch should do when the tunnel fails.

DNS and leak protection

According to ZoogVPN

ZoogVPN states: "When you are using ZoogVPN apps, we protect you from DNS leaks. Our applications are configured in a way that makes it impossible for ISP to send DNS queries," and that domains are resolved using other DNS servers.

What that statement does not cover

ZoogVPN's leak-protection page addresses DNS but does not specifically mention IPv6 leaks or WebRTC leaks. Those are separate failure modes with separate causes: an IPv4-only tunnel can let IPv6 traffic escape, and WebRTC exposes addresses from inside the browser before traffic reaches the network stack. No VPN client can fully close the WebRTC case on its own — any provider implying otherwise is overstating what is possible. Verify both yourself using this procedure.

DNS leak protection: what changes

The page request may be encrypted while the DNS lookup still reveals the destination domain.

Without DNS leak protection
DEVICEDNS query outside tunnelISP DNSsees domain
Exposure
The resolver can associate queried domains with the user's network connection.
A VPN icon alone does not prove DNS privacy.
With VPN DNS protection
DEVICEQuery follows protected routeVPN DNSinside route
Expected result
The ISP resolver is not used for the lookup, subject to correct app and OS configuration.
Verify with repeatable IPv4, IPv6 and WebRTC tests.

ZoogVPN documents DNS leak protection in its apps; VPN Sherlock should publish observed test conditions before claiming test results.

DNS handled correctly, versus the leak it is meant to prevent.

Split tunneling and platform coverage

ZoogVPN's documentation did not state split tunneling support in the pages we reviewed, but a capture from our review pass shows it working on Windows: Edge was routed through a Polish server while Chrome kept the direct connection, and the two browsers reported different public addresses at the same time. We did not capture the behaviour on macOS, Linux, iOS or Android, so those platforms remain unconfirmed. If routing specific applications outside the tunnel is the reason you are buying, confirm your platform with the vendor before subscribing.

Platform coverage derived from ZoogVPN's published protocol matrix. Windows is the only platform listing all six.

Platform	Protocols listed by ZoogVPN
Windows	WireGuard, IKEv2/IPsec, OpenVPN UDP, OpenVPN TCP, Shadow, ZoogTLS
macOS	WireGuard, IKEv2/IPsec, OpenVPN UDP, OpenVPN TCP, Shadow
iOS	WireGuard, IKEv2/IPsec, OpenVPN UDP, OpenVPN TCP, Shadow
Android	WireGuard, IKEv2/IPsec, OpenVPN UDP, OpenVPN TCP, Shadow
Linux	WireGuard, IKEv2/IPsec, OpenVPN UDP, OpenVPN TCP
Routers	WireGuard, OpenVPN UDP, OpenVPN TCP

Strengths and limitations

Strengths

Six published protocols — the widest range among the five providers reviewed here — covering speed, mobility, firewall tolerance and obfuscation.
Both OpenVPN transports available everywhere including routers, so a UDP block is a settings change rather than a dead end.
Kill switch listed across all four major consumer platforms.
Unlimited simultaneous devices, which suits a household on one subscription.
Obfuscated transports included with a standard subscription rather than sold as an add-on.

Limitations

No published third-party audit that we could locate.
Leak-protection documentation covers DNS but not IPv6 or WebRTC. A capture from our review pass showed no WebRTC leak on Windows, which is one observation rather than a documented guarantee.
Split tunneling is undocumented, though we observed it working on Windows.
Shadow has no public specification. ZoogVPN says ZoogTLS is based on OpenConnect, which is documented, but its own build of it is not published. Neither transport has been independently assessed for detection resistance.
ZoogTLS is Windows-only, and Shadow is absent on Linux and routers.
Kill-switch behaviour during server changes and after sleep is undocumented.

What our review-pass screenshots show

Separately from the documentation review above, we captured a set of screenshots and screen recordings while running ZoogVPN. These are single observations from one machine on one connection, not a controlled test programme, so they establish that something worked at the moment of capture rather than how it behaves over time.

Leak checks

DNS: with ZoogVPN connected to Germany, the resolvers returned were all operated by Google and located in Frankfurt, matching the selected server. An unprotected run of the same test returned the real Ukrainian resolver. A second capture against a Swiss server showed the same pattern.
WebRTC: BrowserLeaks reported "No Leak" with ZoogVPN connected to Germany, with no local or additional public WebRTC address exposed, and the remote address matching the one shown in the app.
Torrent address: ipleak.net reported the same Austrian address in the browser and through the BitTorrent client while connected to Vienna over WireGuard, so torrent traffic was using the tunnel rather than the ordinary connection.

Throughput

We recorded an unprotected baseline first, on both Ookla and Fast.com, so every observation below is relative to the same line rather than to a number quoted out of context.
On a nearby European server over WireGuard, download throughput stayed close to the unprotected baseline and latency rose by tens of milliseconds, which is the distance to the server rather than a cost of the protocol.
On a US server tested against a US endpoint, throughput again stayed in the same range as the baseline, with latency reflecting the longer route from our location.
Routing from a European server to a US endpoint kept throughput broadly intact but roughly tripled latency. That is the intercontinental hop, and no protocol choice removes it.
A qBittorrent download of a Ubuntu ISO sustained a steady rate through the European server over WireGuard, with the client bound to the tunnel.

Streaming and restricted networks

BBC iPlayer: a recording shows iPlayer unavailable from the original location, then playing after connecting to a UK server, with seeking working.
Netflix and Prime Video: both loaded and played through a US server in the captures reviewed. Netflix also played through Japanese and Korean servers.
Restricted networks: recordings from China show Google and YouTube unreachable, then loading after connecting; recordings from Russia show the same for YouTube and Instagram.
Split tunneling on Windows: with Edge routed through a Polish server and Chrome excluded, the two browsers reported different public addresses at the same time.

What these captures do not establish

They do not establish durability. Streaming platforms and national filters change what they block continuously; a capture shows one moment, and we make no claim that any of these services remain accessible today.
They are not a speed benchmark. The figures come from one line in one country on one day, against servers we chose. Your own result is the only one that describes your connection - the method is in our testing guide.
They do not verify the no-logs position, the jurisdiction or anything else that depends on what happens on the provider's side. Nothing visible in a client screenshot can confirm that.
They were captured on Windows. We did not capture equivalent evidence on macOS, Linux, iOS or Android, so the per-platform behaviour described earlier in this review remains provider-documented rather than observed.

What we could not verify

Stating gaps plainly is more useful than filling them with plausible-looking numbers.

Question	Status
Throughput on any route	Not measured. We have not run a controlled testing programme, so we publish no speed figures for any provider.
Independent security audit	We do not assert an audit exists unless we can point at the report, its author and its date.
Server count and locations	Vendor-published figures change frequently; we do not restate them as fact.
Streaming platform access	Varies by platform, server and region, often week to week. We make no fixed claims.
App screenshots	We hold no licensed product screenshots and will not reuse images from other sites.
Shadow and ZoogTLS effectiveness	Shadow has no public specification at all. ZoogTLS is vendor-described as OpenConnect-based, but ZoogVPN's own implementation is not published. Neither has been independently assessed.
Split tunneling availability	Not stated in the documentation we reviewed. Observed working on Windows in our review pass; other platforms unconfirmed.
WireGuard peer-address handling	Not described in public documentation.

Who it suits

People who move between restrictive networks and want protocol options rather than a single tunnel.
Mobile users who benefit from IKEv2's behaviour when switching networks.
Households that need more than a handful of simultaneous connections.

It is a weaker fit if you specifically require a provider with a current, published third-party infrastructure audit, or if documented split tunneling is a hard requirement.

Pricing and plans

Save 82%

Pricing, plan length, discount and refund terms exactly as published on VPN Sherlock. We do not refresh these from vendor sources during content updates, so confirm current terms at checkout before buying.

$2.49/month+ 3 months free

2-year plans

Unlimited devices30-day guarantee

Get ZoogVPN Deal Read our full review

Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.

How it compares

The table below carries the commercial terms exactly as published on VPN Sherlock. There are no speed or score columns, because we have not run the tests that would justify them.

Commercial terms as published on VPN Sherlock, September 2026.

#	VPN	Best for	Key features	Protocols	Devices	Price	Learn more
1		Best overall	Six published protocols — the widest range among the five compared here	6 (incl. Shadow, ZoogTLS)	Unlimited	$2.49/month	Get dealRead review
2	Proton VPN	Clearest obfuscation	The only provider here that publishes how its obfuscation protocol is built	3 (incl. Stealth)	10	$4.99/month	Get dealRead review
3	PureVPN	Most devices covered	Native Apple TV and Fire Stick apps, which removes the usual reason to configure a router	3 (WireGuard, OpenVPN, IKEv2)	10	$3.24/month	Get dealRead review
4		Most obfuscation options	Two proprietary transports, one of them available at router level. No IKEv2	4 (incl. OpenWeb, StealthVPN)	5	$5.00/month	Get dealRead review
5	Windscribe	Most flexible	Manual config generation for all three protocols, plus a free tier you can evaluate first	3 (OpenVPN, IKEv2, WireGuard)	Unlimited	$3.00/month	Get dealRead review

For a fuller picture of where each product sits, read the Proton VPN review, PureVPN review, Astrill VPN review, Windscribe review.

Frequently asked questions

Which ZoogVPN protocol should I use?

WireGuard for everyday use, IKEv2/IPsec on a phone that moves between Wi-Fi and mobile data because MOBIKE survives the address change, and OpenVPN TCP on port 443 where UDP is filtered. Shadow and ZoogTLS are for networks that identify and drop VPN traffic rather than merely blocking ports; they cost speed, so there is no reason to use them by default.

What are Shadow and ZoogTLS?

Two in-house ZoogVPN transports aimed at restricted networks. ZoogVPN lists Shadow on Windows, macOS, iOS and Android, and ZoogTLS on Windows only. Shadow has no public specification. ZoogVPN describes ZoogTLS as based on OpenConnect with TLS encryption, which is documented, though its own build of it is not published. Neither has been independently assessed.

Has VPN Sherlock speed-tested ZoogVPN?

Not as a benchmark. We captured throughput and latency during a review pass against a recorded no-VPN baseline, and those observations are described qualitatively in the review. We publish no figures for any provider, because single readings from one line on one day are not a controlled, reproducible programme and printing them would imply more than they support.

Does ZoogVPN support split tunneling?

Yes, on Windows. Our earlier reading of the documentation did not find it stated, but a capture from our review pass shows it working: Edge routed through a Polish server while Chrome kept the direct connection, with the two browsers reporting different public addresses at the same time. We have not observed it on macOS, Linux, iOS or Android, so treat those platforms as unconfirmed.

Has ZoogVPN had an independent security audit?

We could not locate a published third-party audit report. Absence of evidence is not evidence of a problem, and we will not claim an audit exists to fill the gap. It is worth knowing that an audit covers what the auditor was asked to look at on the day, so its presence is a data point rather than a guarantee either.

Did your screenshots show ZoogVPN working with Netflix and BBC iPlayer?

They did, at the moment of capture. BBC iPlayer went from unavailable to playing after connecting to a UK server, and Netflix and Prime Video both played through a US server. That is the whole claim. Streaming platforms change what they block continuously, so a capture from one day is not a promise about today, and we do not maintain a list of what currently works.

Does ZoogVPN work on Linux?

ZoogVPN's own protocol table lists WireGuard, IKEv2/IPsec, OpenVPN UDP and OpenVPN TCP on Linux, but neither Shadow nor ZoogTLS. Its Linux product page is less specific and mentions only OpenVPN, so the two sources do not fully agree. Our review-pass captures were taken on Windows, so we have not observed Linux behaviour ourselves - treat the protocol table as provider-documented.

Is ZoogVPN a good choice if I only need one country?

If that country is in its network and you do not need obfuscation, most of what distinguishes ZoogVPN here stops mattering. Its advantage in our comparison is protocol breadth across awkward networks. For a single well-behaved route, judge it on price, device limit and refund window like any other provider.