Windscribe review

Updated 21 September 2026 · Based on vendor documentation and protocol specifications · Read our methodology

Quick verdict

Windscribe offers the three mainstream protocols and, unusually, lets you generate manual configuration files for all of them — so it works on routers and third-party clients without depending on an official app. Its logging statement is narrower than a blanket no-logs claim and deserves to be read in full rather than summarised.

Documented facts

Protocols: 3 (OpenVPN, IKEv2, WireGuard)
Manual configs: Yes, for all three
Content filtering: R.O.B.E.R.T.
Simultaneous devices: Unlimited
Refund window: 3-day money-back guarantee
Free tier: 10GB free tier

$3.00/month

Get Windscribe Deal3-day money-back guarantee · Unlimited devices

Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing as published on VPN Sherlock; confirm current terms at checkout.

How to read this review

Everything below comes from Windscribe's own published documentation, retrieved 21 September 2026, or from public protocol specifications, except where a section is explicitly marked as resting on our review-pass captures. We did not run a controlled lab benchmark, and we publish no speed figures, scores or audit verdicts we have not verified. Where a screenshot is cited it supports the visible state at the time of capture, not long-term behaviour.

Protocol support

The protocol list is conventional, but the ability to generate configuration files changes what you can do with it. A provider that publishes working WireGuard, OpenVPN and IKEv2 configs can be used on any client that speaks those protocols — a router, a NAS, a Linux server — rather than only through software the vendor chose to write.

Windscribe states that users can "Generate OpenVPN, IKEv2, and WireGuard configs", retrieved 21 September 2026.

Protocol	What the vendor says
WireGuard	Config generation offered alongside the apps
OpenVPN	Config generation offered alongside the apps
IKEv2	Config generation offered alongside the apps

Manual config generation is the practical differentiator here. It means router use does not depend on the vendor shipping firmware support, and it makes the service usable from clients the vendor never anticipated. The trade-off is that configuring a tunnel by hand puts leak protection and kill switching on you rather than on the app — worth pairing with the checks in how to test a VPN. No obfuscated transport appears in the material we reviewed.

Documented features

Manual config generation for OpenVPN, IKEv2 and WireGuard, usable on routers and third-party clients.
R.O.B.E.R.T.: described as blocking "IPs and domains (ads) of your choice on all devices". Because it works at the DNS and IP layer it complements rather than replaces in-browser controls.
Logging statement: the vendor states "We can't personally identify you based on IP and timestamp". That is a narrower claim than "we keep no records", and the difference matters — read it alongside logging explained.
Encryption is described as "strong & industry-leading", which is marketing language rather than a specification. The underlying ciphers follow from the protocol you choose.
A free tier lets you evaluate the service before paying, which removes the usual reason to rely on someone else's review.

Platform coverage

Platform reach follows from config generation as much as from the official apps.

Platform	Notes
Windows	Native app; manual configs also available
macOS	Native app; manual configs also available
Linux	Native app; manual configs also available
Android	Native app; manual configs also available
iOS	Native app; manual configs also available
Routers	Via generated OpenVPN or WireGuard configuration
Third-party clients	Any client that speaks the generated config

Encryption and authentication

Cipher choice follows from protocol choice rather than being a separate setting you tune. On WireGuard the suite is fixed — ChaCha20-Poly1305 for the data channel, Curve25519 for key agreement, BLAKE2s for hashing — and there is no negotiation, which removes a whole class of downgrade risk. On OpenVPN and IKEv2 the data channel is normally an AEAD construction such as AES-GCM, agreed during the handshake. Both AES-256-GCM and ChaCha20-Poly1305 are unbroken; ChaCha20 tends to be quicker on processors without AES hardware acceleration, which covers a lot of older phones.

What matters more than the cipher name is forward secrecy: each session should use ephemeral keys that are discarded afterwards, so that compromising a server's long-term key later would not decrypt traffic recorded earlier. All three mainstream protocols provide this when correctly configured. Treat "military-grade encryption" as marketing language — AES-256 is a public NIST standard anyone can use. The detail is in VPN encryption.

Leak protection and kill switch: what to check

Vendor documentation across this sector tends to describe DNS leak protection and a kill switch in general terms, without stating behaviour per operating system or during the moments when leaks actually happen. Rather than restate marketing copy, here is what is worth verifying yourself on this provider, in the order the failures usually occur.

DNS. Connect, then confirm every resolver shown in a leak test belongs to the VPN rather than your ISP.
IPv6. Check that either no IPv6 address appears or the one shown belongs to the VPN. An IPv4-only tunnel can let IPv6 traffic escape.
WebRTC. Test in each browser separately. No VPN client can fully close this, because the exposure happens inside the browser.
Kill switch under crash. End the client process from the task manager rather than disconnecting cleanly; traffic should stop immediately.
Kill switch on network change. Switch Wi-Fi to cellular, or disable and re-enable the adapter.
Reconnect and server change. Watch for a gap in protection while the tunnel is rebuilt — this is where most real leaks appear.

The full procedure, including what to record, is in how to test a VPN. We publish our own results for no provider, because we have not run a controlled testing programme — so these are checks for you to run, not findings for you to take on trust.

Strengths and limitations

Strengths

Manual configuration files for all three protocols — genuine flexibility.
A substantial free tier, so you can evaluate before paying.
DNS and IP level blocking bundled through R.O.B.E.R.T.
Works on routers and unusual clients without vendor firmware support.

Limitations

No obfuscated transport in the material we reviewed.
The logging statement is narrower than a blanket no-logs claim.
Hand-configured tunnels leave kill switching and leak protection to you.
"Industry-leading encryption" is marketing language with no specification attached.

What our review-pass screenshots show

We captured a short set of checks while running Windscribe. These are single observations, not a controlled test programme.

DNS: the resolvers shown belonged to the active Windscribe connection rather than the local ISP.
WebRTC: no local address was exposed while connected.
Split tunneling: one browser was routed through the tunnel while another was excluded, each reporting a different address.
BBC iPlayer: playback ran through a UK server in the captures reviewed.
Throughput over WireGuard stayed in the same broad range on European and US servers, with latency tracking distance.

What we could not verify

Stating gaps plainly is more useful than filling them with plausible-looking numbers.

Question	Status
Throughput on any route	Not measured. We have not run a controlled testing programme, so we publish no speed figures for any provider.
Independent security audit	We do not assert an audit exists unless we can point at the report, its author and its date.
Server count and locations	Vendor-published figures change frequently; we do not restate them as fact.
Streaming platform access	Varies by platform, server and region, often week to week. We make no fixed claims.
App screenshots	We hold no licensed product screenshots and will not reuse images from other sites.
The logging statement's scope	"Can't personally identify you based on IP and timestamp" is narrower than "we keep no records". Read the full privacy policy.
R.O.B.E.R.T. block-list sources	Not published in the material we reviewed.

Who it suits

People who want to evaluate a VPN properly before paying for it.
Technical users who need manual configs for routers, a NAS or a server.
Anyone who wants DNS-level blocking bundled with the tunnel.

Less suitable if: you need an obfuscated transport for a heavily filtered network, or you want the app to handle kill switching on a router where you would be hand-configuring the tunnel.

Pricing and plans

Commercial terms exactly as published on VPN Sherlock. We do not refresh these from vendor sources; confirm current pricing at checkout.

$3.00/month

Unlimited devices3-day money-back guarantee10GB free tier

Get Windscribe Deal Read our full review

Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.

How it compares

The table below carries the commercial terms exactly as published on VPN Sherlock. There are no speed or score columns, because we have not run the tests that would justify them.

Commercial terms as published on VPN Sherlock, September 2026.

#	VPN	Best for	Key features	Protocols	Devices	Price	Learn more
1		Best overall	Six published protocols — the widest range among the five compared here	6 (incl. Shadow, ZoogTLS)	Unlimited	$2.49/month	Get dealRead review
2	Proton VPN	Clearest obfuscation	The only provider here that publishes how its obfuscation protocol is built	3 (incl. Stealth)	10	$4.99/month	Get dealRead review
3	PureVPN	Most devices covered	Native Apple TV and Fire Stick apps, which removes the usual reason to configure a router	3 (WireGuard, OpenVPN, IKEv2)	10	$3.24/month	Get dealRead review
4		Most obfuscation options	Two proprietary transports, one of them available at router level. No IKEv2	4 (incl. OpenWeb, StealthVPN)	5	$5.00/month	Get dealRead review
5	Windscribe	Most flexible	Manual config generation for all three protocols, plus a free tier you can evaluate first	3 (OpenVPN, IKEv2, WireGuard)	Unlimited	$3.00/month	Get dealRead review

For a fuller picture of where each product sits, read the ZoogVPN review, Proton VPN review, PureVPN review, Astrill VPN review.

How it differs from the other four

Windscribe's differentiator is not the protocol list, which matches PureVPN's, but what you are allowed to do with it. Generated configuration files mean the service works on routers, a NAS or a Linux box without waiting for vendor firmware support — something none of the other four documents in the same way. Against ZoogVPN and Astrill VPN it has no obfuscated transport, so heavily filtered networks are a weakness. Against all four it is the only one with a free tier substantial enough to evaluate the service before paying, which removes the need to rely on anyone else's review, including ours.

Most regret with a VPN subscription comes from buying on a feature list and discovering a platform gap afterwards. The refund window exists for this; use it deliberately rather than hoping.

Confirm the protocol you actually need is available on the device you will use it on. Per-platform availability varies more than headline protocol counts suggest.
Check the current price and terms at checkout. Figures on this site are preserved as previously published and are not refreshed from vendor sources.
Run the leak and kill-switch checks above in the first day, while a refund is still straightforward.
Test the specific thing you are buying for — a particular network, a particular service, a particular country — rather than a generic speed test.
If something does not work, request the refund inside the stated window rather than waiting to see whether it improves.

Frequently asked questions

Does Windscribe have a free tier?

Yes, and it is more useful than most. The free tier lets you evaluate the service on your own network before paying, which is worth more than any review - including this one - because it tests your line, your ISP and your routes rather than ours. Check the data allowance and server choice, which are where free tiers are usually limited.

What is R.O.B.E.R.T.?

Windscribe describes R.O.B.E.R.T. as a configurable blocker for IP addresses and domains that applies across all your devices. It works at the DNS and IP layer, so it stops lookups and connections rather than inspecting page content. That makes it useful against known advertising and tracking domains and ineffective against anything served from the same origin as the content.

Does Windscribe keep logs?

Windscribe states it cannot personally identify a user from an IP address and timestamp. That is a narrower claim than saying no records are kept, and the difference matters: it describes what the provider says it can reconstruct, not what it stores. Read the full policy rather than the summary line, and note that no logging claim is verifiable from outside.

Is the free tier enough to judge Windscribe?

It is enough to judge speed and reliability on your own connection, which is the part a review cannot do for you. It is not enough to judge the paid experience, since server choice and allowances differ. Use it to rule the service out cheaply, not to conclude the paid tier behaves identically.