TunnelBear VPN

Too often, security companies opt for ominous imagery of faceless hoodie-clad hackers or other scaremongering designs to sell their products. Not so with TunnelBear VPN. This excellent virtual private network secures data with a cadre of powerful, but no less cute, bears. It's bursting with charm, but it also delivers excellent security tools at a good price. It comes up just short of being an Editors' Choice winner, behind even more powerful tools such as NordVPN.

What Is a VPN?

The free public Wi-Fi at the coffee shop might not be as safe as it seems. Maybe it was created by malevolent forces. If you join the network, they might intercept and inspect all your web traffic. Out on the Web, advertisers and government snoops are eager to track your movements online. To combat all of these possible spies, you need a VPN.

When your VPN is active, your web traffic is routed through an encrypted tunnel to a server managed by the VPN service. That keeps your information safe from data thieves with phony networks. It also helps protect against your ISP selling anonymized metadata about your web habits. When your traffic exits to the web through the VPN server, you appear to have an IP address at that server's location. This protects your real identity as you browse the Web.

VPNs are often used by journalists or people living in countries with restrictive policies toward the internet. But they're also a handy way to spoof your location for less serious needs. Content that is region-locked, such as sporting events or Netflix movies that are available in some countries but not in others, can be viewed with a VPN because the service spoofs your location. Netflix has gotten wise and started blocking VPN access, but it hasn't blocked TunnelBear yet!

Pricing and Servers

TunnelBear is one of the few providers I've reviewed that offers a free VPN service. However, the free TunnelBear tier does restrict you to only 500MB of data per month. You can earn more data by Tweeting about the company, which can raise your limit to a total 1GB for one month, and you earn bandwidth by Tweeting every month. Other free VPN offerings, like that offered by HotSpot Shield Elite serve you ads instead, but in exchange they don't restrict your use of the service.

There are a few other features that are limited to paid accounts, features that might go unnoticed until you actually start using TunnelBear. If you want to use VPN servers in Australia or India, for example, you'll have to pony up, but the other 18 countries covered by TunnelBear are available for free.

If you decide to pay for TunnelBear, it won't break the bank. You can snag the Giant plan for $9.99 per month or the Grizzly plan for $59.88 per year. That's dead-on average pricing for a VPN, and the quality of service makes it a good value. Both the paid plans offer unlimited data and a full set of features. Payments can be made using major credit cards and anonymous BitCoin transactions. Other VPN services like TorGuard go even further, accepting prepaid gift cards from other merchants like Starbucks and Subway. The next time you receive one of these as a gift, consider putting it towards a VPN instead of a venti mocha.

With either a free or a paid account, you can use up to five devices with a single TunnelBear account. That's average for VPNs, although Hostwinds VPN has no limit on the number of devices you can enroll.

Some services, like IPVanish, offer software for routers. This effectively protects every device on your network while only counting the router toward your limit of protected devices. TunnelBear doesn't offer this scheme, but it's primarily an option for those getting their hands dirty when it comes to networking, which isn't TunnelBear's sweet spot.

Representatives from TunnelBear told me that it offers approximately 900 servers at any given time. That's a good offering, but a far cry from Private Internet Access, which offers well over 3,000 servers in nearly 200 locations. The number of servers matters because you'll get better performance if the VPN server you're using isn't already stuffed to capacity with other subscribers.

As for server locations, TunnelBear offers servers in 20 countries, including Australia, Brazil, Canada, Denmark, France, Germany, Hong Kong, India, Ireland, Italy, Japan, Mexico, the Netherlands, Norway, Singapore, Spain, Sweden, Switzerland, UK, and these United States. It's a good selection, but it leaves out all of Africa, the Middle East, and places like Russia and Turkey, which have repressive internet access policies. Editors' Choice winners Private Internet Access and NordVPN offer many more locations. The more locations a VPN company offers, the better performance you'll have when traveling abroad, since there will be a VPN server close by. More server locations also means more options for spoofing your location.

Like most VPNs, TunnelBear is a zero-log service. Nothing about your online activities is stored, assuring you anonymity. The company is based in Canada, and a company representative explained that it is not subject to any mandatory data retention laws. The company representative also made it clear that TunnelBear does not inject ads into your web browsing, which some VPN companies have done in the past. The rep went on to say that, in fact, TunnelBear only makes money off of subscriptions and does not sell any data to third parties. That's a relief, especially in this age of surreptitious corporate data mining.

Note that you cannot use TunnelBear for P2P file sharing or BitTorrent. If that's a priority for you, I recommend TorGuard. NordVPN also allows BitTorrent on specific servers, and in fact, offers other specialty servers for video streaming and other activities.

On the Prowl for Ads

TunnelBear does not include integrated ad-blocking. Instead, the company has quietly launched a stand-alone browser plugin called Blocker. It retains TunnelBear's trademark bears and charm, and is surprisingly well polished for a Chrome plugin.

When you visit a site, the number of ads blocked appears in the mouth of the little bear icon, as if it had ripped them from the still-warm body of the website. Clicking the arrow next to the Blocking section expands a list of all the elements blocked. I really like this, since it allows you to block some elements on a website, but not all of them. You could, for example, block privacy-defying trackers while still allowing ads. TunnelBear Blocker also handles more complex elements, such as Ultrasonic Tags. These are high-frequency tones played during advertisements and received by apps in order to tell advertisers that their ad is being viewed.

Fine controls, like site whitelists, are especially important with ad blockers. Some blockers break elements in sites, making them virtually unusable. Sometimes, a few ads are worth a working site.

VPN Clients and Features

TunnelBear has client software for Windows, Mac, iOS, and Android devices. It also offers browser plug-ins for Chrome and Opera. Using these runs only your browser data through the VPN service, letting your other apps operate unfettered but also unprotected. It's a feature I like, since it offers protection for just about any device that can run a browser. But it's not a substitute for the service's complete VPN protection, which is what I tested.

I installed TunnelBear on a Lenovo ThinkPad T460s running Windows 10 for testing. Installation took just a couple of seconds and required no additional tweaking from me. That's perfect for novice users.

Previously, the TunnelBear app used a serviceable but dated interface that heavily relied on old-timey visual metaphors like switches and dials. The company has moved away from this approach, and I really like the result. The new client is sleek and subtle, built around a central map of the world displaying the company's server locations. Select your desired location from the menu above, switch protection on, and you're treated to a surprisingly smooth animation of a bear tunneling away from your current location. The mobile apps use the same design, so you'll have a familiar experience no matter where you go with TunnelBear.

TunnelBear doesn't have too many locations to choose from, but a location search box would be an excellent addition—as would a list of servers, with some basic information like load and ping time. NordVPN does an excellent job of conveying vital statistics about its VPN servers, and offers specialized servers for connecting to Tor, streaming video, and more.

The TunnelBear app does include some advanced features, such as Vigilant Mode. This prevents data from slipping through your internet connection during the seconds it takes TunnelBear to reconnect should you become disconnected. GhostBear aims to circumvent VPN blocking by disguising VPN traffic as normal HTTPS traffic. A TunnelBear representative told me that the company advises that users only switch on GhostBear when absolutely necessary, as it can affect performance by as much as 50 percent. It's an impressive offering, but not unique. Other companies, such as Golden Frog VyprVPN offer similar custom tools designed to circumvent censorship.

Another important security feature is Trusted Networks. This is basically a whitelist of Wi-Fi networks you trust. When this feature is activated, TunnelBear will automatically connect if the Wi-Fi network you're on is not one of the networks on your white list. I like this feature a lot, but other companies that include a similar feature frame it more clearly by saying that the VPN will connect on untrusted networks. Still, it gets the job done.

TunnelBear secures your connection with the OpenVPN protocol for Android, macOS, and Windows. This is my preferred protocol, as it is newer, faster, more secure, and open source. The TunnelBear iPhone app uses IKEv2 protocol, which is a good option for that platform. You can't change which protocol TunnelBear uses in its app, but that's fine for most users. You can, however, opt to force a TCP (instead of UDP) connection with TunnelBear.

A final note on the app itself: TunnelBear reps tell me that it recently underwent and passed an independent code audit. A company representative tells me that future code audits will be released publicly. The point of a code audit is to find potential flaws in the app's design, so this is welcome news.

Speed Test

No matter the VPN you choose, you'll see an impact on your web-browsing experience. Most of the time, it's a negative one, but there's the occasional exception, such as Editors' Choice winner PureVPN, which actually improved throughput performance in some parts of my testing. After looking over all my tests, TunnelBear performed on par with other VPN services, occasionally surpassing the competition—especially over international connections.

When I test VPNs, I look at performance when connected to a domestic (US) server and an international server. For the domestic test, I connect to the VPN and then compare the average results of several Ookla speed tests with a baseline average. I do the same for the international tests but use an Ookla test server in Alaska communicating with a VPN server as far away as possible—usually in Australia. (Note that Ookla's Speedtest.net is owned by Ziff Davis, PCMag's publisher.)

The domestic VPN test is meant to simulate the way most users will experience the service, since it's generally optimized for speed and reliability. TunnelBear earned an excellent score in the latency test, increasing latency by only 12.3 percent. Hide My Ass VPN has the best score in this test, increasing latency by only 5.6 percent. TunnelBear delivered a decidedly average result in the download test, eroding download speeds by 6.7 percent. PureVPN and Hotspot Shield Elite actually improved download speeds, by 346.4 percent and 45 percent, respectively. TunnelBear performed less impressively in the upload test, where it slowed uploads by 8 percent. PureVPN has the best score in this test as well, reducing upload speeds by 4.9 percent—it's the fastest VPN I've tested.

The international scenario is more of a stress test for a VPN, and its indicative of the VPN's performance while spoofing your location. The distances involved always lead to increased latency, and TunnelBear is no different; it increased latency by 277.5 percent. Hotspot Shield Elite has the best score in this test, increasing latency by just 155.4 percent. TunnelBear managed to actually improve download speeds by 98.9 percent, a remarkable trait it shares with PureVPN, which increased download speeds by 403.8 percent. TunnelBear managed an admirable score for the upload test, reducing speeds by 6.8 percent. Hotspot Shield Elite eked out the win for this test, improving upload speeds by 1.4 percent.

Smarter Than the Average VPN

TunnelBear has always been a favorite of mine. In the often ossified and overly technical world of security products, it's lighthearted and cute. The company has always put a premium on design and user experience, which is sorely needed in the world of VPNs specifically and all of digital security generally. TunnelBear does all that while still offering a secure, simple product with a robust backbone and surprisingly good speed test scores—particularly in international testing. It's a great purchase, and one that has become more compelling since I last evaluated it.

That said, it falls short in the important area of geographically diverse servers, and it lacks the specialty servers offered by some of the competition. Because of that it gets a four-star rating, but it falls just shy of Editors' Choice winners KeepSolid VPN Unlimited, NordVPN, Private Internet Access, and PureVPN. Still, I wouldn't fault anyone for cuddling up with this bear.