Hotspot Shield

A long-running US-based VPN built on the proprietary Catapult Hydra protocol, now operated by Point Wild, offering fast speeds but a checkered privacy history.

www.hotspotshield.com/ ↗

⚠ Not scored

⚠ Documented concerns

We don't give Hotspot Shield an overall score. A proven logging breach, or an ownership history in adware or surveillance, is not something a good feature list should be able to average away. The data below is still shown in full so you can judge it yourself.

2016: Peer-reviewed study measured JavaScript ad injection
An academic study of 283 Android apps using the VPN permission, by researchers at CSIRO, UNSW, ICSI and UC Berkeley, named the then free ad-supported Hotspot Shield Android app as one of two actively injecting JavaScript via iframes for advertising and tracking, using more than five third-party tracking libraries. This is a measured finding rather than an allegation.
Source ↗
2016: Shopping traffic redirected to affiliate partners
The same study documented the app intercepting web requests and redirecting them through an AnchorFree endpoint to affiliate networks, with observed redirections for retailers including eBay, Target, Best Buy and Macy's.
Source ↗
2017: Privacy group asked the FTC to investigate
The Center for Democracy and Technology filed a complaint arguing that marketing promising guaranteed security and privacy was contradicted by a policy permitting logging to identify a user's general location and optimise advertisements. These were CDT's allegations; no public FTC action followed, and the company called the claims unfounded.
Source ↗
2018: Flaw exposed users' real IP address
CVE-2018-6460: a local web server endpoint could be queried by an unauthenticated attacker to reveal VPN connection state, Wi-Fi network name and the user's real IP address. Rated high severity by NVD, first reported to the company in November 2017 and fixed in February 2018.
Source ↗

What counts in their favour

The FTC never took public action. No investigation, consent order or finding against the company was ever announced, so the complaint's broader deception claims remain untested rather than proven.
The company denied the allegations, saying user information is never associated with online activity and that IP addresses are not stored.
An independent technical review by Aon in 2023 examined the free and paid tiers, node server logs and the client, and found no indication that browsing activity could be correlated back to a unique user, and no plaintext IP logging. Its scope covered logging and collection rather than hosting security.
The ad-injection and affiliate-redirect measurements are a 2015 and 2016 snapshot of the Android app; no comparable later measurement was found.
Ownership has changed repeatedly since: AnchorFree became Pango, was acquired by Aura, spun back out, and is now part of Point Wild.

Listing a concern is a statement about the documented record, not a claim about how the service behaves today. Where a provider has since changed owner, jurisdiction or policy, that is noted above and in the report below.

Jurisdiction: United States (five eyes)
Founded: 2008
Owner: Point Wild
Best price: $2.99/mo
Devices: 10
Free tier: Yes

No category scores are shown for Hotspot Shield because of the documented concerns above. Every individual data point is still published below, so you can weigh the record yourself.

Best for

· Users prioritizing raw connection speed over maximum privacy
· Casual streaming and general browsing on a trusted network
· People wanting a free ad-supported VPN tier to try before paying

Not ideal for

· Privacy-critical users, journalists, or activists needing a court-tested no-logs provider
· Anyone wanting anonymous/crypto payment or open-source, independently audited clients
· Users in a non-Five-Eyes jurisdiction seeking strong legal protection from data requests

Strengths

✓Proprietary Catapult Hydra protocol delivers consistently fast, high-throughput speeds
✓Has a no-logs validation by Aon (Aug 25, 2023) covering its privacy-policy data-collection claims across free and paid tiers
✓Generous 45-day money-back guarantee plus a genuinely free (ad-supported) tier
✓Large brand with apps across all major platforms and up to 10 simultaneous connections

Weaknesses

✗US jurisdiction (Five Eyes) and a 2017 FTC/CDT complaint alleging undisclosed data sharing with ad networks and traffic redirection/JavaScript injection
✗Privacy policy admits collecting bandwidth, session duration, device hashes and IP-derived location despite no-logs marketing
✗Core Hydra protocol is closed-source and clients are not open source; the Aon audit reviewed only the privacy policy, not Hydra's code or app security
✗No public transparency report since 2022, no RAM-only servers, no port forwarding or multi-hop

Protocols & encryption

The tunnelling protocols this service offers and the cryptography behind them.

WireGuard

Modern

A modern, lean protocol (~4,000 lines of code) that is fast and easy to audit. Its cryptography is fixed and state-of-the-art, with no weak options to misconfigure.

Data cipher: ChaCha20-Poly1305
Key exchange: Curve25519 (ECDH)
Integrity: BLAKE2s

IKEv2 / IPsec

Trusted

A fast, stable protocol that reconnects quickly when you change networks, so it is popular on mobile. Built natively into most operating systems.

Data cipher: AES-256-GCM
Key exchange: Diffie-Hellman (ECP)
Integrity: SHA-256 / SHA-384

In-house protocol. Catapult Hydra

This provider's setup

Stated data cipher: AES-256
Stated handshake: TLS (Catapult Hydra)
Perfect forward secrecy: Yes
Post-quantum resistant: No
RAM-only servers: No
Kill switch: Yes
First-party DNS (leak protection): Unknown
IPv6: Unknown

Full data sheet

Every attribute we track, coloured by whether it helps or hurts your privacy.

Company & jurisdiction

Based in	United States
Eyes alliance	5 Eyes
Enemy of the Internet	No
Owner	Point Wild
Conglomerate	Point Wild
Founded	2008

Logging

Traffic / activity	None kept
DNS requests	Unknown
Timestamps	Some
Bandwidth	Logged
Source IP address	Some

Markets itself as no-logs and the policy (held by Anchorfree, LLC) states it does not record which sites/apps you access or tie session activity to your identity. However, the privacy policy admits it collects session duration, bandwidth consumed, a per-install device hash, and uses your IP to derive approximate location. The Aug 2023 Aon report's own data-classification table lists timestamps, bandwidth, device hash and approximate location among collected data. DNS-query logging is not addressed. US jurisdiction (Five Eyes) and a 2017 FTC complaint over undisclosed ad-network data sharing weigh against the no-logs marketing.

Payment & anonymity

Anonymous signup	No
Accepts cash	No
Accepts crypto	No
PGP key	Unknown

Protocols & features

OpenVPN	No
WireGuard	Yes
Proprietary protocol	Catapult Hydra
Multi-hop	No
Obfuscation	Unknown
Kill switch	Yes
First-party DNS	Unknown
RAM-only servers	No
Port forwarding	No
P2P / torrenting	Yes
IPv6	Unknown

Encryption

Data cipher	AES-256
Handshake	TLS (Catapult Hydra)

Transparency

Open-source clients	No
Independent audits	1
Transparency report	No
Court / seizure-tested	Unknown

No documented server seizure, raid, or subpoena outcome demonstrating an absence of usable user data. Last public law-enforcement transparency report referenced is 2022 (per the Aon report); no published transparency report found since.

Infrastructure

Simultaneous devices	10
Countries	80
Servers	1800
Linux support	CLI / config

Pricing

Month-to-month	$12.99
Best $/mo	$2.99
On plan	3-year
Free trial	None
Refund window	45 days
Free tier	Yes

Ethics

Logging policy	Contradictory
Marketing honesty	Overclaims

Independent audits

Aon· 2023 · Technical security review of the Hotspot Shield VPN privacy policy, scoped strictly to data-collection and logging claims (no-logs validation) across free and paid tiers and client- and server-side components; methodology included VPN node server log review, client analysis, and review of the 2022 transparency report. Not a Hydra source-code audit or app penetration test, and explicitly excluded review of security measures/best practices across the hosting environment.report ↗

Ownership timeline: AnchorFree (founded 2005; Hotspot Shield product launched 2008) -> rebranded Pango -> folded into Aura (Dec 2020) -> Aura split, VPN/security side spun out (Sep 2024) -> Pango Group merged with Total Security to form Point Wild (12 Dec 2024, confirmed via PRNewswire). Hotspot Shield, Betternet, UltraAV, VPN360 and TotalAV are sibling Point Wild brands (the Dec 2024 release also names UltraAV, CyEx, Simpluris and Comparitech). The privacy policy is held by Anchorfree, LLC (250 Northern Ave, Boston, MA) with Pango GmbH (Stans, Switzerland) as an associated entity, but operational control and HQ are US. The Aon report PDF on the official security-audit page is dated 25 August 2023 (PDF metadata created 2023-10-27), confirmed by direct extraction; firm = Aon, scope = privacy-policy/logging validation only.

Sources

Last verified 2026-06-17. Point-in-time data, so always confirm on the provider's own site.