Windscribe

Free, but capped

Windscribe’s free tier is not a trial. The service says so plainly, and explains its reasoning: paying Pro users cover the cost, so the free tier carries no ad networks, no activity logs and no hidden tracking, and the only catch is a stated data cap. The numbers are simple. Give Windscribe an email address and the allowance is 10 GB a month; decline and it is 2 GB. Either way you get servers in 10 countries, unlimited devices on one account, and no card required.

The allowance can be raised permanently rather than topped up. Confirming an email moves 2 GB to 10 GB for good, posting about the service on X adds 5 GB a month, and each friend who signs up gives 1 GB to both sides. Windscribe is also unusually explicit about what a free account stores: a username, a hashed password, an email address if one was given, the total bandwidth used in the current period, and the timestamp of the last activity — and nothing that connects an activity to a person.

The macOS client

The macOS app is where the engineering shows. Windscribe states that it is a native universal binary that runs directly on M-series chips with no Rosetta translation, which keeps it light on CPU and battery. It lives in the menu bar, respects system dark mode, and uses native macOS networking APIs so connections survive sleep, wake and system updates. The desktop client’s own documentation lists macOS 13 or later for both amd64 and arm64.

Six protocols are available across more than twenty ports: WireGuard, which now includes post-quantum encryption; IKEv2, which macOS understands natively; OpenVPN over UDP and over TCP; Stealth, which disguises OpenVPN as HTTPS traffic; and WSTunnel, which disguises it as WebSocket traffic for networks that block almost everything. Custom OpenVPN or WireGuard configurations can be imported and run through the client, and there is a command-line interface on every platform.

Leak protection and control

Windscribe’s approach to leaks is worth separating from the usual one. A kill switch watches the connection and cuts the internet after the tunnel drops — which leaves a window in which the tunnel is down and traffic is not. Windscribe’s firewall works the other way round: it blocks all traffic outside the tunnel by default, using native macOS APIs, so a dropped tunnel has nothing to leak because non-VPN traffic was never allowed out in the first place. It fails closed.

Around that sit the controls a user is likely to want. Split tunnelling chooses which apps or which networks go through the tunnel, in include or exclude mode. MAC address spoofing makes the Mac look like a new device each time it joins a network. Network rules decide automatically what happens on each Wi-Fi network — connect, disconnect, or switch protocol. The R.O.B.E.R.T. DNS blocker for ads, trackers and malware domains runs on the free plan as well as on paid ones, and custom DNS servers are supported.

Open source, and how far that goes

Windscribe publishes its desktop clients’ source on GitHub under the GPL and points to it from its own site, which is unusual for a commercial VPN and makes the client verifiable in a way most competitors’ are not. The distinction matters: the clients are open source, the service they connect to is not. Anyone wanting to audit the network side has to rely on Windscribe’s own claims about its no-identifying-logs policy, which the company says has been audited by outside firms and tested in a court case.