Hotspot Shield: Blazing Speeds, Big Network—But Privacy Concerns

As you can see, Hotspot Shield keeps logs—many of which are sensitive and identifiable, including your real IP address.

Hotspot Shield justifies logging your IP address by saying it’s stored only for the duration of your VPN session. But it’s not necessary to store this information at any time. VPNs like Private Internet Access and Mullvad prove this.

Hotspot Shield also logs your bandwidth usage, connection timestamps, VPN server location, and originating location—and it keeps these logs indefinitely.

Your browsing data is recorded in aggregated form, which means it cannot be linked to your specific account.

Hotspot Shield Free is even less private, as using it means sharing your personally identifiable data with third-party advertisers.

Owned by Aura, Based in the US

Hotspot Shield is now owned by a company called Aura. This is a US-based company, where intrusive privacy laws apply. US authorities can compel Aura to retain and share its users’ information.

The US is also a founding member of the Five Eyes alliance—countries that work together to collect, share, and analyze mass surveillance data. None of this is good for privacy. Ideally, Hotspot Shield would be based in a country with no data retention laws, like the British Virgin Islands or Switzerland.

No Longer Releases Transparency Reports

Hotspot Shield used to release transparency reports detailing the law enforcement requests it receives and how it responds. This built trust and supported its logging claims. However, Hotspot Shield has not released a transparency report since 2019.

With no transparency reports and no independent audit, there is no evidence to support Hotspot Shield’s privacy protection claims, and therefore it cannot be fully trusted.

Hotspot Shield’s Controversial History

There have been a number of controversies surrounding Hotspot Shield:

• In 2016, a CSIRO report highlighted questionable practices by Hotspot Shield. The Android app was “injecting JavaScript codes for advertising and tracking purposes,” meaning Hotspot Shield used tracking codes to collect information about users and sell data to advertisers.
• In 2017, the Center for Democracy and Technology (CDT) accused Hotspot Shield’s free version of “unfair and deceptive practices.” Essentially, Hotspot Shield overstated the privacy and security benefits of its VPN, even arguing that collecting your IP address is not personal information.

• In 2018, an independent researcher found and reported a bug with Hotspot Shield that leaked users’ personal data, including location and Wi-Fi name. Hotspot Shield eventually acknowledged the accuracy of this report.

It’s hard to trust a company with such a checkered history. However, Hotspot Shield has since come under new ownership and its privacy policy has been revamped. It now clearly shows users what data the VPN does and does not collect, and how the free app is used for advertising.

Overall, based on Hotspot Shield’s current logging policy, its US jurisdiction, its refusal to provide transparency reports or audits, and a history of selling user data, we have to say that Hotspot Shield cannot be 100% trusted to protect your privacy.

Unblocks Most Global Streaming Sites

Our streaming tests show that Hotspot Shield Premium works to access most geo-blocked streaming sites, including six Netflix libraries (including the US), HBO Max, Hulu, and Amazon Prime Video.

It’s also useful for watching British TV on sites like BBC iPlayer, ITVX, and Channel 4. However, Hotspot Shield does not work with Hotstar. This is disappointing, as the best VPNs for streaming unblock every platform.

Hotspot Shield Free Does Not Unblock Streaming Sites

Hotspot Shield Free performs very poorly as a streaming VPN. We tested it with every major streaming site and it failed to unblock all of them. For a free streaming VPN, we recommend Windscribe Free instead.

WireGuard, IKEv2 & Hydra Protocols Available

Hotspot Shield includes the common WireGuard and IKEv2 protocols, as well as its proprietary protocol called Hydra (formerly Catapult Hydra).

Hydra was developed by Hotspot Shield to deliver very fast speeds, and our tests show that it works. In terms of security, Hydra is safe: it is based on TLS 1.2 and uses 128-bit AES encryption, 2048-bit RSA certificates for server authentication, and perfect forward secrecy.

However, the problem with closed-source proprietary technology like Hydra is that independent experts can’t fully examine it. Hotspot Shield says the code is assessed by experts from cybersecurity firms like Bitdefender and McAfee. If you trust this, you can use Hydra without concern. If not, it’s better to use WireGuard.

We typically recommend WireGuard or OpenVPN because they are secure and open-source. But Hotspot Shield does not include OpenVPN in its list of protocols, preferring to promote its Hydra protocol.

Hotspot Shield Passed Our Encryption Test

We tested whether Hotspot Shield actually encrypts your traffic by analyzing it with the packet-sniffing tool Wireshark. If Hotspot Shield did not encrypt our data, Wireshark would show the websites we visited.

As you can see in the image below, our test found that all incoming and outgoing network packets were encrypted, and none of the websites we visited were decipherable.

No IP, DNS, or WebRTC Leaks

We tested the Hotspot Shield apps using our in-house tool to check for data leaks. The results were safe: no IP, DNS, or WebRTC leaks were recorded, and our real IP address remained hidden throughout.

However, Hotspot Shield does not support IPv6 traffic, so you risk exposing personal data on IPv6 connections. Other VPNs like Hide.me offer a dual-stack solution to this issue, and others like Surfshark simply block IPv6 traffic to prevent leaks.

Browser Extensions Failed Our Leak Test

While the Hotspot Shield apps were leak-free, the same isn’t true for its Chrome browser extension. Our tests showed that the Chrome extension leaks DNS requests — even with the WebRTC leak blocker enabled.

This means your ISP can still see the websites you visit when connected via the Chrome extension. We recommend avoiding Hotspot Shield’s browser extension.

No Kill Switch on macOS

Hotspot Shield does not have a kill switch for macOS — not even an automatic one running in the background. We tested it with our kill switch test tool and found that our real IP address was exposed whenever we changed servers or triggered an unexpected internet disconnection.

Thankfully, the kill switch works properly on other apps. However, it’s not enabled by default, so you should turn it on.

Like all VPNs, most of Hotspot Shield’s servers are in North America and Europe. However, there are more options in Asia, the Middle East, and Africa than usual. It’s refreshing to see servers in countries like Algeria, Bhutan, Pakistan, Nepal, and Peru.

There are city-level options in seven countries, including Australia, Canada, France, Italy, Spain, the UK, and the US.

It’s a shame that Hotspot Shield’s city servers are all in Western countries, but it’s still a solid number of city options — especially in the US, where there are 25 available cities.

Hotspot Shield does not disclose how many individual IP addresses it maintains, but it can offer IPs in various parts of the globe because it uses virtual servers. This means it doesn’t have physical hardware in the country but can still unblock geo-restricted content.

Hotspot Shield shares its server network with Betternet, TouchVPN, and VPN360. This is unusual, as it means the network is used by many more users, potentially leading to congestion. Furthermore, as a paying Hotspot Shield subscriber, it seems unfair that free VPNs have access to the same network.

Hotspot Shield Free Limited to Four Countries

Hotspot Shield Free’s server network is much smaller than the Premium version. It has servers on the US East Coast (New York), US West Coast (Los Angeles), the UK, and Singapore.

This is very limited, well below the 10 free countries available from Windscribe Free.

Hotspot Shield’s apps are simple, well designed, and mostly consistent across devices.

Here’s an overview of our experience using Hotspot Shield on different devices and operating systems:

Desktop & Laptop (Windows & macOS)

Hotspot Shield is more customizable on Windows than on macOS, with options for auto-connect, minimize to tray, and start on launch.

There are also useful keyboard shortcuts on Windows, such as for VPN connection and disconnection (Ctrl + Shift + C). This is a rare feature that makes the user experience more efficient.

The macOS app has none of these features and is much more minimal. It consists of a main connect button, a list of servers, and a settings menu that includes protocol choices and split tunneling. Beyond split tunneling, there are no customization options, and you cannot resize the window.

This might appeal to users who want a simple click-and-protect experience, but seasoned users wanting full control may prefer the Windows version or a different VPN altogether.

Neither app is complicated, and both include useful split tunneling (on the Hydra protocol only).

Mobile (iPhone & Android)

Hotspot Shield’s mobile apps are even simpler than its desktop clients, with a large connect button, a server list, and an almost identical settings menu.

The biggest difference between the desktop and mobile apps is the inclusion of streaming and gaming servers on mobile.

The iOS and Android apps are nearly identical. They are equally smooth and easy to use.

The only difference is the addition of Always-On VPN on iOS, a technical feature that ensures you don’t use apps or visit websites without Hotspot Shield’s protection.

Lots of CAPTCHAs

We ran into many CAPTCHAs when browsing the web with Hotspot Shield. CAPTCHAs occur when a VPN doesn’t refresh its IP addresses and their overuse gets flagged as suspicious. Frequently proving your humanity gets tiresome quickly, and we found it frustrating.

Hotspot Shield should update its IP address pool. The option to get a dedicated IP address would also help, but this isn’t available in any of Hotspot Shield’s subscription plans.

Hotspot Shield openly endorses torrenting on its service, but we don’t recommend it due to the VPN’s slow average download bitrate, its intrusive logging policy, and the lack of a macOS kill switch. Torrenting with Hotspot Shield is not without risk.

When testing Hotspot Shield with torrent clients like qBittorrent and uTorrent, we recorded an average download bitrate of 4.3MiB/s. This is a low result that can lead to slow file sharing, especially compared to top-rated torrenting VPNs.

Not Reliable Against Censorship

Live Chat Support Is Reserved for Paying Customers

Features We’d Like to See