Search for “best free VPN” and you will find fifty nearly identical lists. They all rank by the same things: speed, whether they unblock Netflix, how many servers they have. Reasonable criteria for someone in Madrid or Miami.
For someone in Cuba, not one of those three matters at all. The criteria are different, and in an order none of those lists mentions.
Before comparing anything: you cannot pay
A subscription costs between 5 and 12 dollars a month. A Cuban artist summed it up for TIME: that is ten days of salary. And even if you had it, there is no card to pay with, because international cards are not issued on the island.
That is why this article only covers free plans. In Cuba the free tier is not a preference of people being cheap: it is the only door there is.
Installing it: less of a problem than people say
I was going to write here that Google Play blocks Cuba, because more than one serious news report says so. I corrected it before publishing, and I am telling you because the mistake is instructive: Google Play does work in Cuba for free apps. What you cannot do is buy. The embargo stops Google from selling there, so what falls outside are paid apps and services like Google Cloud, Google Developers and Google One.
For our purposes, that means a free VPN normally installs from the store, and that is that.
So why is there an F-Droid column in the table? For two reasons that still hold, and they are about trust rather than access. First: if the app is pulled from the store tomorrow, or your account is restricted, a direct APK or F-Droid is the emergency exit. Second, and this matters more: on F-Droid the apps are built from published source code, so what you install is exactly what anyone can read. In a tool you are about to trust with all of your traffic, that is worth more than the convenience of a download button.
Jurisdiction: a risk, not a verdict
OFAC sanctions forbid American companies from providing services to Cuba. There are exceptions for telecommunications that “directly benefit the Cuban people,” but most web services do not fall under them and would need a special license.
Now, be careful with the easy conclusion, because I nearly drew it myself. A company being subject to the rule does not mean it blocks Cuban IP addresses. These are three different things, and mixing them is the most common error in writing about this: one is not being legally allowed to operate there, another is technically filtering connections arriving from Cuba, and another is whether it works in practice. A great many American services do not filter by region at all: they ask for an email address and nothing else, no street address and no card, and they are used from the island every day.
So what I am saying is narrower than it looks, and that is why I am saying it slowly. Jurisdiction does not tell you what happens today: it tells you who can shut the door on you tomorrow. If a provider is Swiss or Canadian, that door cannot be shut by a decision in Washington. If it is American, it can shut overnight even if it works for you today, and there will be nobody to appeal to. On that basis TunnelBear, which has belonged to McAfee since 2018, is a worse bet than Proton for someone on the island.
And the limit of all this: I check jurisdiction, which is a public and verifiable fact. I cannot check from outside whether each one blocks Cuban IP addresses in practice, because that would require testing it from Cuba. If you are there and you check, write to me and I will correct it.
What is a real obstacle: ETECSA filters even the word “VPN”
According to Freedom House, ETECSA goes as far as filtering the word “VPN” itself. And as I explained when writing about how a website gets blocked, the primary mechanism in Cuba is deep packet inspection.
Against that you need obfuscation: VPN traffic that does not look like VPN traffic. It is a column most comparisons do not even include, and here it decides whether the tool works at all.
The table
Everything below comes from each provider’s own website, checked on September 4, 2026. Not from reviews, which in this industry live on commissions.
| Free | Jurisdiction | Open source | Obfuscation | |
|---|---|---|---|---|
| Proton VPN | Unlimited data, no speed limit, 10 countries, 1 device | Switzerland | Yes, F-Droid, GPLv3 | Yes, Stealth, on the free plan too |
| URnetwork | 30 GiB per day, 2 clients | USA (Delaware) | Open source on GitHub | Yes, plus a DNS-shaped transport |
| Windscribe | 2 GB a month, 10 GB if you confirm an email, unlimited devices | Canada | Yes, F-Droid, GPLv3 | Yes, Stealth and WStunnel |
| hide.me | Unlimited data but restricted speed, 8 locations, 1 connection | Malaysia (Labuan) | Not verified | Not verified |
| PrivadoVPN | 10 GB every 30 days, 1 device | Switzerland per its legal notice | Not verified | Not verified |
| TunnelBear | 2 GB a month | USA, owned by McAfee | Not verified | GhostBear, not verified |
Where it says “not verified” it is because I did not check it myself. I would rather leave it blank than fill it in by assumption.
Proton VPN, and being the obvious answer does not count against it
It wins for reasons that have nothing to do with speed.
It is Swiss, so OFAC does not apply to it. It is on F-Droid under GPLv3 with the source on GitHub, which means it installs without going through Google Play and anyone can audit what it does. The free plan has no data cap and no speed limit, which is rare. And its Stealth protocol, which disguises traffic as ordinary HTTPS, is available on the free plan, not reserved for paying customers.
What it does not have: only 1 device at a time, and 10 countries.
URnetwork, which is not a VPN
I list this one separately because it works differently and because it is the most generous thing I have seen: 30 GiB per day on the free plan, no card.
A VPN concentrates everyone in datacenters whose IP ranges are catalogued and get blocked wholesale. URnetwork routes your traffic out through other members’ home connections, in more than 2,000 cities. That difference matters in Cuba twice over: it is harder for ETECSA to block, and many services that refuse Cuba do so by checking range lists, not residential addresses.
It is built for censored networks: community-run relays on their own addresses, and even a DNS-shaped transport for networks where DNS is the only thing that gets out. All the code is published.
Now what has to be said. The operator is BringYour, Inc., a Delaware company, so the same thing applies to it as to TunnelBear. And there is something they say, not me, which is to their credit:
“No independent audit covers the protocol, the connect engine, or the operator’s server code. That is the layer the privacy claim rests on.”
That they write it in their own documentation says a great deal in their favor. That it is true says this is a young network and should be treated as one.
The other three, briefly
Windscribe is the only one that gives unlimited devices on the free plan, and in a Cuban household where one phone is shared by three people that is not a small thing. It gives 2 GB a month, which rises to 10 GB just by confirming an email address. It is on F-Droid and it has obfuscation. One detail worth reading carefully: it does not say “no logs,” it says “no identifying logs,” meaning they cannot identify you from an IP address and a timestamp. That is a narrower claim, and I would rather point it out than let it pass.
hide.me gives unlimited data but with the speed restricted, which is the fine print. It is Malaysian, a jurisdiction with no data retention laws, and according to third-party reviews it passed a Securitum audit in 2024. That last part I did not verify myself.
PrivadoVPN gives 10 GB every 30 days. Its legal notice says Switzerland, though there are press reports that it is moving to Iceland. I do not know which of the two is current today, so I leave it at that.
TunnelBear does something almost nobody does, which is independent audits every year. But it has belonged to McAfee since 2018. For a Cuban, that weighs more than the audits.
What none of these solves
And here I come back to the same point, because it is the only one that really matters.
Everything above solves access: reaching what has been cut off. None of it solves exposure.
None of them erases what you published under your own name. None of them protects your phone if it is confiscated, and Decree-Law 370 expressly provides for confiscating it. None of them stops someone in your group from talking. The convictions I documented in this series did not come from anyone reading anyone’s traffic: they came from content in plain sight and from people who talked.
And I add the warning that is not technical. Using circumvention tools is not a neutral gesture in a country whose Penal Code punishes what you publish. Installing a VPN is not the dangerous part. The dangerous part comes afterward, and none of these six covers it.
Regaining access and being safe are not the same thing.