Coverage168countries
Paying monthly$10.99monthly
Paying yearly$39.84yearly total
Free tierYeslimited free plan
Devices10at once
7 out of 100
Security
86 out of 100
Usability
Servers in country
The law in Iran puts a VPN provider with servers in the country under obligations to the state — keeping records about its users, registering, or giving the authorities access. On record here: mandatory registration and interception access.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
An exit here is under a retention mandate. Mandatory registration and interception access. From the contract's country table — the same field that marks a country on a record's own list.
Using an unlicensed VPN is prohibited in Iran, though the rule names no penalty for the user. An exit standing here stands on a licensed network that must keep records of its users and stay open to interception.
The Computer Crimes Law (2009) obliges access providers to keep traffic data for at least six months after it is created and to keep their users’ information for at least as long, and article 48 places interception requirements on them. Every access provider operates under a state licence.
That is registration and interception in one: the operator of the line has to know who its customers are and be able to show the authorities what passes through it.
A resolution of the Supreme Council of Cyberspace, announced in February 2024 with the Supreme Leader’s approval, prohibits the use of VPNs that are not licensed. Instagram, Telegram, X and YouTube have been blocked for years; WhatsApp and Google Play were unblocked in December 2024.
The network itself has been cut: nationwide in June 2025, again from 8 January 2026, and almost entirely from 28 February until a partial restoration on 26 May 2026.
Yes, and sentences are long. Prosecutions over posts are brought under the Islamic Penal Code, among them article 500, propaganda against the state, and article 698, spreading lies, as well as under the Computer Crimes Law. One journalist was sentenced to twelve years for a reply on X.
The account is the exposure, not the network. A VPN does not answer a case that starts from what was published under a name.
An exit in Iran is an exit under that law, and the register marks the mandate on a record’s own country list.
Two of the 77 records publish an exit here. That is a usability fact — reach — and it is not a recommendation: the order of the rows is the security score, and the mandate above sits on the provider, not on the reader.
Iran
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
Each of the two providers with an exit here names this country under a mandate in its own record (C09_mandate_countries).
Coverage168countries
Paying monthly$10.99monthly
Paying yearly$39.84yearly total
Free tierYeslimited free plan
Devices10at once
Security
Usability
Coverage91countries
Paying monthly$12.99monthly
Paying yearly—no yearly plan
Free tierNopaid plans only
Devices7at once
Security
Usability
