Malwarebytes Privacy VPN Review 2026: AzireVPN Servers, Audit and Pricing

Verdict at a glance

Malwarebytes Privacy VPN is a better product in 2026 than its reputation as an antivirus add-on suggests. It now runs on AzireVPN's self-owned, RAM-only WireGuard network, it has a published third-party infrastructure audit, and the privacy policy is specific about what is and is not collected. What holds it back is breadth: a modest server count, no Linux or router apps, no obfuscation, and a feature set that thins out on iPhone and iPad.

What we like

• Self-owned physical servers, RAM-only, with no virtual locations
• WireGuard on every server, with more than 90% on 10G infrastructure and no artificial speed caps
• A published X41 D-Sec white-box audit of the VPN infrastructure (April 2026)
• Clear privacy policy: no browsing history, DNS requests, IP addresses or session timestamps collected
• New 10 GB per 30 days limited tier for Free and Standard users on Windows and Android
• The Plus bundle (antivirus plus full VPN) is cheap in its first year

What we don't

• 150+ servers in 60+ locations is small next to the largest consumer VPNs
• No Linux, router, ChromeOS or browser-extension VPN
• No documented obfuscation, dedicated IP, port forwarding or P2P policy
• Multi-hop was removed in January 2026
• Kill switch is off by default on Windows and Mac, and needs Auto connect turned on
• US parent company, and one Critical audit finding was still open when the audit was published

From rebadged service to AzireVPN's own network

For years Malwarebytes' VPN was easy to dismiss as a white-label service with an antivirus brand on top. That changed on November 7, 2024, when Malwarebytes announced it had acquired AzireVPN, a VPN provider founded in Sweden. Terms were not disclosed.

The technical switch came later. Malwarebytes VPN for Windows 3.18.0, released on January 27, 2026, "updated the VPN server backend to connect with our AzireVPN infrastructure", moved to the WireGuardNT driver, and deprecated the Multihop feature. Today the product page describes the service as "powered by AzireVPN, a Malwarebytes company" running "a 100% self-owned network of physical VPN servers".

Network, protocol and speed

Malwarebytes lists 150+ servers across 60+ locations. The server features it advertises are the ones privacy-focused buyers look for: RAM-only servers, no virtual servers, native IPv6 and a "Blind Operator" design. Every server runs WireGuard, more than 90% sit on 10G infrastructure, and Malwarebytes says it never artificially limits server speed.

Encryption is WireGuard's 256-bit ChaCha20, not AES-256 as some third-party write-ups claim. The help centre says the app uses both UDP and TCP to establish a connection. There is no protocol picker in the way OpenVPN-era apps offered, and none is needed for most people.

Two caveats. The help centre states that server locations "are not guaranteed and may change", so check the in-app list for a specific country before paying. And with no virtual locations, the map is honest but thinner than services that pad their country count with virtual servers.

Privacy, logging and jurisdiction

The privacy policy (updated August 31, 2026) is more concrete than most. For the VPN, Malwarebytes collects the license key, a generated unique identifier and the app version, and says "We only receive the public key which is used to validate and establish a VPN connection."

It lists what it does not collect: websites or IP addresses you browse, DNS requests, bandwidth usage (except to enforce the free tier), your device's network details including IP address, telemetry, and local VPN app logs. The VPN FAQ adds session information, including connection timestamps and number of sessions.

Jurisdiction is mixed. The VPN belongs to Malwarebytes, a US company based in Santa Clara, California, and runs on infrastructure from Swedish-founded AzireVPN. Each server must comply with the law of the country it sits in. Malwarebytes also points to AzireVPN's annual transparency reports and monthly warrant canary.

The X41 D-Sec audit

In April 2026 Malwarebytes published what it called "our first-ever third-party audit for the infrastructure that now powers both Malwarebytes Privacy VPN and AzireVPN". The work was a white-box penetration test by X41 D-Sec: 23 person-days between December 1, 2025 and January 9, 2026, with the final public report dated March 31, 2026.

• Rated findings: 2 Critical, 0 High, 2 Medium, 2 Low (the full report counts 14 issues in total)
• Auditors "did not observe evidence of user activity logging"
• Critical (CVSS 9.4): Debian image checksum signature not validated - fixed
• Critical (CVSS 9.3): unsigned PXE boot - still being addressed at publication

Read that carefully. It is an infrastructure security test that found no evidence of activity logging, which is useful, but it is not a formal no-logs certification. Two Critical findings in a first audit are also a reminder that the platform was young. Publishing them openly is to Malwarebytes' credit; we could not confirm whether the PXE boot issue has since been closed.

Apps and features

The VPN is part of the Malwarebytes app on Windows, macOS, Android and iOS. Windows 10 and 11 are supported on both Intel and ARM, macOS goes back to Big Sur 11, Android needs version 10 or newer, and iOS and iPadOS need version 18 or 26. ChromeOS is not supported, and there is no Linux app, router setup or VPN browser extension. Browser Guard, Malwarebytes' extension, blocks ads and scams but is not a VPN.

Kill switch and auto connect

On Windows and Mac the Kill Switch is disabled by default and can only be turned on once Auto connect is enabled. On Android, Malwarebytes relies on the system's own "Block connections without VPN" setting instead.

Split tunnelling and connection rules

Android has split tunnelling by app. Windows and Mac get connection rules by application or IPv4 address, plus port rules on Windows only. iOS documents just Auto Connect and "Trust local devices", so there is no split tunnelling on iPhone or iPad.

What is missing

We found no documentation of obfuscation or a stealth mode, dedicated IPs, port forwarding, a stated P2P or torrenting policy, or built-in ad and tracker blocking (the bundles cover that with Browser Guard). Multi-hop existed before the AzireVPN switch and was removed in January 2026.

Streaming

Malwarebytes says the VPN helps you reach sites and streaming services restricted in your region, but its help centre warns that some services block VPN users for security, copyright or licensing reasons. Treat streaming as a maybe, not a feature.

The new 10 GB limited VPN

Since August and September 2026 Malwarebytes has been rolling out a limited VPN to users without the full version. Android 5.28 (August 17, 2026) added it for Standard plan users, and Windows 5.7.0 (September 8, 2026) brought it to Free and Standard users, rolling out gradually.

• 10 GB of data every 30 days, after which speed is "significantly" reduced rather than cut off
• Fewer servers than the full list
• Data allowance is per account, not per device, and resets 30 days after you turn the VPN on
• Mac and iOS support is marked "coming soon"

It is a reasonable taste of the service, but the throttling and reduced server list make it a trial, not a replacement for a paid plan.

Pricing and plans

All prices below are US prices read from Malwarebytes' pricing page and its own pricing data on October 2, 2026. Pricing is localised by country, so you may see different figures. There is no monthly plan.

Standalone Privacy VPN

• 1 device: $39.99 for 12 months, $79.98 for 24 months
• 2 devices: $47.99 for 12 months, $95.98 for 24 months
• 3 devices: $49.99 for 12 months, $99.98 for 24 months
• 4 devices: $57.99 for 12 months, $115.98 for 24 months
• 5 devices: $59.99 for 12 months, $119.98 for 24 months

Malwarebytes does not label these as introductory or renewal prices, and the 24-month price is simply twice the 12-month one, so there is no multi-year discount. In the UK the standalone VPN ranges from £29.99 to £42.99 a year, and oddly the 3-device and 5-device tiers there cost less than the 2-device and 4-device ones.

Bundles

A sale running through October 11, 2026 cuts first-year bundle prices by up to 50%. After the first year the list price applies.

• Standard (device security, limited VPN only): $35.99 first year, then $59.99, 3 devices
• Plus (device security and full VPN): $47.99 first year, then $79.99, 3 devices; $89.99 then $149.99 for 10 devices
• Ultimate (adds identity protection): $139.99 first year, then $279.99, 1 adult and 3 devices; family plan $199.99 then $399.99

Existing Malwarebytes customers can add the VPN without extending their subscription; they pay the difference for the remaining time. The product page mentions covering up to 20 devices, but consumer plans top out at 5 devices standalone and 10 on Plus; 20 devices applies to the business Small office plan.

Who should buy it

Malwarebytes Privacy VPN makes the most sense for people who already use, or want, Malwarebytes antivirus. The Plus bundle gives you a clean WireGuard VPN with a credible privacy story for little more than the antivirus alone, and everything is managed from one app.

Look elsewhere if you need Linux or router support, obfuscation for restrictive networks, port forwarding, dependable streaming unblocking, or full features on iOS. Privacy purists who want a non-US company and a long audit history also have stronger options.

Frequently asked questions

How much does Malwarebytes Privacy VPN cost?

In the US the standalone VPN costs $39.99 a year for 1 device up to $59.99 a year for 5 devices. The Plus bundle, which adds antivirus, is $47.99 for the first year on 3 devices during the current sale, then $79.99.

Is there a free version?

Yes, a limited one. Free and Standard users on Windows and Android get 10 GB every 30 days on fewer servers, with speed sharply reduced after the cap. It is rolling out gradually, and Mac and iOS are listed as coming soon.

Does Malwarebytes VPN keep logs?

Its privacy policy says it does not collect browsing history, DNS requests, your IP address, session timestamps or app logs. It does keep a license key, a unique identifier and app version, and on the free tier it counts total GB per account. The 2026 X41 D-Sec audit found no evidence of user activity logging, though that is not a formal no-logs certification.

Does it work on Linux, routers or Chromebooks?

No. Apps exist for Windows, macOS, Android and iOS only. Malwarebytes states ChromeOS is not supported, and we found no Linux, router or VPN browser-extension option.

Does it have a kill switch?

Yes on Windows and Mac, but it is off by default and requires Auto connect to be enabled first. On Android you use the system's "Block connections without VPN" setting.

Can I get a refund?

Malwarebytes' pricing page promises a 60-day money-back guarantee for direct purchases. The help centre defers to the license agreement for details, and subscriptions bought through Google Play or the App Store follow those stores' refund rules instead.

Who runs the VPN servers?

AzireVPN, a Swedish-founded provider Malwarebytes bought in November 2024. Since January 2026 the Malwarebytes apps connect to AzireVPN's self-owned, RAM-only WireGuard servers.

Key takeaways

• Malwarebytes Privacy VPN now runs on AzireVPN's self-owned, RAM-only WireGuard network with 150+ servers in 60+ locations.
• An X41 D-Sec audit published in April 2026 found no evidence of activity logging but flagged two Critical infrastructure issues, one still open at publication.
• Standalone US pricing runs $39.99 to $59.99 a year; the Plus bundle at $47.99 first year (then $79.99) is the better deal.
• A 10 GB per 30 days limited tier is rolling out to Free and Standard users on Windows and Android.
• No Linux, router, ChromeOS, obfuscation, port forwarding or multi-hop, and iOS lacks split tunnelling.