CyberGhost VPN Review

0 User Reviews

Video Review

CyberGhost have some great features which we cover in our handy video review - check it out!

Alternative Choices for You

If you're looking for more information, why not compare CyberGhost and ExpressVPN side-by-side?

Pricing

CyberGhost VPN users are offered a steep reduction in price for purchasing longer-term subscriptions, but plans are otherwise identical. A 1-day free trial is on offer, although finding it on the website is not always easy. There is also a very generous 45-day VPN money-back guarantee.

CyberGhost VPN accepts payment via credit/debit card, PayPal, or direct debit. Additional payment options may be available depending on your country of residence. Those looking for privacy can pay in Bitcoin although remember that no matter how anonymously you pay a VPN company will know your real IP address.

Payments are processed by third party services such as Cleverbridge, Stripe, and PayPal. Bitcoin payments are processed by BitPay.

Features

With over 5,700 servers in over 90 countries, you are never going to be short of a handy server to connect to! And this figure is all the more impressive when you consider the fact that all these servers are bare-metal single occupancy machines which are firmly under the control of CyberGhost’s staff.

Allowing up to seven devices to connect at once is generous. CyberGhost VPN permits torrenting on many of its servers, including a large fleet of servers in Montreal, specifically configured to provide fast torrenting for users in North America.

“Connection features”

The CyberGhost VPN clients offer a number of special “connection” features. Block ads, Block Malicious Websites, and Block Online Traffic use DNS blocklists to protect your device from various threats.

Automated HTTPS is basically an implementation of the famous open source HTTPS Everywhere browser add, which ensures a secure HTTPS connection is established if the domain supports HTTPS on any level.

Data compression reduces your bandwidth usage and can therefore be useful (depending on what you download), but it should be noted that many VPN services enable data compression by default without feeling the need to mention it.

“Smart rules”

“Smart rules” cover a number of features that are available in some of CyberGhost VPN apps, but not others.

• WiFi protection (Windows, macOS, Android, iOS) - detects when you connect to an unknown network and can automatically turn on your VPN, ask what to do, or never protect, as you specify.
  

   

• Exceptions (Windows, Android, iOS) – also known as split-tunneling, this feature allows you to exclude some websites from the VPN. This is very useful, for example, if you usually connect to a VPN server overseas but wish to connect to local versions of some websites without disconnecting the VPN.
• App protection (Windows, Android) – auto-launches CyberGhost and automatically connects to a specified server whenever you open named apps. So you could set this up to auto-connect to the US Netflix server every time you open the Netflix app.

Does CyberGhost unblock Netflix?

CyberGhost runs streaming servers that are specially optimized to unblock over 35 popular streaming services. These include Fox Sport in Brazil, Comedy Central, YouTube in various countries, Netflix in various countries, and many more. It even unblocks Disney+ from anywhere in the world, despite its US-only availability at launch. Unfortunately, the service has been hit-and-miss when it comes to BBC iPlayer. It used to flawlessly grant access to the British platform, but has since become distinctly unreliable.

We didn’t test them all, but the US Netflix servers worked a treat.

Speed and performance

Speed

A weighted average download speed of 58.51 Mbits/s puts CyberGhost VPN at the lower end of our results table, which is a little unfair since the completion around that speed mark is very fierce with less than a Mbit/s or two separating many providers.

Again, it not at the top of our list, but CyberGhost VPN’s max burst speed result of 556.2 Mbit/s means that if you connect to a server in the same continent as yourself then your will see minimal slowdown on even the fastest home internet connection.

DNS lookup and connection times are similarly middle-of-the-road, which these days means they are still pretty fast!

Leak tests

We encountered no leak problems with the macOS client, although we did detect WebRTC IPv6 leaks in the Windows client. In the Windows client settings, you can disable IPv6 to fix this, although we can’t for life of us think why IPv6 is not disabled by default.

We cannot test mobile apps for IPv6 problems at the present time but detected no leaks of any kind over an IPv4 connection.  The CLI Linux app provides no DNS or WebRTC leak protection.

Please see our Complete guide to IP leak protection for information on this subject.

Ease of Use

You can sign-up for an account on the website or take advantage of the card-free 24-hour free trial first. We have to say the trial can be a little elusive – sometimes it’s advertised, sometimes it’s not. If you can download the software then the trial is automatically included, but we often found it hard to find direct download links.

Clicking on the free trial for macOS can also lead to a Windows .exe file being downloaded, requiring you to chase through the CyberGhost VPN help pages to find a .pkg download for macOS.

If you already have an account (which you can also sign-up to in-app from the Android and iOS apps), or once you have tracked down the Windows or macOS free trial download, the entire process is very easy.

CyberGhost VPN has custom apps for Windows, macOS, Android, and Android TV/ Amazon Fire TV. It also offers a command-line (CLI) app for Linux and free browser extensions for Chrome and Firefox. Manual setup guides are provided for a range of other devices such as DD-WRT and Tomato routers, Raspberry Pi, and Chromebooks.

The Windows client

When you start the client for the first time CyberGhost VPN offers some simple guides to using the VPN for surfing “anonymously”, torrenting, and streaming.

Note that using a VPN does not provide real anonymity because your VPN provider always know who you are. That aside, the guides provide a simple newbie-friendly explanation of how to use the VPN.

CyberGhost VPN has definitely upped the game with its CG7 client in terms of aesthetics. It looks good and is easy to navigate. You can let the app choose a nearby server for you, or you can expand the app to access the full interface. 

From here you can select a country or individual server within a country based on distance and load. You can also select servers that have been optimized for torrenting and streaming.

The Windows app features every “Connection feature” and Smart rule” on offer. By default, the CyberGhost uses the OpenVPN protocol, but you can instead choose IKEv2 or L2TP/IPsec.

OpenVPN users can switch from UPP to TCP, which can be useful for evading moderate VPN blocks. The client also offers a random port scanning feature to OpenVPN users, which can also be useful for evading casual VPN blocks.

IPv4 DNS leak protection and a kill switch are enabled by default, although for reasons which are not clear IPv6 connections are not blocked by default. As already noted, IPv6 should be disabled in Settings to prevent IPv6 leaks in Windows.

We ran some tests on the kill switch to determine that it works at the system firewall level. This is good because even if both the VPN client and the OpenVPN daemon (if used) crash, your IP address will not become exposed.

The macOS client

As should be clear from screenshots earlier in this article, the macOS client is very similar to the Windows one. A system-level kill switch and effective IPv4 and IPv6 DNS leak protection are sensibly baked-in, rather than being a user-configurable option.

The Mac app uses IKEv2. All “connection features” are present and correct, although the only “smart rule” available is WiFi protection.

The Android app

The Android app uses OpenVPN, and like its Windows sibling supports “Use TCP” and random port selection. It also supports all “Connection features,” plus the WiFi Protection and Exceptions “Smart rules.”

There is no user-selectable kill switch setting, but CyberGhost VPN tells us that a kill switch is built-in.

 There is no kill switch, although Android 7+ comes with a built-in kill switch that works with any VPN app.

The iOS app

Unsurprisingly, the iOS app looks very similar to the Android app. Under the good, though, it uses the IKEv2 protocol rather than OpenVPN. This is absolutely fine. IKEv2 is widely considered very secure and has performance advantages over OpenVPN.

“Connection features” and most “Smart rules” are not present in the iOS app, although WiFi Protection and a built-in kill switch are.

Linux

CyberGhost’s Command-line Linux client is little more than the open-source OpenVPN client preconfigured to use CyberGhost’s servers. This does, however, provide real convenience over downloading and running the .ovpn files manually.

The client is available for Ubuntu and Fedora, and appears to be optimized for different versions of those distros. The DEB and RPM packages should work on any systems that support those distribution formats, though.

Browser add-ons

The browser apps for Firefox and Chrome are available for free to everyone, and having a CyberGhost account does not improve their functionality. There are only four proxy server locations available: Germany, Netherlands, Romania, and the United States.

They simple HTTPS proxies. As such, they will spoof your location and protect your data with HTTPS encryption at the click of a button. They do provide any WebRTC protection, however.

Customer Service

The website hosts extensive setup guides, plus numerous other articles and guides on many aspects of VPN use (although some are a little outdated). There is also 24/7 live chat and email support in English, German, French, and Romanian, which responds quickly and fielded all the questions we asked of it.

Privacy and Security

Jurisdiction

CyberGhost is a Romanian company which is now owned by Kape Technologies.

Romania is generally considered to be privacy-friendly.  Romanian courts struck down the EU Data Retention Directive on constitutional grounds long before it was declared illegal by the European Court of Justice. It is also not a 14-Eyes spying alliance nation and has no known ties to the NSA.

According to its TOS, “the relationship between you and KAPE shall be governed by and construed in accordance with the laws of England.” The UK is a founding member of the NSA-led Five Eyes spying alliance and home to some of the most extreme mass surveillance legislation ever enacted. 

Logs

“When using the CyberGhost VPN, the user's traffic data such as browsing history, traffic destination, data content, and search preferences are not monitored, recorded, logged or stored by the Company. More than this, when using the CyberGhost VPN, we are not storing connection logs, meaning that we don't have any logs tied to your IP address, connection timestamp or session duration.”

So CyberGhost VPN easily qualifies as no logs VPN, although some aggregate metadata is sent anonymously to third-party services (MixPanel) for trend analysis.

More concerning is that CyberGhost VPN performs a considerable amount of web tracking on visits to its site, which it shares with a number of third parties (although we didn’t spot any Google Analytics trackers). This kind of tracking has no effect on the privacy of VPN sessions, though,

Technical security

The Windows app uses the IKEv2protocol by default, although you can switch to OpenVPN or IPsec. The Android app uses OpenVPN, while the macOS iOS apps uses IKEv2. CyberGhost uses the following OpenVPN settings:

Data channel: an AES-256-CBC cipher with SHA-256 hash authentication.

Control channel: an AES-256 cipher, RSA-4096 key encryption, and SHA384 hash authentication. Perfect forward secrecy is provided by an ECDH-4096 key exchange.

This is a very strong setup. And as already mentioned, CyberGhost VPN uses 100% bare metal servers, which is great news for privacy.

We recommend disabling WebRTC at the browser level as this is the only 100% guaranteed solution to WebRTC leaks, although CyberGhost’s apps prevented all forms of IP leaks, anyway. We do wish, however, that IPv6 was disabled in Windows by default.

Controversies

Under its previous name of Crossrider, Kape Technologies garnered an unsavory reputation as a malware merchant, a past that Kape has been keen to distance itself from:

“The decision to rename the company… was due to the strong association to the past activities of the company as well as the need to enhance the consumer-facing brand for the business.”

Kape’ largest shareholder, Teddy Sagi is a controversial figure who was named in the Panama papers. Also somewhat concerning are reports of past connections between Crossrider and Unit 8200, “the Israeli equivalent of the NSA or GCHQ.”

CyberGhost VPN has reached out to us on this point and is keen to stress that it is a Romanian company, operating under Romanian jurisdiction. Also that it publishes a transparency report.

Final thoughts

CyberGhost VPN is a fully-featured no logs VPN service. Its CyberGhost 7 software is elegant on all platforms, is very secure, unblocks just about everything, and depending on platform, features a host of useful bells and whistles.

The only important feature we would like to see in the future is more robust obfuscation technology capable of defeating VPN blocks in places such as China, Egypt, and Iran. But for the vast majority of users who don’t need this, CyberGhost VPN is a highly professional service that provides almost everything a VPN could want.