Practical guide · verified against the real thing
Which VPN subscription is worth paying for? Read the contract, not the ad
In one line: Introductory prices are instalment arithmetic on a lump sum; renewals are the real product. Five VPN contracts compared on their own published terms - entry charge, renewal jump, device limits, refund catches, free tiers - plus the payment rails that work from Nigeria and four jurisdictions where the rules change.
Open five VPN pricing pages and you get five ads. Open five renewal invoices and you get the actual product. This guide reads the second document: what each contract charges on day one, what it charges on day 731, how many devices it covers, what the refund window really excludes, and which payment rails actually work from a Nigerian bank account. The threat model — what a tunnel does and does not protect — already lives on VPNs explained: what they protect and what they don't; this page is about the money.
The answer, before the pricing table
Most people reading this do not need a monthly VPN subscription, and some do not need a paid one at all. Roughly 99 per cent of Chrome page loads already happen over HTTPS according to Google's Transparency Report, so the padlock on the site you are visiting is doing the content-encryption job for free. A paid VPN earns its keep in the gaps HTTPS leaves: networks you do not control (hotel, airport, café and conference Wi-Fi, where CISA's wireless security guidance still warns that many public access points carry unencrypted traffic that sniffing tools can read), the metadata your ISP collects about which services you use and when, and censorship or blocking at the network level where local law permits circumvention.
If you do pay, the shape of the good deal in September 2026 is: the cheapest core tier (VPN only, no antivirus-identity-bundle upsell) on a two-year introductory term, sized to your real device count, bought through a payment rail that will not decline, with the renewal date in your calendar before the app is installed. Concretely, the entry charges on the providers' own pages on 16 September 2026 were Surfshark Starter at $67.23 for the first 27 months, ExpressVPN Basic at $83.72 for the first 28 months, NordVPN Basic at $94.23 for the first 27 months, Proton VPN Plus at about $71.76 for 24 months, and Mullvad at a flat €5 per month with no introductory term at all. The advertised monthly equivalents — $2.49, $2.99, $3.49, $2.99 — are instalment arithmetic on a lump sum, not a price you can pay month to month.
And the number the ads bury: what happens at renewal. NordVPN Basic renews at $139.08 a year, about 3.3 times the introductory monthly rate. ExpressVPN Basic renews at $99.95 a year. Surfshark Starter renews at $79.00 — and a two-year subscription renews as a one-year term at that price, per Surfshark's own renewal-pricing terms. Proton VPN Plus renews at about $83.88 a year. Mullvad renews at €5, because there is nothing to renew into. Buy the intro price with your eyes open about the second invoice, or buy the flat price and skip the game.
What the subscription actually buys, and what HTTPS gives you free
A VPN subscription rents you an encrypted tunnel from your device to a server the provider runs, plus one of that server's IP addresses. Inside the tunnel, the local network — the hotel Wi-Fi, the campus router, the ISP behind it — sees encrypted packets and nothing else. Outside it, the provider sees everything your ISP used to see. That trade is the whole product: you are not removing a vantage point, you are moving it from an ISP you did not choose to a company you did.
What HTTPS already covers, for free, is the content of your traffic to any site that serves it: Google's Transparency Report measures about 99 per cent of Chrome page loads encrypted, Cloudflare Radar measures 98.6 per cent of human requests on its network, and even the strictest denominator — W3Techs' share of websites whose default protocol is HTTPS — sits near 90 per cent. A VPN adds nothing to a bank login that HTTPS was not already protecting end-to-end.
What the tunnel adds is the rest: on an open or hostile network, encryption of the packets themselves and of your DNS queries, which CISA's wireless guidance treats as the reason to use a VPN on public access points; hiding which services you use from whoever owns the local network; a server in another country when you are travelling and a service you rely on is geo-blocked or throttled; and a stable exit IP when your mobile connection drops and reconnects behind a new carrier address every few minutes. What it does not add is protection against malware, phishing, reused passwords, or a breach at the service you are logged into — the list of广告-free realities that the threat-model piece goes through in full — the unglamorous list of things a tunnel changes nothing about — including why a free VPN whose business model is you is the one purchase this desk argues against hardest.
One caveat that surprises people: your bank may treat a foreign exit IP as a fraud signal. Logging into a Nigerian banking app over a European server can trigger step-up verification or a blocked login. That is the bank working as designed, not the VPN failing. Route banking traffic outside the tunnel (every provider here offers split tunneling or a per-app exclusion) or disconnect before you bank.
The five contracts, side by side
Read on 16 September 2026, from each provider's own pricing page and terms. Introductory charges are lump sums for the whole first term; the "per month" figure each provider advertises is that lump sum divided by the term, including the bonus months.
| Provider and entry tier | Introductory charge | Renewal after the intro term | Simultaneous devices | Refund window, and the catch | Free tier |
|---|---|---|---|---|---|
| Surfshark Starter | $67.23 for the first 27 months (advertised $2.49/mo, +3 extra months); 7-day free trial, card or PayPal only | $79.00, and a 2-year plan renews as a 1-year term; 30 days' email notice before renewal | Unlimited | 30 days; the trial converts to a paid charge if you do not cancel first | None |
| ExpressVPN Basic | $83.72 for the first 28 months (advertised $2.99/mo, +4 extra months) | $99.95/year | 10 (12 on Advanced, 14 on Pro) | 30 days, new users only — the guarantee text on the pricing page is limited to first-time users | None |
| NordVPN Basic | $94.23 for the first 27 months (advertised $3.49/mo, +3 extra months); $14.99/mo month-to-month | $139.08/year | 10, with at most 5 on one server and protocol | 30 days on every plan, no first-user limitation on the page | None |
| Proton VPN Plus | About $71.76 for 24 months (advertised $2.99/mo); $9.99/mo month-to-month | About $83.88/year | 10 | 30 days | Yes: 1 device, medium speed, 10 countries chosen at random, no card required |
| Mullvad | No intro term: a flat €5/month, paid monthly | €5/month — there is no renewal jump because there is no intro price | 5 | 14-day money-back guarantee, excluding cash and crypto payments | None, but accounts are anonymous numbers: no email, no name |
Three footnotes that matter more than the sticker prices. First, payment rails differ: NordVPN's pricing page is titled around card, crypto and PayPal; ExpressVPN's around PayPal and credit card; Surfshark's free trial accepts only a credit card or PayPal; Mullvad's pricing FAQ lists cash, Bitcoin, Bitcoin Cash, Monero, bank wire, card, PayPal, Swish, EPS, Bancontact, iDEAL and Przelewy24. Second, Surfshark's renewal-pricing terms disclose that displayed renewal prices may be subject to A/B price testing — the renewal figure you are shown is not necessarily the renewal figure the next visitor is shown. Third, Surfshark's currency policy charges most of the world, Nigeria included, in USD: whatever your bank's conversion rate and markup are on the day is part of the price you actually pay.
The renewal jump: what three years really cost
Rank these deals by the introductory number and Surfshark wins. Rank them by what 36 months actually costs at published renewal prices and the order changes, which is the point of doing the arithmetic:
| Contract | First term | Renewal charged inside 36 months | 36-month total | Effective per month | Renewal jump vs intro rate |
|---|---|---|---|---|---|
| Surfshark Starter | $67.23 (27 months) | $79.00 at month 27, buying 12 more months | $146.23 (covers 39 months) | $4.06 | 2.6× |
| ExpressVPN Basic | $83.72 (28 months) | 8 of 12 months of $99.95 = $66.63 | $150.35 | $4.18 | 2.8× |
| Proton VPN Plus | $71.76 (24 months) | $83.88 at month 24 | $155.64 | $4.32 | 2.3× |
| NordVPN Basic | $94.23 (27 months) | 9 of 12 months of $139.08 = $104.31 | $198.54 | $5.51 | 3.3× |
| Mullvad | €5 × 27 = €135 | €5 × 9 = €45 | €180 | €5.00 | 1.0× |
Two things fall out of that table. One: over three years the spread between the cheapest and the dearest entry contract here is about $52 — real money, but not the $250 spread the introductory stickers imply, because renewals compress the difference. Two: the introductory discount is a loan you repay in year three. NordVPN's 3.3× jump is the price of that loan; Mullvad's flat €5 is what it looks like when a provider refuses to offer the loan at all. Neither is dishonest, but only one of them surprises you.
There is also a case for paying monthly, and it is arithmetic rather than loyalty: NordVPN's month-to-month Basic is $14.99, so the $94.23 two-year lump sum only starts winning after about six and a half months of continuous use ($94.23 ÷ $14.99 ≈ 6.3). If your real need is a three-week trip, a conference season, or a single project, the monthly plan — or Proton's free tier on one phone — is the cheaper contract. The two-year deal is a bet that you will still want this in 2028; make it deliberately.
Paying from Nigeria: the rails that actually work
Until July 2025 this section would have been a list of workarounds, because naira-denominated debit cards had been suspended for international transactions for roughly three years under the foreign-exchange restrictions. Banks including GTBank and UBA re-enabled international usage on naira cards in early July 2025, with per-bank spending caps — reporting at the time described GTBank's initial ceiling as $1,000 per quarter across all international transactions, with other banks setting their own limits — so a $3–5 monthly charge or even a $67–$121 two-year lump sum fits inside the cap, but the cap is one more reason a declined charge is not necessarily the VPN's fault.
The currency layer sits on top: Surfshark's published currency list charges Nigeria in USD, and NordVPN and ExpressVPN price in USD, so a naira card pays the lump sum plus whatever conversion rate and markup your bank applies on the day — and again at every renewal. A domiciliary-account dollar card, or a virtual USD card from a licensed Nigerian provider, removes the double conversion and, usefully, lets you set a hard card limit at exactly the renewal price so a surprise charge cannot exceed it.
PayPal deserves its own warning. Nigerian personal PayPal accounts are send-only — fine for buying a subscription, which is sending — but naira cards are widely reported as unreliable when linked to PayPal, with USD virtual or domiciliary cards the recommended funding source. That matters here because two of the five contracts route through PayPal: ExpressVPN's checkout and Surfshark's card-or-PayPal trial. If your only rail is a naira card that PayPal declines, the providers whose checkouts take cards directly (or crypto, below) are the ones that will actually activate.
Which brings up the rail nobody advertises to Nigerians and everybody offers: crypto. Mullvad accepts Bitcoin, Bitcoin Cash and Monero alongside cash by post; NordVPN's pricing page leads with card, crypto or PayPal. For a subscriber whose card declines twice a year at renewal, a crypto payment is not ideology, it is continuity. Note the trade: Mullvad's 14-day money-back guarantee explicitly excludes cash and crypto payments, so the anonymous rails are also the non-refundable ones.
Four jurisdictions, four different rules
No sentence about VPN legality is true everywhere, so this desk will not write one. Four data points, each with its instrument:
Nigeria. No law bans VPN ownership or use. The relevant statute for online conduct is the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, whose broadly worded provisions — section 24 on offensive messages, section 38 on two-year data retention by providers — apply to what you do, not to the tunnel you do it through. The cautionary episode is June 2021: during the suspension of Twitter, the office of the Attorney-General of the Federation threatened prosecution of anyone using a VPN to circumvent the ban, while digital-rights experts publicly disputed that such use was an offence. The practical reading: the tool is legal; using it to defeat a specific, live regulatory order is where the risk concentrated, and that risk was contested even then.
Russia. Federal Law No. 276-FZ, adopted 29 July 2017 and in force from 1 November 2017, does not criminalise using a VPN. It obliges VPN and anonymiser operators to block access to websites prohibited in Russia, and authorises Roskomnadzor to block services that refuse — a law aimed at the provider's routing table rather than at the user, with the user-facing consequence that compliant VPNs are useless for blocked content and non-compliant ones get blocked at the ISP.
United Arab Emirates. Federal Decree-Law No. 34 of 2021 on combating rumours and cybercrimes punishes, in Article 10 as quoted by legal commentary in 2025–2026, whoever "frauds a computer network protocol address by using an address belonging to a third party or by any other means for the purpose of committing a crime or preventing its discovery" with imprisonment and a fine of AED 500,000 to AED 2,000,000. The VPN itself is lawful — corporate VPNs are everywhere in the UAE — and the offence is the spoofed address in service of a crime, which in practice is how prosecutions for reaching blocked services are framed.
China. The Ministry of Industry and Information Technology's notice of January 2017, effective immediately, requires government approval to establish or lease cross-border channels including VPNs, and ran a rectification campaign through March 2018 that made most consumer VPN services unlicensed overnight. Enforcement has fallen on providers and on individuals using unapproved channels, with fines and device confiscation reported in commentary as recently as 2026.
The operative habit: a subscription bought in Lagos carries Lagos's rules until you land somewhere else, and then it carries that country's. Check the law where you are standing, not where you paid.
Streaming: what the providers claim, what the terms say
Proton's own pricing page lists "Stream your favorite TV shows and movies" as a Plus feature, and the rest of the market implies the same. The counterweight is contractual: Netflix's Terms of Use limit viewing to the country where you established the account and to locations where Netflix offers and has licensed the content, and bind you not to circumvent its content protections — which is what a VPN exit in another country is. Enforcement, in practice, is aimed at servers rather than subscribers: reported experience as of mid-2025 is that Netflix blocks detected VPN IP addresses (falling back to its globally licensed originals) rather than banning accounts.
So treat streaming support as an arms race you are renting into, not a right you are buying. Never choose a tier or pay a premium for it; if a provider's servers win this month, that is a bonus. And note the direction of the legal risk in the four jurisdictions above: in places like the UAE, circumventing blocked services is exactly the fact pattern the penalty articles describe.
Free vs paid, settled in one paragraph
Proton's free tier is the honest version of the category: one device, medium speed, ten countries chosen at random, no card required, from a provider with a published no-logs posture and a paid tier it would like to upgrade you to. That is a legitimate product for one phone on occasional hostile Wi-Fi. What free tiers cannot do is cover a household (one device), let you pick an exit country (random selection), or sustain daily use at full speed — and outside the audited providers, the free-VPN business model is the warning this desk repeats until it is boring: if the tunnel is free, the commodity is your traffic, which is the one thing the tunnel existed to protect. Paid starts making sense at two devices, a needed exit country, or daily use; below that threshold, the free tier or nothing is the correct purchase.
The decision, in order
One: the need test. Hostile Wi-Fi most weeks, ISP-level blocking or throttling you care about, or regular travel? If none, do not buy; HTTPS and the free tier cover the residue. Two: count devices, then match the limit — unlimited (Surfshark), 10 (Nord, Proton, Express Basic), 5 (Mullvad), remembering that a router connection consumes one slot and covers everything behind it. Three: do the 36-month arithmetic above, or run your own numbers in the calculator below; rank by effective monthly, not by sticker. Four: use the refund window as the trial — 30 days at Surfshark, Nord and Proton, 30 days for new users only at ExpressVPN, 14 days excluding cash and crypto at Mullvad — and test on the networks you actually use, not on your home fibre. Five: pick the rail before the plan: naira card with the international function confirmed and a cap you know, domiciliary or virtual USD card for the cleanest conversion, crypto where refunds are not the priority. Six: on the day you buy, calendar the renewal — Surfshark emails 30 days before, the others are your problem — and decide at that date whether the service earned its standard rate or whether you re-enter at a new introductory price elsewhere. Seven: re-check the jurisdiction before you travel with it.
Run your own numbers
The table above is five specific contracts; yours is one. The VPN true-cost calculator takes the four numbers that matter — the introductory lump sum, how many months it buys, the annual renewal price, and how long you realistically expect to keep the service — and returns the total, the effective monthly rate, the renewal jump as a multiple, and the month count at which paying monthly would have been cheaper. It runs entirely in your browser, like every tool on this desk, and it will not flatter the deal you came in hoping to justify.
Related on this desk.
VPNs explained: what they protect and what they don't is the threat-model half of this decision, including the free-VPN warning in full. How to actually audit every subscription you're paying for is where a VPN renewal should show up before it silently doubles. Which password manager fits you? covers the other half of account security that no tunnel touches, and the mobile-data guide is the companion piece for anyone whose VPN traffic mostly rides a Nigerian data bundle.
Sources
- NordVPN — pricing page (Basic/Complete/Prime introductory charges for 27-month and 12-month terms, $14.99/$19.99/$29.99 monthly, renewal prices $139.08/$219.48/$296.28 per year, 30-day money-back guarantee, card/crypto/PayPal checkout; read 16 September 2026)
- NordVPN support — How many devices can I use with NordVPN? (10 simultaneous devices per account, five per server and protocol, router slot)
- Surfshark — pricing page (Starter $67.23 / One $75.33 / One+ $121.23 for the first 27 months, 7-day free trial on card or PayPal, unlimited simultaneous devices, 4,500+ servers in 100 countries, US-only identity-theft coverage, Incogni limited to US/UK/EU/CH/CA; read 16 September 2026)
- Surfshark — Billing Practices, Currency Policy & Renewal Prices (Starter renews at $79.00 as a 1-year term, One $99.00, One+ $119.00; 30-day renewal email notice; disclosed A/B price testing on displayed renewal prices; USD charging for unlisted regions including Nigeria; read 16 September 2026)
- ExpressVPN — pricing page (Basic $83.72 / Advanced $111.72 / Pro $167.72 for the first 28 months, renewals $99.95/$119.95/$199.95 per year, 10/12/14 simultaneous devices, 113 countries, 30-day money-back guarantee for new users, PayPal and credit card checkout; read 16 September 2026)
- Proton VPN — pricing page (Free tier: 1 device, medium speed, 10 randomly selected countries, no credit card; Plus: 10 devices, 20,000+ servers in 140+ countries, streaming and NetShield included, 30-day money-back guarantee; prices rendered client-side; read 16 September 2026)
- vpnpro — Proton VPN pricing tracker (Plus 2-year at $2.99/mo, $71.76 for the term, renewing at $83.88/year; $9.99 monthly; prices checked September 2026)
- Mullvad — homepage and pricing FAQ (flat EUR 5 per month, anonymous account numbers with no email, 5 devices per account, payment methods: cash, Bitcoin, Bitcoin Cash, Monero, bank wire, card, PayPal, Swish, EPS, Bancontact, iDEAL and Przelewy24; read 16 September 2026)
- Mullvad help — Account and payments FAQ (14-day money-back guarantee, except cash payments under anti-money-laundering regulations and crypto payments)
- TechnologyChecker — HTTPS Adoption 2026 reconciliation, 3 September 2026 (Google Transparency Report at about 99% of Chrome page loads, Cloudflare Radar at 98.60% of human requests, W3Techs at about 90% of websites)
- CISA — Security Tip ST05-003, Securing Wireless Networks (revised 15 November 2019): many public access points are not secured and carry unencrypted traffic, sniffing tools can capture passwords and card numbers, use at least WPA2 and a VPN on public networks)
- Netflix — Terms of Use (viewing limited to the country where the account was established and to locations where Netflix offers and has licensed the content; agreement not to circumvent content protections)
- Privacy Journal — How to Get Around the Netflix VPN Ban, 22 June 2025 (enforcement by blocking detected VPN server IPs and falling back to globally licensed originals, rather than banning subscriber accounts)
- Human Rights Watch — Russia: New Legislation Attacks Internet Anonymity, 1 August 2017 (Law No. 276-FZ prohibits VPN operators from providing access to websites banned in Russia; Roskomnadzor blocking powers)
- Gowling WLG — New restrictions for VPNs and anonymisers in Russia (276-FZ adopted 29 July 2017, in force 1 November 2017; the law does not prohibit use of anonymisers per se but regulates providers and recordal)
- Caixin Global — China Tells VPN Service Providers to Get Approval to Operate, 23 January 2017 (MIIT notice effective immediately, prior approval required for VPN services and dedicated channels, rectification campaign to March 2018)
- LegalClarity — Is Using a VPN Illegal in China?, 15 April 2026 (enforcement against individual users of unapproved channels: fines and device confiscation; MIIT classifies VPNs as a Class I value-added telecom service)
- GetGulf VPN legal summary — Is VPN Legal in UAE? 2026 Laws Explained, 11 July 2026 (Federal Decree-Law No. 34 of 2021, Article 10: imprisonment and a fine of AED 500,000 to 2,000,000 for fraudulently using a network protocol address to commit or conceal a crime; VPN use itself not banned)
- BusinessDay — Nigerian govt hunts for VPN users as Twitter ban kicks off, 5 June 2021 (Attorney-General's office threatens prosecution of VPN use to circumvent the Twitter suspension; digital-rights experts dispute the legality of that position)
- Freedom House — Freedom on the Net 2022: Nigeria (Cybercrimes (Prohibition, Prevention, ETC.) Act 2015: section 24 offensive-message provisions, section 38 two-year traffic-data retention; arrests of users for online activity)
- Nairametrics — GTB, UBA resume international transactions on naira cards with varying spending limits, 4 July 2025 (naira-card international usage re-enabled after nearly three years; per-bank caps, GTBank's initial ceiling reported at $1,000 per quarter)
- The Nation — CBN reforms drive naira recovery, restore card use abroad, 16 July 2025 (banks lift the three-year moratorium on naira-funded debit cards abroad; dollar-funded domiciliary cards unaffected throughout)
- Paycape — How to Create a PayPal Account in Nigeria, 26 February 2026 (Nigerian personal PayPal accounts are send-only; naira Mastercard and Verve cards frequently declined; USD virtual or domiciliary cards recommended)
Next