CyberGhost

Description

Robert Knapp started CyberGhost in Bucharest in 2011, and the service has since expanded to serving more than 38 million users worldwide. Kape Technologies, previously called Crossrider, bought the company in 2017 and has since rebuilt itself as a privacy-oriented software company, also owning ExpressVPN and Private Internet Access. Both of those brands still exist independently under the Kape umbrella, and CyberGhost has its own engineering team and infrastructure in Romania.

Romania is not located within the sphere of Five Eyes, Nine Eyes, and Fourteen Eyes intelligence sharing alliances, meaning that Romanian law does not require CyberGhost to collect and transfer user traffic data to foreign governments. The company first published a transparency report in 2011, making it one of the first VPN providers to do so, and switched to quarterly reporting in 2019. Each report outlines the number of DMCA complaints, law enforcement requests and reports of malicious activity that the service received during that period.

HOW IT WORKS

CyberGhost encrypts the user’s internet traffic and passes it through one of its servers before it gets to the destination. The destination site sees the IP address of the CyberGhost server instead of the user’s real address. This masks the user’s geographic location and protects the connection from being inspected on the local network — a good protection on public Wi-Fi, where other devices on the same network can try to intercept unencrypted traffic.

The client uses AES 256-bit encryption on OpenVPN connections, AES 128-bit on IKEv2, and ChaCha20 on WireGuard tunnels. WireGuard has become the protocol of default use in mobile apps due to its ability to connect faster and consume less battery compared to the older ones. Users can manually switch protocols or the client can choose the protocol automatically depending on the network conditions.

SERVER NETWORK

CyberGhost has servers in 100 countries in 126 locations, with no longer publishing the exact number of servers after a change that the company made in mid-2024. Third party estimates put the total at between 9,000 and 11,500 servers at a given time. The client shows a percentage of load for each country entry, so the user can choose a less congested server before connecting.

In addition to the regular pool, CyberGhost operates three categories of specialized servers. Streaming-optimized servers are targeted to specific platforms and are updated on a regular basis to keep ahead of IP blocks that are put in place by services such as Netflix, BBC iPlayer, and Disney+ to known VPN addresses. Torrenting-optimized servers explicitly permit P2P traffic and set favorable configuration for this use case. NoSpy servers are located on hardware CyberGhost owns and operates within their own facility in Romania, eliminating the variable of third party data center staff having physical access to the machines.

Users that require a static exit address can add a dedicated IP to any plan for an additional $2.50 per month. CyberGhost currently provides dedicated IPs in 21 countries. A dedicated IP decreases the rate of CAPTCHA challenges that shared IPs cause on search engines and aids with services that detect login attempts from frequently changing addresses.

PRIVACY AND AUDITS

CyberGhost’s no-logs policy says that CyberGhost does not log IP addresses, browsing history, DNS queries, traffic destinations, session timestamps, or connection durations. It does collect anonymized technical data such as version of app and connection attempt counts which it uses for diagnostics and cannot link to individual accounts.

Deloitte Audit Romania made two independent reviews of this policy. The first audit was in 2022 and the second in April 2024, covering the server infrastructure and IT management systems. Both of these audits found that CyberGhost’s systems functioned in accordance with its no-logs claims. The 2022 report can be requested by anyone, and the 2024 report is available to active subscribers via the account dashboard. A bug bounty program is an invitation for external security researchers to report vulnerabilities in the client and infrastructure.

In late 2024, there were reports of a leak of about 83,600 account passwords from a third-party breach. CyberGhost recommended users to change their passwords and said the leaked passwords were from outside sources and not from CyberGhost systems.

SECURITY FEATURES

The kill switch shuts off all internet traffic the instant the VPN tunnel falls, so the user’s actual IP address is not exposed in the event of a gap in reconnection. From a certain version on the kill switch works permanently and cannot be switched off, which eliminates the possibility of accidental browsing unprotected.

The content blocker filters DNS requests for domains related to ads, trackers, and malware on a network level before pages are loaded. The Force HTTPS option redirects any unencrypted request over the http protocol to the secure version of the same URL where available. Split tunneling allows the user to exempt certain applications or domains from the VPN tunnel, allowing the local network devices and services that require the real IP address to continue functioning, while everything else passes through the encrypted connection.

The Smart Rules automation system triggers certain VPN behaviors based on network conditions — for instance, to automatically connect to a selected server when the device joins an unrecognized Wi-Fi network or to launch a specific browser within the VPN session.

RANDOM PORT FEATURE

Some corporate and hotel networks block the ports commonly used by VPN protocols, preventing a normal connection from being made. CyberGhost has a random port feature under the OpenVPN protocol which checks for open ports on the current network and tries to connect through one of them. This is not the case for WireGuard or IKEv2 connections but it provides users with a simple way to get around stubborn networks without having to manually configure anything.

SIMULTANEOUS Connections and Device Support

One subscription is for up to seven devices simultaneously. CyberGhost offers native apps for Windows, macOS, Linux, iOS, Android and Apple TV. Users who wish to have VPN coverage for devices that don’t support VPN apps directly — gaming consoles, smart TVs, and older hardware — can set up CyberGhost at the router level, which then covers all devices on the network with the single connection count.

A browser extension for Chrome manages simple IP masking and enforcing of the secure https protocol without having to run the desktop client. The extension doesn’t work with the main app and doesn’t apply the kill switch or full encryption that the desktop client has.

PRICING AND REFUND POLICY

CyberGhost prices go down drastically with longer commitments. The two-year plan begins at around $2.03 per month billed upfront, which makes it one of the cheaper options among full-featured VPN services. Monthly billing is much more expensive at about $12.99 per month. A one-year plan is in between the two. The company accepts major credit cards, PayPal, and Bitcoin; if users pay with cryptocurrency and a disposable email address, they do not have to leave personally identifiable information to sign up.

New subscribers receive a 24-hour free trial on the desktop and a longer trial on the mobile with no credit card required. Monthly subscribers have 14 days to request a refund; subscribers to any longer plan have 45 days. The company processes refunds without requiring the user to explain the reason for cancellation.