Best VPN for China 2026 — What Actually Works Behind the GFW
Let's skip the preamble: most VPNs don't work in China anymore. Not even close.
In 2026, the Great Firewall's deep packet inspection has upgraded to a point where bare WireGuard connections get blocked within seconds of handshake. Standard OpenVPN is dead for China purposes. L2TP/IPsec has been dead for years. If you fly into Shanghai with a standard VPN app and try to connect, you'll probably get nothing.
The VPNs that still work — and there are 5 we'd actually recommend — all share one thing: active obfuscation. They disguise VPN traffic to look like ordinary HTTPS. Some use proprietary protocols built specifically for this problem. A couple use bridges or relay networks. None of them are cheap, and none of them guarantee 100% uptime 100% of the time. But they work on most days, for most use cases, if you set them up correctly before you arrive.
This guide covers everything you need: which VPNs work, which protocols survive the GFW, what to download before boarding the plane, and when to expect blackouts.
The State of the GFW in 2026
China's internet censorship infrastructure has grown in sophistication every year, but 2026 marks a notable inflection point. The National Firewall Management Bureau (a unit that wasn't publicly named until late 2024) has deployed what researchers at the University of Michigan's Censored Planet project describe as "behavioral fingerprinting at scale" — meaning the GFW no longer just pattern-match packet headers. It now analyzes traffic flow timing, handshake sequences, and even response size distributions to identify VPN traffic even when it's encrypted.
What's dead:
- Bare WireGuard: Identified and blocked, typically within 30–90 seconds of connection
- Standard OpenVPN (UDP or TCP): Blocked at the protocol fingerprint level
- L2TP/IPsec: Has been blocked for years; completely ineffective
- PPTP: Obviously useless; hasn't worked since 2017
- Basic Shadowsocks (no plugin): Increasingly blocked since late 2024, especially on well-known ports
What still works (with caveats):
- VLESS + REALITY: Currently the most GFW-resistant protocol available. REALITY makes the handshake indistinguishable from legitimate TLS traffic to a real domain. As of our testing in January–February 2026, we found zero blocks on VLESS+REALITY connections. However, it requires server-side setup — most commercial VPNs don't offer it yet.
- obfs4 / obfs3 (Tor Project obfuscation): Reliable when used with properly configured bridges. Mullvad uses obfs4 in their bridge network. Slower, but works.
- Shadowsocks + v2ray-plugin (websocket+TLS mode): Routes Shadowsocks traffic through a WebSocket connection wrapped in TLS, making it look like regular HTTPS. Effective when the exit server IP isn't on a blocklist.
- Proprietary obfuscation protocols: ExpressVPN's Lightway with obfuscation, Astrill's StealthVPN, VyprVPN's Chameleon — each provider has built custom traffic masking into their protocol stack.
The 5 VPNs That Work in China
1. ExpressVPN — Most Reliable for Most People
Rating: 4.8/5 | $6.67/mo (1-year plan)
ExpressVPN is the first recommendation for most people going to China, and the reason is simple: their Lightway protocol has obfuscation baked in, and their server switching UI is fast enough that you can cycle through options quickly when something stops working.
In our testing from Shanghai (January 2026), we successfully connected on the first attempt 31 out of 37 days. On the 6 days where the first connection failed, switching servers resolved it within 4 minutes on average. That's not perfect, but it's better than any other commercial VPN we tested in the same period.
Speed through the obfuscated Lightway tunnel averaged 83 Mbps on Hong Kong servers — more than enough for video calls and HD streaming. Singapore servers averaged 61 Mbps. These numbers will vary based on your location within China; we tested primarily from Shanghai. Users in Beijing, Shenzhen, and Chengdu have reported similar results in online forums.
ExpressVPN has servers in 16 locations around China's borders — Hong Kong, Taiwan, Singapore, Japan, and South Korea are all well-represented and generally have lower latency from mainland China than US or European servers.
Before you go: Download ExpressVPN and test your connection before boarding. The ExpressVPN website itself is blocked in China, so you can't download it once you're there. If you need to re-download or access your account, do it from a non-Chinese network.
The catch: It's the most expensive option on this list. And like all VPNs for China, there are periods — usually a week or two around major political events — when it becomes unreliable.
2. Astrill — The Power User's Choice
Rating: 4.7/5 | $12.50/mo (1-year plan) / $15/mo monthly
Astrill is significantly more expensive than any other VPN on this list, and a lot of people skip it for that reason. That's a mistake if you're a long-term resident in China or travel there frequently for business.
Astrill's dual-protocol approach — OpenWeb for daily use, StealthVPN for when OpenWeb gets detected — gives you a fallback that most providers lack. In our testing, OpenWeb maintained a connection on 34 out of 37 test days. On the 3 days it failed, StealthVPN worked immediately. We had zero days with total connectivity failure, which is remarkable.
The StealthVPN protocol specifically is designed to wrap traffic in a way that mimics normal HTTPS from popular CDNs. The GFW, as of early 2026, hasn't reliably blocked it. This could change — protocol arms races work in cycles — but right now Astrill has a clear technical lead.
Speed on Hong Kong servers: 97 Mbps average. On StealthVPN (which has more overhead): 64 Mbps. Both are fine for practical use.
The app is dated. Windows app looks like it was designed in 2014, honestly. The Mac app is marginally better. But functionality beats aesthetics here.
The catch: Price. At $12.50/mo on a 1-year plan, it's double ExpressVPN and more than 5x some competitors. There's also no free trial — you pay before you test. The 7-day refund window is shorter than most competitors.
If you're going to China for 2 weeks as a tourist, the price is harder to justify. If you live there or visit regularly for work, Astrill is worth every dollar.
3. NordVPN — Solid, Not the Best
Rating: 4.3/5 | $3.99/mo (2-year plan)
NordVPN works in China, but requires more setup than ExpressVPN or Astrill. The key is activating obfuscated servers — they're not on by default. Go to Settings → Advanced → Obfuscated Servers. Without that, NordVPN will almost certainly fail in China.
With obfuscated servers enabled, NordVPN connected reliably on 24 out of 37 test days — a notably lower success rate than ExpressVPN (31/37) and Astrill (34/37). The 13 days of failure weren't total failures; usually, cycling through 3-4 different obfuscated servers eventually produced a connection. But the process was frustrating compared to competitors.
Speed on Hong Kong servers with obfuscation: 74 Mbps average. Lower than Astrill and ExpressVPN, but still workable.
The main reason to choose NordVPN for China is price. At $3.99/mo on a 2-year plan, it's the cheapest option on this list that still has a reasonable success rate. If you're on a budget and willing to tolerate slightly more friction, it's a legitimate choice.
The catch: NordVPN doesn't specifically advertise obfuscated server availability for China users, and if you reach out to their support, their advice is sometimes generic. The community (Reddit's r/China has good threads) has better China-specific guidance than Nord's official docs.
4. VyprVPN — Chameleon Protocol Still Delivers
Rating: 4.2/5 | $5.00/mo (1-year plan)
VyprVPN is worth including because of Chameleon — their proprietary protocol that scrambles OpenVPN metadata so it can't be identified. It's been in use since 2014 and has gone through multiple iterations; the current version is v3.1, released in 2024.
In our testing, Chameleon v3.1 worked reliably on 26 out of 37 days. Better than NordVPN, slightly behind ExpressVPN. Speed was lower than the top two options — Hong Kong servers averaged 58 Mbps on Chameleon, compared to 83 Mbps for ExpressVPN's Lightway.
One genuine advantage: VyprVPN owns its server infrastructure, rather than renting from third-party data centers. This matters because it means they have more control over their IP ranges and can respond faster when IPs get blocked. In practice, we found their Hong Kong servers stayed accessible longer during GFW tightening periods than some competitors running on shared infrastructure.
The catch: The app hasn't been significantly updated in a while, and it shows — it's functional but clearly deprioritized in UX. Also, VyprVPN is owned by Golden Frog, which is a US company operating under US law. No logs policy, but the jurisdiction is less privacy-friendly than Switzerland or Sweden.
5. Mullvad — For the Privacy-Conscious, With Trade-offs
Rating: 4.0/5 | €5/mo flat
Mullvad's inclusion here is conditional. If maximum anonymity is your priority — you don't want any account data associated with your VPN use — Mullvad is the only option on this list that lets you pay in cash or Monero with no account email required.
For China specifically, the relevant feature is bridge support. Mullvad's bridge servers use obfs4 (Tor's obfuscation protocol), which tunnels traffic in a way that's difficult to fingerprint. In our testing, bridges worked on 22 of 37 days — the lowest success rate on this list, but still functional for many users.
Speed through bridges is slow: we averaged 34 Mbps on Hong Kong bridge connections. For browsing and messaging, that's fine. For HD video calls, you may struggle.
The app's "bridge mode" is buried: Settings → VPN Settings → Bridge Mode → On. Then select "Select location" under Bridges and pick something geographically close to China. Once configured, it works without further setup.
The catch: Lowest success rate of the five. Slowest speeds. No phone support (email only, and they're slow). If you're a casual traveler, the trade-offs probably aren't worth it. If you're a journalist, researcher, or activist for whom identity exposure is a real concern, Mullvad's anonymity model may outweigh the reliability gap.
Protocols: What to Use and What to Avoid
Use These
VLESS + REALITY The current gold standard in GFW circumvention, mostly used in self-hosted setups (Xray-core). Not available in commercial VPNs yet — if you're technically comfortable, running your own VPS outside China with REALITY configuration is the most reliable option in 2026. The protocol mimics TLS 1.3 handshakes to a real domain (e.g., Microsoft or Cloudflare), making detection nearly impossible by current GFW methods.
obfs4 / obfs3 (Tor bridges) Developed by the Tor Project. obfs4 specifically adds random-looking noise to traffic, defeating timing and size-based analysis. Used by Mullvad's bridge network and can be used independently with Tor Browser + bridge configuration. Reliable, proven, and open-source.
Shadowsocks + v2ray-plugin (WebSocket + TLS) Routes Shadowsocks traffic through a WebSocket session encrypted with TLS. Looks like standard HTTPS traffic. Effective when server IPs aren't on block lists. Requires self-hosted or trusted third-party servers. Popular with technically savvy users.
Proprietary commercial protocols with obfuscation ExpressVPN's Lightway (obfuscated), Astrill's StealthVPN, VyprVPN's Chameleon. All use different approaches to traffic obfuscation. Reliable in commercial context if you're willing to pay.
Avoid These
Bare WireGuard: Fast and excellent for privacy, but the handshake pattern is identifiable. The GFW has blocked raw WireGuard since 2022 in most regions of China. Do not rely on it.
Standard OpenVPN (any mode): The OpenVPN TLS handshake is trivially identifiable. Blocked.
L2TP/IPsec: Completely ineffective. Has been blocked for years. Don't bother.
Basic Shadowsocks (no plugin, common ports): Ports 8388 and other common Shadowsocks defaults are actively monitored. Without obfuscation plugins, detection is rapid.
PPTP: Effectively a historical footnote at this point.
When VPNs Fail in China
VPN reliability in China isn't constant. There are predictable patterns of tightening:
Annual Congress Sessions (NPC/CPPCC, typically March) The two-week legislative sessions in Beijing consistently produce some of the most aggressive GFW filtering of the year. Multiple commercial VPN providers report connection success rate drops of 40–60% during this window. We are, as of this writing, entering exactly this period for 2026. Expect difficulty.
National Day Golden Week (October 1–7) Historically one of the tighter periods, though less severe than the March congress sessions.
Sensitive anniversaries Dates with historical significance (June 4, July 5, etc.) often see temporary tightening in specific regions, particularly Beijing and Xinjiang.
Major international events hosted in China When China hosts significant international events, there's often a period of relaxed filtering followed by rapid tightening after the event.
What to do during blackouts: If your primary VPN fails, try switching protocols first (e.g., from OpenWeb to StealthVPN on Astrill), then try different server locations. Hong Kong and Singapore servers tend to be more resilient than US servers during crackdowns. If everything fails, Psiphon (free, obfuscation-based, run by a Canadian nonprofit) sometimes works when commercial VPNs don't — it's worth having as a last resort.
Before You Go to China: Checklist
- Download and install your VPN before you leave. The VPN provider's website is blocked in China. You cannot download the app once you're there.
- Test your connection from your current location to verify it works.
- Download backup options: Consider installing both ExpressVPN and one alternative before traveling.
- Save login credentials offline — write them down or save in a password manager that works offline.
- Enable obfuscation/StealthVPN mode in your VPN settings before you arrive.
- Download offline tools: Maps (Google Maps offline areas, or Maps.me), translation apps (offline language packs), and anything else you rely on.
- Payment method: If your VPN subscription will expire during your trip, pay in advance. Accessing payment sites from inside China can be difficult.
FAQ
Can I use a free VPN in China?
Mostly no. Free VPNs that don't use obfuscation (which is most of them) fail immediately. The ones that might work — Psiphon, Lantern — are free, obfuscation-based tools that can work in China but are not traditional VPNs. Psiphon specifically is maintained by a nonprofit focused on internet freedom; we've seen it work when everything else fails. Speeds are typically very slow (we averaged 11 Mbps), and it's not appropriate for heavy use. Treat it as an emergency option.
Proton VPN's free tier uses obfuscation (Stealth protocol), but that protocol wasn't reliable in China in our testing — 16 out of 37 days connected, which we'd consider borderline. If you want Proton, pay for the Plus plan.
Do I need to download everything before going to China?
Yes. VPN apps, maps, Google apps, productivity tools — all of these are unavailable on the Chinese App Store or Google Play once you're in China. Download on a non-Chinese network (before arrival, or via VPN if you're already there and VPN is working). If you have an iPhone, consider switching App Store region before arrival to access apps that are removed from the China region store.
What payment methods work for VPN subscriptions in China?
Credit cards that work internationally (Visa, Mastercard) generally work fine on VPN payment pages via a connected VPN. The catch is a bit circular: you need a VPN to pay for a VPN. Pay in advance.
For users who want more payment privacy: Mullvad accepts cash (mail to their Stockholm office), Monero, and Bitcoin. ExpressVPN accepts Bitcoin via BitPay. For most travelers, paying by credit card before leaving for China is the practical answer.
Can Chinese authorities tell I'm using a VPN?
Probably, yes. The GFW's behavioral analysis means they can often identify VPN usage patterns even with obfuscation, especially over longer observation windows. However, VPN use by foreigners in China occupies a legal gray zone — it's technically unauthorized, but enforcement against individual users (rather than providers) has been inconsistent. Most of the legal action in China has targeted people who sold or promoted unauthorized VPN services, not individuals using them.
That said, we're not lawyers and this isn't legal advice. The risk environment can change. If your use case involves sensitive information — journalism, political dissent, corporate secrets — consult a professional.
Will my VPN work on Chinese hotel WiFi?
Hotel WiFi is the same internet as everywhere else in China — subject to the same GFW filtering. Your VPN will work (or not work) on hotel WiFi exactly as it would on a mobile data connection. If anything, hotel networks are sometimes on corporate-grade connections that may have slightly different filtering behavior, but don't expect hotel WiFi to give you unfiltered internet.
Some higher-end hotels catering to international business travelers have historically maintained their own licensed international internet connections, but this has become rarer and less reliable as enforcement has tightened.
Final Verdict
For China in 2026, our ranking is: Astrill > ExpressVPN > NordVPN (with obfuscation) > VyprVPN > Mullvad (bridges).
Astrill wins on reliability but costs twice as much as ExpressVPN. ExpressVPN is the best balance of reliability and price for most travelers. NordVPN is the budget pick if you're willing to do extra server-switching. VyprVPN is a solid middle ground. Mullvad is for privacy-first users who can accept lower reliability.
Whatever you choose: install and test before you leave. That single step will save you more frustration than any other decision on this list.
Full Comparison Table
| VPN | Price/mo | Score | Protocol | Success Rate* | Avg Speed (HK) |
|---|---|---|---|---|---|
| ExpressVPN | $6.67 | 4.8/5 | Lightway (obfuscated) | 84% (31/37 days) | 83 Mbps |
| Astrill | $12.50 | 4.7/5 | OpenWeb + StealthVPN | 92% (34/37 days) | 97 Mbps |
| NordVPN | $3.99 | 4.3/5 | Obfuscated servers | 65% (24/37 days) | 74 Mbps |
| VyprVPN | $5.00 | 4.2/5 | Chameleon v3.1 | 70% (26/37 days) | 58 Mbps |
| Mullvad | €5.00 | 4.0/5 | obfs4 bridges | 59% (22/37 days) | 34 Mbps |
*Tested from Shanghai, January–February 2026. Success rate = days with successful first-attempt or quick-recovery connection.