Even the best VPNs can seem like a complicated technology, packed with low-level geeky details that hardly anyone understands, but TunnelBear is a provider that does things differently.
The Canadian-based, McAfee-owned company doesn't drown you in jargon. The website has little talk of protocols, no mention of encryption types, indeed barely any technical terms at all. Instead, the company focuses on the fundamentals, such as clearly explaining why you might want to use a VPN in the first place.
This approach won't work for everyone. If you're an experienced user and want to get down to the technical details of the service, for instance, you're likely to be disappointed. Search for DNS on the ExpressVPN support site, for instance, and right now you'll get 56 hits; search at TunnelBear and you'll get three.
- Want to try TunnelBear? Check out the website here (opens in new tab)
The service specs are fairly average. The network has a mid-sized 48 countries (India is no longer available, to avoid the new logging laws). There are apps for Windows, Mac, iOS and Android, as well as extensions for Chrome and Firefox, and you can have up to five connections active at the same time.
Support for other platforms is lacking, unfortunately, with no significant help for getting the service working on routers, games consoles, Chromebooks, Linux, or setting it up manually.
TunnelBear has introduced one major improvement since our last review, though: the apps finally support the ultra-speedy WireGuard protocol, as well as OpenVPN and IKEv2. Just wait until you see what that does for its performance.
TunnelBear's free account (opens in new tab) provides a horribly limited 500MB of traffic a month, barely enough to run even a single basic speed test. But it's a simple way to check out the interface and make sure you can connect.
Its monthly plan (opens in new tab) gives you unlimited data for a reasonable $9.99 a month, though. The price drops to an effective $4.85 a month on the annual plan, or $3.33 if you sign up for three years.
These are competitive prices which beat most providers, although there are a few with cheaper deals. Private Internet Access asks $2.03 a month on the first term of its three-year plan, and opting for Ivacy's five-year plan cuts the cost to a supercheap $1.19.
If you do sign up for TunnelBear, keep in mind that there's no money-back guarantee. The small print says: "While all amounts paid are non-refundable, certain refund requests for subscriptions may be considered by TunnelBear on a case-by-case basis." Presumably, you might get a refund if you've had really bad service, but it's entirely up to the company to decide. Not quite as friendly as the cuddly cartoon bears suggest, then.
TunnelBear used to support Bitcoin payments for its annual plan, but no more. With no PayPal, either, it’s now strictly card-only.
Privacy and logging
The logging policy is clearly described, with TunnelBear explaining that it does not collect "IP addresses visiting our website", "IP addresses upon service connection", "DNS Queries while connected", or "any information about the applications, services or websites our users use while connected to our Service." As a result, the company says, it can't link any of its users to an action carried out by a specific IP address. Sounds good to us.
The service does record 'operational data', updating this when you connect. That includes the OS version of your device, TunnelBear app version, whether you've been active this month, and the bandwidth you've used. Not quite zero logging, then, but it's far less than we've seen elsewhere, and there's nothing here that could link you to any online action.
While that looks great, there's normally no way to tell whether you should trust what a VPN provider is telling you – but TunnelBear is a little different. The company now has independent specialists Cure53 run an annual public security audit covering many different areas of the service. The most recent audit (the fourth) included the mobile and Windows apps, browser extensions, the service infrastructure, backend and frontend systems, and the public website.
The audit results weren't perfect, and the report detailed five vulnerabilities: two low, two medium and one high risk. These didn't compromise users, though, and were more about ways TunnelBear systems could be attacked.
For instance, Cure53 spotted a way that an attacker could prevent someone logging into TunnelBear if they knew the victim's account email address. Annoying? Yes. A disaster? No.
Issues like this are no surprise when a service puts itself under this level of scrutiny (a Cure53 audit is seriously thorough), and they’re all now fixed. And the only reason we know about this at all is that unlike many providers who have security audits, TunnelBear's report is available to read online (it's a PDF linked from this blog post (opens in new tab)).
Overall, we must applaud TunnelBear for its level of transparency. Most VPNs have never had any form of security audit, and the providers who have actually made some movement in this direction typically have one-off audits with a far narrower scope. That's just not good enough, and it's great to see TunnelBear leading the way on this front.
TunnelBear doesn’t say much about torrenting on its website – in fact, it barely mentions the topic at all – but the support team explained that it’s available on all locations.
Some may be more reliable than others, apparently: the company recommended we try Canada, US, UK, Romania, Netherlands, Germany or Sweden if we had problems elsewhere.
How likely is it that you might have problems elsewhere, then? To get an idea, we tried downloading torrents from three of the other locations: Greece, Portugal and Brazil. Despite not being on TunnelBear's 'recommended' list, they all completed without any issues, suggesting that you really should be able to use torrents right across the network.
TunnelBear's Windows app opens with all its locations highlighted on a gray world map. This has one or two nice visual touches, with cartoon palm trees in tropical areas, and snow-covered Christmas trees if you head further north. But it’s also very basic, with little map detail, and not even a zoom option to help find the locations you need.
You can also select your server from a more conventional location list. That’s probably easier, but if anything, it’s even more basic, with no ping times, server load figures, or Favorites system to save your most commonly-used servers.
Once you've chosen a location, clicking 'On' gets you connected, and the app displays a 'connection' animation, panning the screen and plotting a line across the map to your destination. It’s a cute visual effect the first time of viewing, but it began to annoy us by the 100th (unfortunately, there’s no way to turn it off).
WireGuard connection times were a little disappointing at 3-4 seconds, even for our nearest server (the best VPNs take around a second). But this didn’t change much over distance – even connecting from the UK to New Zealand took only 5-6 seconds – and times were reasonable overall.
The app displays notifications when it connects or disconnects, too, ensuring you always know when you're protected, and when you're not.
The app doesn't have many settings, but the few you get are very useful. You can have it load when Windows starts, for instance, then automatically activate the VPN whenever you access an untrusted Wi-Fi network (everywhere but home and work, say).
The Obfsproxy-based GhostBear (opens in new tab) attempts to make your activities look more like regular internet traffic, perhaps helping you connect in countries like China which try to detect and block the use of VPNs.
A VigilantBear (opens in new tab) setting is essentially a kill switch, blocking all internet traffic if the VPN drops to prevent any identity leaks. We found this had some issues in extreme situations – the kill switch could fail if the app crashed and it was restarted, for instance, but it performed well in simpler tests.
It’s great to see WireGuard supported in the Windows app, as well as OpenVPN and IKEv2. By default the app selects the most appropriate protocol for your network, but you can now also choose your preferred option.
Overall, TunnelBear's Windows app is easy to use, and the arrival of WireGuard is a major plus. There’s clearly scope for improvement in every part of the app, though, and the basic feature list could disappoint experienced users.
Mac and mobile apps
TunnelBear's Mac, Android and iOS apps mostly follow in much the same vein as the Windows client: there's a world map with VPN locations, a text list of locations if you prefer, a handful of settings, and not much else.
The Mac app has a tiny map, but this can’t be resized, making it awkward to use. Fortunately, you can collapse the app window down to a widget-sized panel, with little more than the name of the selected location and a drop-down menu to choose something else.
There’s no WireGuard support or choice of protocol, unfortunately. But the app does have the other key settings present: the VigilantBear kill switch, automatic connection when you access untrusted Wi-Fi, and GhostBear to bypass VPN blocking.
The Android edition has a full-sized map. There's no zoom, but it works well on a tablet, where you can keep swiping in any direction to find what you need (and there are portrait and landscape modes, too).
The Android app improves on Windows and iOS with new support for split tunneling – called SplitBear, obviously – allowing you to specify apps that won't use the VPN. (There's a slightly less technical feature in an optional 'Bear Sounds' setting, which gives a ‘roar’ every time you connect. Not exactly necessary, but there's no harm in giving an app a little personality.)
TunnelBear's iOS offering has the best-looking map, especially when viewed on a large display. It also misses out on some key technical settings, with no WireGuard support, no GhostBear, VigilantBear or app-level split tunneling.
The iOS app does have a major plus in its support for auto-connecting on untrusted Wi-Fi. There’s also a new feature, a simplified version of Android’s SplitBear. This doesn’t work with apps (not TunnelBear’s fault, iOS won’t allow that), but instead allows you to specify websites that won’t use the VPN, handy for anything that doesn’t work properly when you’re connected.
These are far from the best mobile VPN apps we've seen, but the TunnelBear range is certainly easy to use, with some worthwhile features, and the company is clearly hard at work adding more. If you like a VPN which stays out of your way, and won't ever confuse you with low-level networking jargon, it just might be a sensible choice.
Installing TunnelBear's browser extensions can make the service easier to operate, by allowing you to choose a location, connect and disconnect from inside your browser. The extensions work as proxies and so only protect your browser traffic, but if that's all you need, the extra convenience could make them worth a try.
The Chrome extension added an icon to our address bar, and tapping this enabled choosing new locations from a drop-down list.
Hit the 'Connect' button and, as usual with proxies, you're connected instantly. A tiny map updates to show your location, similar to the regular apps.
There are no extra features, no WebRTC or tracker blocking or anything else. But the extension does have a small usability plus in its keyboard shortcut support. If you want to keep your hands off the mouse, pressing Ctrl+Shift+U connects you to the VPN, and pressing it again will toggle the connection off when you're done. (A separate Alt+Shift+N shortcut toggles the connection on and off in Incognito mode.)
We checked the Firefox extension to see if it had any more options, but no, it looked and worked much the same as the Chrome version.
The browser extensions follow a very similar pattern to the apps, then – they are short on features, but relatively simple, and fine for the target audience of casual users.
To check out TunnelBear's performance, we first connected to our nearest server from a UK data center and a US location, each with 1Gbps test connections.
We then measured our download speeds multiple times using several benchmarking services – SpeedTest's site and command line app, nPerf and others – and then repeated each test in an evening session.
TunnelBear’s new WireGuard support saw UK download speeds double its previous results, soaring from OpenVPN’s 290-310Mbps last time, to a strong 560-640Mbps in these tests.
That’s still trailing far behind the likes of Surfshark and TorGuard, which beat 950Mbps in our testing. But it has lifted TunnelBear from the lower reaches of the performance table in our last reviews, to a solid mid-range 12th place out of 21 this time, and the service probably now delivers all the speed that most people need.
Netflix and streaming
One of the major selling points of a VPN is that it can make you appear to be visiting a website from another country, perhaps giving you access to content you wouldn't be able to view otherwise. But this doesn't always work, so we test all VPNs with Netflix and more to see if they can give us access to various streaming sites.
TunnelBear successfully unblocked US Netflix, though with only one of our three test locations. It failed with the UK, Australian, Canadian and Japanese libraries.
The service got us into US Amazon Prime Video without difficulty, but Disney Plus was a different story. If we logged into UK Disney Plus, then connected to TunnelBear, we couldn’t access US-specific content. And if we connected to TunnelBear first, Disney Plus didn’t allow us to log in.
The mixed picture continued in our regional tests. In Australia, TunnelBear unblocked 9Now, but failed with 10 play. And in the UK, the service failed with BBC iPlayer, but got us into both ITV and Channel 4.
TunnelBear has a few unblocking skills, then, but if streaming is a priority, ExpressVPN, Hide.me, NordVPN, PureVPN and Surfshark all unblocked every one of our test streaming services in our latest round of reviews.
TunnelBear support starts with its web-based help site (opens in new tab). This is presented in a clear and simple way, with large icons pointing you to key areas (Getting Started, Troubleshooting, Accounts), and basic articles on the most common questions ('Why should I trust TunnelBear?', 'Why can't I access the content I want?', 'Does TunnelBear keep logs?').
Go searching for answers and you'll find TunnelBear's knowledgebase doesn't have a lot of content, but what you get is well presented and gives you a decent range of information. The Connection Issues (opens in new tab) page doesn't just offer generic 'reinstall'-type ideas, for instance. It links you to TunnelBear's Twitter page to look for service information, suggests trying out the service on another network, and points you to settings which might help.
Despite its beginner-oriented approach, there's also room for just a few more advanced tweaking ideas, with recommendations for ports which should be opened in some circumstances.
There's no live chat support, but if you need more in-depth help, a Contact page allows you to send a message to the support team. This prompts you for the type of problem, affected locations, operating system and so on, a smart way to ensure beginners provide all the key information.
There's no live chat, but if you need more help, a Contact page allows you to send a message to the support team. We kept our test question simple, and had a friendly, helpful and accurate reply the next day. We would still prefer the near-instant response of quality live chat – because if your problem is complex and requires a lot of back and forth, it could take a very long time to find a solution – but as email support goes, TunnelBear isn't bad at all.
TunnelBear review: Final verdict
It's not the largest, fastest or most powerful of VPNs, but TunnelBear's ease of use and strong focus on opening up its systems to scrutiny deserve a lot of credit. If you're looking for a gentle start with VPNs, or are tired of apps which are crammed with features you never, ever use, then TunnelBear could be a smart choice.