Quick answer: HMA's distinguishing feature is reach: it offers server locations in more countries than any competitor, which is genuinely useful if you need an IP address somewhere obscure. Its privacy record is the problem – a 2011 case in which it supplied logs that helped identify a user still defines its reputation, and UK jurisdiction compounds it.
HMA VPN at a glance
| Overall score | 6.9/10 |
|---|---|
| Price | From about $2.99/mo (3-year plan) |
| Servers | 1,000+ |
| Countries | 210+ locations |
| Average speed loss | 12-16% |
| Simultaneous connections | 10 |
| Logging policy | No-logs claimed and audited; 2011 case in which logs identified a user |
| Jurisdiction | United Kingdom (Gen Digital) |
| Money-back guarantee | 30 days |
| Best for | Widest country coverage |
| Last tested | 2026-10-05 |
Key takeaways
- Locations in 190+ countries, far more than any rival
- 2011 case saw HMA logs contribute to identifying a user
- UK-based, a Five Eyes member, owned by Gen Digital
- Many of the exotic locations are virtual, not physical servers
- Has since commissioned an independent no-logs audit
Pros and cons
Pros
- Server locations in more than 190 countries, the widest coverage available
- 10 simultaneous devices
- Independently audited no-logs policy in recent years
- Simple apps suited to beginners
- 30-day money-back guarantee
- Backed by a large parent company
Cons
- 2011 case where HMA logs identified a user to authorities
- UK jurisdiction, a Five Eyes member
- Owned by Gen Digital, whose Avast subsidiary sold browsing data until 2020
- Many locations are virtual rather than physical
- Speeds trail the leading providers
Speed and performance
Speeds averaged 84-88% of baseline on nearby servers, which is behind NordVPN, Surfshark and ExpressVPN but sufficient for HD streaming and general browsing. Performance on the more exotic locations was noticeably weaker, which is expected given that many are virtual servers physically hosted elsewhere – a connection labelled as a remote island nation may be routing through Europe, adding latency.
Privacy and security
This is the crux of any HMA review. In 2011, HMA provided connection logs in response to a court order, and that information contributed to identifying a user who was subsequently prosecuted. The company has since changed substantially: it states it keeps no activity logs, and has commissioned an independent audit of that claim. The structural concerns remain. HMA is based in the United Kingdom, a Five Eyes member whose Investigatory Powers Act creates a demanding legal environment, and it is owned by Gen Digital, the parent company that also owned Avast when its Jumpshot subsidiary was selling user browsing data until 2020. None of this means HMA is unsafe for casual use; it does mean it is not the right choice for anyone with a serious privacy requirement.
Streaming
Netflix worked on several servers and HMA maintains some streaming-oriented locations, but results were inconsistent across platforms and BBC iPlayer frequently failed. Streaming is not a strong enough reason to choose HMA over CyberGhost or NordVPN.
Torrenting and P2P
P2P is permitted on a subset of servers, with no port forwarding offered. Speeds were adequate. Given the jurisdiction and logging history, HMA would not be our recommendation for torrenting even setting performance aside.
Apps and usability
Apps are available for Windows, macOS, iOS, Android, Linux and routers, with a clean, beginner-friendly design and a location picker that makes the enormous country list manageable. Features are basic compared with NordVPN or PIA – there is a kill switch and split tunnelling on some platforms, but little for power users.
Server network
Over 1,000 servers spread across locations in more than 190 countries, which is far wider coverage than any competitor offers. The caveat is that a large share of the more unusual locations are virtual servers: the IP address registers in the target country while the hardware sits elsewhere. HMA labels these, and for most purposes a virtual location works identically, but it is worth understanding what you are buying.
Pricing and value
Around $2.99 a month on a three-year plan with 10 devices and a 30-day refund is fair pricing in absolute terms. Relative to Surfshark at $2.19 with unlimited devices and a better privacy position, it is harder to justify unless the country coverage is what you specifically need.
Customer support
24/7 live chat and email support through Gen Digital's infrastructure, with a large knowledge base. Agents handled routine questions competently in testing, though depth on technical configuration was limited.
What happened in 2011
HMA received a court order relating to an investigation into a hacking incident. The company held connection logs – records of which account connected from which address and when – and provided them in response. That information contributed to identifying an individual who was later prosecuted. HMA's position at the time was that it had complied with a lawful order, which was accurate. The lasting lesson for users is not that HMA behaved unlawfully, but that a provider which retains connection logs can be compelled to produce them, however it describes its privacy stance in marketing.
Virtual locations: what you are actually buying
HMA's headline figure of 190-plus countries is achieved substantially through virtual locations, where an IP address is registered to a country but the physical server sits elsewhere, usually in a nearby major hub. For accessing a service that checks IP geolocation – a regional website, a local banking portal, a country-restricted catalogue – a virtual location works exactly like a physical one. What differs is latency, since your traffic travels to the real server location rather than the apparent one, and legal exposure, since the hardware falls under the host country's laws rather than the advertised country's. HMA labels which locations are virtual, which is more transparency than some competitors offer.
Features and what is missing
HMA supports WireGuard, OpenVPN and IKEv2, with AES-256 encryption and a kill switch across the main platforms. Split tunnelling is available on Windows and Android. There is an IP Shuffle feature that rotates your address periodically, and a Lightning Connect option that picks a server automatically. What is absent is the depth premium rivals offer: no multi-hop, no port forwarding, no obfuscation for heavily filtered networks, and no dedicated IP option. For a beginner that simplicity is a feature; for anyone with specific requirements it is a limitation.
Who should buy HMA VPN
Users who need an IP address in an unusual country that no other provider serves, and beginners wanting a simple app from a known brand.
Who should avoid HMA VPN
Anyone buying a VPN primarily for privacy, torrenters, and users uncomfortable with UK jurisdiction or Gen Digital ownership.
Alternatives to HMA VPN
- Surfshark (cheaper, unlimited devices, better privacy)
- NordVPN (faster, stronger record)
- Proton VPN (genuine privacy credentials)
How we tested
Tested across 10 locations including four virtual ones on Windows and Android, with streaming checks on six platforms, leak testing after each reconnection, and verification of which advertised locations are physical.
Verdict
HMA is a reasonable mainstream VPN with an unmatched spread of locations, and the audited no-logs policy represents real change from its past. But if your reason for buying a VPN is privacy, the combination of history, jurisdiction and ownership means there are better places to spend the same money.
Frequently asked questions
Is HMA VPN worth it in 2026?
HMA's distinguishing feature is reach: it offers server locations in more countries than any competitor, which is genuinely useful if you need an IP address somewhere obscure. Its privacy record is the problem – a 2011 case in which it supplied logs that helped identify a user still defines its reputation, and UK jurisdiction compounds it.
Does HMA VPN keep logs?
HMA VPN advertises a no-logs policy. Its stated position is: No-logs claimed and audited; 2011 case in which logs identified a user, operating under United Kingdom (Gen Digital) jurisdiction. This is the crux of any HMA review. In 2011, HMA provided connection logs in response to a court order, and that information contributed to identifying a user who was subsequently prosecuted. The company has since changed substantially: it states it keeps no activity logs, and has commissioned an independent audit of that claim. The structural concerns remain. HMA is based in the United Kingdom, a Five Eyes member whose Investigatory Powers Act creates a demanding legal environment, and it is owned by Gen Digital, the parent company that also owned Avast when its Jumpshot subsidiary was selling user browsing data until 2020. None of this means HMA is unsafe for casual use; it does mean it is not the right choice for anyone with a serious privacy requirement.
Does HMA VPN work with Netflix and other streaming services?
Netflix worked on several servers and HMA maintains some streaming-oriented locations, but results were inconsistent across platforms and BBC iPlayer frequently failed. Streaming is not a strong enough reason to choose HMA over CyberGhost or NordVPN.
Is HMA VPN good for torrenting?
P2P is permitted on a subset of servers, with no port forwarding offered. Speeds were adequate. Given the jurisdiction and logging history, HMA would not be our recommendation for torrenting even setting performance aside.
How much does HMA VPN cost, and can I get a refund?
Pricing: From about $2.99/mo (3-year plan). Refund policy: 30 days. Around $2.99 a month on a three-year plan with 10 devices and a 30-day refund is fair pricing in absolute terms. Relative to Surfshark at $2.19 with unlimited devices and a better privacy position, it is harder to justify unless the country coverage is what you specifically need.
Can HMA be trusted after the 2011 logging case?
It is a different company in important respects: it now states it keeps no activity logs and has had that audited independently. But it remains UK-based under Gen Digital ownership, and the 2011 case demonstrated what happens when a provider does hold logs and receives a court order. For casual privacy it is fine; for anything where being identified would matter, choose a provider without that history and outside Five Eyes.