The unsponsored VPN comparison, with a source for every claim
🌐 fineprint.peng.ly
Contents
Most "best VPN" lists are paid per signup, so they rank whoever pays the biggest cut. fineprint takes no money from anyone, has no affiliate links, and grades every provider on the same published rules.
It picks up where That One Privacy Guy's old VPN comparison chart left off. Logging, jurisdiction, audits, how anonymously you can pay, what the apps get up to and what it all costs, with every value linked to its source. Anything nobody could find says Unknown rather than guessing.
Just head to fineprint.peng.ly. Cards give you the gist of each provider, the table lets you filter, sort and download the lot as CSV or JSON, and each provider has a page with the full picture and its sources. How grading works lists every criterion and the rule behind each colour.
The data's there for your own projects too:
| URL | What's in it |
|---|---|
/api/providers.json |
Every provider, with grades and derived values worked out |
/api/criteria.json |
What's measured, and the grading rules |
/schema/provider.json |
JSON Schema for the provider YAML files |
/llms.txt |
A plain-text summary for AI assistants |
Each provider is one YAML file in data/providers/, checked against the criteria in data/criteria.yml. Spotted something wrong? Hit "Suggest an edit" on its page, fix the value, add a source and open a pull request. The checks point at the exact line if anything's off.
To add a provider, npm run new -- example-vpn "Example VPN" writes the file with every criterion listed. The contributing guide has the rest.
It's a fully static site, so it'll run anywhere that serves files.
This is what fineprint.peng.ly runs on. Build it, then push the build/ folder up as a Worker with static assets:
npm run build
npx wrangler deploy --name fineprint --assets build --compatibility-date 2026-10-01There's a multi-arch image on DockerHub (notaflightrisk/fineprint) and GHCR (ghcr.io/notaflightrisk/fineprint). It's nginx serving the built site:
docker run -p 8080:8080 notaflightrisk/fineprintEvery release has the built site attached as site.zip. Unzip it and serve the folder with anything:
unzip site.zip -d site
npx serve siteFollow the Development steps, then npm run build. The site lands in build/.
You'll need Node 22.18 or newer, plus Git.
git clone git@github.com:NotAFlightRisk/fineprint.git
cd fineprint
npm install
npm run devThe dev server is then on localhost:5173.
npm run validate checks the data, npm test runs the tests, npm run check the types, and npm run preview serves a production build.
It's SvelteKit, prerendered to plain HTML. Loading, validating and grading the data all lives in src/lib/data/, shared by the site and the scripts in scripts/.
Inspired by That One Privacy Guy's VPN comparison chart, which did this first and did it well.
Licensed under MIT, © NotAFlightRisk 2026
