HideMyAss! (HMA) VPN review

One of the biggest and best VPN names in the business, HideMyAss! (HMA) has been protecting its users' privacy for more than 15 years.

The company offers a vast network of 1,030+ servers in 290+ locations across 210+ countries. That's fewer servers than some of the top providers, but many more locations and countries (NordVPN has 5,200+ servers across 60 countries, ExpressVPN has 3,000+ servers across 160 locations and 94 countries).

• Want to try HideMyAss? Check out the website here

There's P2P support, but only with a handful of locations, in fact just eight via our Windows app: five in Europe, three in the US.

The service now only supports the OpenVPN protocol (IKEv2 has been dropped from the Windows app, and there's still no sign of WireGuard). It's seriously secure, though, with AES-256-GCM data encryption, RSA-4096 for handshaking and SHA-256 data authentication, while dual kill switches aim to keep you safe if the VPN drops.

The HideMyAss! website proudly proclaims that it works on all your devices, and it just might have a point. Not only are there custom apps for Windows, Mac, Android, iOS and Linux, but there's installation advice to help you manually set up the service on Apple TV, Android TV, Xbox, PlayStation and more.

HideMyAss! supports up to five simultaneous connections with its baseline plans. Paying extra allows you to cover up to 10 devices, or you can set up the service on some routers and connect as many devices as you need: it's your call.

HideMyAss pricing

The HideMyAss! main pricing page looks short on options with just a couple of plans.

You can get support for up to five simultaneous connections for $4.99 a month on the standard annual plan, dropping to only $2.99 over three years.

If you've got lots of hardware to protect, you might want to choose the 10-connection option, but that bumps up the price: $7.99 a month on the annual plan, $6.99 for two years of coverage, or $5.99 for three.

The seeming lack of a monthly plan puzzled us – but in fact there is one, but HMA hides it away on an 'extended' pricing page, presumably because it wants users to buy one of the longer-term plans.

Track down the right page and you'll find an $11.99 monthly billing option. There's also a six-month plan at $8.99, and a two-year plan at $4.99 a month. (The same price as the one-year plan? Maybe that's why it's hidden away on another page.) These appear to support up to five connections only, with no 10-device choice.

$4.99 a month is a fair annual price which beats vendors like Hotspot Shield ($7.99) and ExpressVPN ($8.32). Shopping around can still save you a little cash, though. Private Internet Access charges $3.33 a month for its annual plan, and just $2.03 for the first term of its three-year plan. Ivacy's five-year plan is a tiny $1.19 a month.

If you've got a lot of devices to protect, though, HMA doesn't look like such a good deal. Those low Private Internet Access prices cover up to 10 simultaneous connections, and Windscribe's annual plan, just $4.08 a month, has no device limits at all.

HideMyAss! doesn't support Bitcoin, whatever plan you choose, but you can pay via cards, PayPal, Apple Pay, Alipay and various other methods. (Payment options vary by region, but the website has a helpful guide here.)

A 7-day free trial gives you a decent amount of time to try out the service. Be careful, though – you must hand over payment details, and you're automatically billed for the annual plan when the trial ends, unless you cancel (fortunately, that's easy to do online).

If you buy, and then run into problems, you're protected by a 30-day money-back guarantee. This includes plenty of jargon-packed small print, but there's also an unusually generous extra.

Most VPNs say that they won't issue a refund if you've ever claimed a refund from them before. That makes sense – they don't want freeloaders claiming over and over again – but it could also be a little unfair, if, say, you're just trying the service again years later to see if it might work for you.

HideMyAss! understands this, and doesn't care how many previous refund requests you've made, just as long as it's at least six months since the last one. Seems much more reasonable to us.

Privacy and logging

HideMyAss! has so much small print that the Legal section includes a sidebar with no less than 13 separate sections, and many of those are also very lengthy (the privacy policy alone has more than 5,000 words).

This isn't quite as bad as it first sounds. The main reason for the cluster of documents is that HideMyAss! has organized important sections into separate areas, making them easier to find, and most of these are clearly structured and well-written. (If you're allergic to small print and just want the basics, though, check out HMA's no log blog post for a quick explanation.)

The privacy policy explains that there's no logging of originating IP addresses (a possible way to identify you), precise timestamps (when you connected or performed some action), DNS queries, browsing history or transferred data.

There is some general logging of service use, including the date of connection and whether it's AM or PM, and a very approximate idea of transferred data (the service only records whole 100MB blocks, so a 379MB data transfer is logged as 300MB).

HMA justifies this minimal data collecting on the grounds that it helps with troubleshooting, customer service and understanding network capacity, and that makes sense to us.

If you're the skeptical type, though, there's no need to take these words on trust. In August 2020 HMA announced in a blog post that its no logging policy had been audited by security consultancy VerSprite. HMA passed, the company explained, with VerSprite awarding the minimum possible 'low risk' user privacy impact rating.

The HMA site only gives broad details about the scope of the audit, for example talking about it including 'analyses of data, traffic, and storage on both the client and server-side, and the disconnection of user identities with data containing information about online user activity.'

As the report isn't publicly available, there's no way to judge how meaningful the results might be. Still, it's a start, and we have to applaud any VPN which puts itself through this kind of expert independent scrutiny. Hopefully HMA will run further audits in future, this time with results we can read in full.

Windows app

Signing up for HideMyAss! was easy, and within seconds the website was pointing us to the correct app for our Windows PC. There's a little extra help available – links to Mac, Android and iOS apps, some Linux setup advice – but it doesn't have the depth or detail you'll get with ExpressVPN and other high-end providers.

The Windows interface includes an animated icon of HMA's cartoon donkey mascot, but look past that and it's much like any other VPN app. It has a list of locations, a big On/Off button, and a Settings dialog with some useful tweaks.

The Location Picker doesn't force you to scroll – and scroll, and scroll – to find what you need. You're able to filter locations by continent or type (streaming or P2P optimized), enter text in a search box, or save commonly-used locations as Favorites for speedy access later.

The location names don't have any latency or server load indicators, but there is a Speed Test option which detects your nearest servers and calculates their latencies and download speeds.

Kill switch

HMA's app sidebar contains a small number of configuration options, including a setting to automatically connect to the VPN whenever you access the internet, and to enable the client's two kill switches. Yes, two: if the VPN drops, a system-wide kill switch protects you by blocking internet access, and an optional app kill switch closes down your chosen processes (your browser or torrent client, say).

We tested the kill switch by forcibly closing the Openvpn.exe process and its TCP connection, and monitoring IP leaks when we switched servers. In all cases the client correctly blocked all leaks, preventing our real IP from reaching the outside world.

The app kill switch is unusual, because as well as terminating specific apps if the VPN drops, it also automatically connects to HideMyAss! when you launch those apps. Presumably HMA is thinking, if this app is so important that it must be closed if the VPN drops, then that means it must be protected at all times.

This is a nice idea, and it worked during testing, but it doesn't offer enough control. You might not want to connect to the VPN every time you open your torrent client, for instance, but HideMyAss! doesn't care: once it's on the app kill switch list, that's what will happen.

Even worse, when you close the app, the VPN automatically disconnects. You might also be using the VPN to unblock a streaming site, browse securely or whatever, and want to leave it active, but as before, HideMyAss! doesn't care: these are the rules.

• Get a big discount on HideMyAss! with our exclusive offer here

IP Shuffle

HMA's IP Shuffle feature enables changing your IP address automatically or on demand. It's a straightforward way to reduce the chance of others tracking what you're doing, and might also help you get into a site if you're blocked while using the first IP address HMA allocated to you.

Making this happen is as easy as clicking the Refresh button when you're connected. Alternatively, the app can automatically change your IP at a defined interval (30 minutes, an hour, a day, whatever you like).

There's one potential catch. IP Shuffle works by closing your connection, then immediately reconnecting. This should only take a few seconds, but if the kill switch isn't turned on, your identity and traffic will be exposed for that time.

The app's IP Shuffle interface is careful to point out the problem, though, so most users are unlikely to be caught out. And when the app was properly set, we found IP Shuffle worked perfectly, regularly updating our IP without ever exposing our real identity.

Mac and mobile apps

HMA's other apps have a near identical interface to the Windows version, and once you've found your way around one, you'll have no problem using any of them.

The Mac app opens with the same animated donkey, On/Off button, and status information, for instance, and the location list is exactly the same. If you're not interested in the technicalities then you don't have to do anything beyond tap 'On' when you need the VPN, 'Off' when you don't.

There are some Settings differences. The Mac app doesn't have the App Kill Switch, and it can only use OpenVPN UDP (there's no OpenVPN TCP option). But you still get the system-wide kill switch, and the 'connect automatically when accessing untrusted networks' option.

The Android and iOS apps rearrange their interface to fit smaller screens, and try to avoid excess scrolling. The location picker opens with a list of recently chosen locations, and HMA's suggested streaming servers, for instance, and your Favorites are just a tap away.

We noticed one odd difference, as the iOS app had seven fewer locations (290 vs 297).

The Android app is a close match to Windows for settings. Okay, there's no kill switch (though you can set up Android's built-in version), but you still get IP Shuffle, and auto-connect when you access untrusted networks, and the app adds split tunneling and a Wi-Fi Threat Shield to warn you of network dangers.

HMA's iOS app has almost no settings, unfortunately, beyond the option to automatically connect whenever you access untrusted networks (everything but your home and work Wi-Fi, say).

All the apps are easy to use, and got us quickly connected during testing. The iOS version is particularly underpowered, though, and we'd like more functionality across the range. The lack of WireGuard (or almost any other protocol option) is a particular problem. The company doesn't seem very active, though – as we write, the latest blog post in the Product News section is dated January 2021 – so it doesn't look like we'll see big improvements any time soon.

Performance

We measured HideMyAss! speeds from US and UK locations, both with 1Gbps connections, using several performance testing sites and services (SpeedTest's website and command line app, TestMy.net, Netflix's Fast.com and more). We checked the download speeds at least five times from each site, and then we repeated all the tests in an evening session.

OpenVPN results were lower mid-range at 220-225Mbps in the UK, but jumped to 380-400Mbps in the US. That beats some providers – Windscribe only managed 170-270Mbps with OpenVPN, NordVPN managed 220-350Mbps – but it's a long way behind the leaders. Hide.me's OpenVPN downloads reached 550-580Mbps, for instance, and Mullvad stretched to 700-710Mbps.

There's another problem. While HMA only supports OpenVPN, most of the competition also have WireGuard, and that can make a huge difference. CyberGhost reached 300-415Mbps with OpenVPN, for instance, but when we switched to WireGuard, it managed 830-850Mbps. It's not alone, either: most WireGuard-equipped providers hit download speeds of 500-900Mbps in recent tests.

If your internet connection or device can't handle 100Mbps, let alone 1Gbps, this probably won't matter much. But if you're looking for more performance, perhaps to set up the VPN on a router and handle multiple connections, HMA might not deliver.

• Save yourself a packet with our exclusive HideMyAss! offer

Netflix and streaming

Point your browser at the HideMyAss! website and you'll learn that the service allows you to "stream your favorite TV shows from wherever you are in the world using one of our dedicated streaming servers." Sounds good, but is it true?

The HideMyAss! Windows client enables filtering its location list to display only streaming servers, and right now there are just six of these: four in the US, one in London and another in Frankfurt. That's not exactly a lot of choice, and we wondered whether that would make it easier for streaming websites to detect and block them.

HMA got off to a bad start, when BBC iPlayer detected it and warned content was 'not available in our region.' That's disappointing, as HideMyAss! got us into the site in our last review.

HMA also failed with US Netflix. That's no great surprise – it beats even some of the best VPN providers – but HideMyAss! couldn't unblock Amazon Prime Video or Disney Plus, either.

That's a poor result, and you can do much better elsewhere. CyberGhost, ExpressVPN, Hotspot Shield, NordVPN, ProtonVPN, Surfshark and others all unblocked 100% of our test platforms.

Support

The HideMyAss! support site offers a wide range of resources, including setup guides, a searchable knowledgebase, FAQs, a web forum, and 24/7 live chat for anything urgent.

The web content isn't as in-depth or well-presented as some of the competition. ExpressVPN has a host of detailed setup guides, all easily accessible in a couple of clicks from the support page. HideMyAss! doesn't organize its articles quite as neatly, and when you do find them, there's less information, and occasionally some questionable points.

For example, various troubleshooting guides include recommendations for disabling Windows driver signing checks, resetting the Winsock catalog and other technical steps. This isn't necessarily bad advice if you know what you're doing, but it's also seriously advanced stuff with implications for your security and other apps, and we wouldn't expect it to appear in a general installation tutorial for all levels of user.

HideMyAss! has a community forum, but it's best avoided. There are very few questions, and if the support team respond, it's usually only to say they've created a ticket, which you could have done yourself.

If you can't wait, live chat is on hand for swift assistance. We asked about a Windows installation issue, and within minutes, a support agent began giving us a helpful and accurate solution. That works for us, and overall, we think HideMyAss! should be able to help you solve most common VPN issues.

HideMyAss! review: Final verdict

HMA has more network locations than just about anyone else, its apps are easy-to-use, and we have to applaud any provider that puts itself through a no-logging audit. But below-par speeds and a poor unblocking performance make HMA difficult to recommend, and with no sign of service improvements for a very long time, that seems unlikely to change any time soon.

• Take your pick from today's best VPNs