Quick answer
No single VPN is "best" in China — reliability shifts month to month as the firewall adapts. Frequent travelers in 2026 converge on three camps: premium stealth providers (Astrill, ExpressVPN), budget multi-device apps (Surfshark, NordVPN) that need more server-hopping, and self-hosted Shadowsocks on a VPS for full control. The winning strategy is installing two and testing both before you fly.
Why this matters in 2026
Provider rankings that matter for China are nothing like global VPN rankings: the decisive skill here is obfuscation — disguising tunnel traffic as ordinary HTTPS — and providers rise and fall on how quickly they re-route when their servers get blocked. A service that worked in spring can struggle in autumn, and app-store ratings reflect home-country users, not firewall conditions. Choosing by global reputation instead of China-specific track record is the most common expensive mistake.
Key facts at a glance
- Premium picks: Astrill (the expat standby, priced accordingly) and ExpressVPN (consistent stealth, well-known name)
- Budget picks: Surfshark (unlimited devices) and NordVPN — functional but expect more server rotation
- Self-hosted: Shadowsocks or V2Ray on your own VPS, about USD 5–6 per month, the most resilient once tuned
- Reliability pattern: every provider has dead weeks; redundancy beats brand loyalty
- Free VPNs: effectively nonfunctional in China and a data-privacy liability — skip
- Refund windows: most premium providers offer 30-day money-back trials — use them in-country
Step-by-step walkthrough
Step 1: Define what the trip needs
Count devices, list the services you must reach (video calls are the demanding case), and decide whether streaming matters. Needs pick the camp, not marketing.
Step 2: Shortlist one premium and one budget option
The premium covers the critical days; the budget covers the rest. Two subscriptions for one month cost less than one failed meeting.
Step 3: Subscribe and install before departure
From inside China, neither the apps nor the signup pages are reachable. Everything — installs, logins, first connections — happens at home.
Step 4: Configure stealth protocols on both
Enable each provider's obfuscated or "stealth" mode, plus a second protocol as fallback. Save config files for the built-in clients in case the apps fail.
Step 5: Test from home, then again in-country
At home: speed test and a video call on both providers. In-country: note which servers work on which network — China Mobile, Unicom, and Telecom treat tunnels differently.
Step 6: Log what works and refund the loser
Keep a note of working server numbers per city. Within the 30-day window, refund the provider you did not need — that is what the window is for.
Common scenarios and use cases
1. Two-week tourist
One budget provider with stealth mode and patience for server-hopping covers Google Maps and WhatsApp. Add a premium only if the itinerary depends on daily calls.
2. Remote worker on daily video calls
Premium (Astrill or ExpressVPN) or self-hosted Shadowsocks. The cheapest acceptable tunnel is the one that does not drop during a client meeting.
3. Family sharing one subscription
Surfshark's unlimited simultaneous devices, or a budget provider plus a travel router so every device shares one tunnel.
4. Long-stay expat
Self-hosting wins on cost and resilience: a VPS at USD 5–6 per month plus an evening of setup outlasts every blocking wave if configured with obfuscation.
Costs and pricing breakdown
- Astrill: roughly USD 12–15 per month on annual plans; the most expensive mainstream option
- ExpressVPN: roughly USD 8–13 per month depending on plan length
- Surfshark: roughly USD 2–4 per month on long plans; unlimited devices
- NordVPN: roughly USD 3–5 per month on long plans
- Self-hosted VPS: USD 5–6 per month plus setup time
- Two subscriptions for redundancy: USD 5–20 total for a trip month — cheap insurance
Pitfalls to avoid
- Choosing by global app-store ratings: those reviewers are not behind the firewall; China track records live in expat forums and monthly-updated blogs.
- Signing an annual contract untested: use the 30-day money-back window to validate in-country before committing to a year.
- Expecting one server to last the trip: plan on rotating; the skill is knowing your backup numbers, not finding a magic server.
- Sharing one account across a whole office: heavy simultaneous logins get flagged and throttled faster than individual use.
- Deleting the app after a bad week: blocking waves pass; rotate servers and protocols instead of starting over.
Alternatives and trade-offs
- International-roaming eSIM: data exits through your home carrier, bypassing the filter entirely — no VPN needed, at higher data prices.
- Travel router loaded at home: one premium subscription covers every device in the room; see the VPN router guide.
- Corporate remote-access gateway: the licensed, stable route for business travelers whose employer has China infrastructure.
- Local-only toolkit: WeChat, Alipay, Amap, and Trip.com cover most travel tasks; you lose Google-grade search and Western social feeds.
Local context and customs
Shanghai and Beijing expat groups trade working server numbers the way surfers trade swell reports — weekly, and with matching opinions about which provider "died this month." Performance differs noticeably by carrier: China Unicom historically tolerates tunnels better than China Mobile. Provider employees read the same forums travelers do, so real user reports age better than official marketing pages.
Verifying current information
China VPN reliability is a moving target. Cross-check before buying:
- Reddit r/china and r/digitalnomad: weekly "what works" threads
- Provider status pages and their mirror URLs: China server health
- Expat blogs updated monthly: server-by-server, city-by-city reports
- r/China_VPN-type communities: provider-specific troubleshooting
- In-country speed tests: the only review that matters — run your own on arrival
Putting it all together
Pick one premium and one budget provider, install and configure both with stealth protocols at home, and fly with two working tunnels plus saved config files. Log which servers hold up in-country, refund the unnecessary subscription inside the trial window, and keep a roaming eSIM as the deepest fallback. In China the "best service" is whichever one is connected when you need it — redundancy is how you make that always true.
FAQ
Is Astrill worth the higher price?
For daily-reliance users — video calls, work — it remains the most frequently recommended standby in expat circles. Casual tourists can get by with budget options and patience.
What is the cheapest reliable option?
Surfshark or NordVPN at USD 2–5 per month, with the caveat that budget servers need more rotation and are the first to drop in blocking waves.
Which providers keep logs?
Read each provider's policy; the premium players publish audited no-logs claims. For China use, assume any commercial tunnel could be observed and act accordingly.
How much speed do I lose?
Expect 30–60% overhead versus the direct connection, worse at peak evening hours and on congested servers.
Does streaming work through these?
Provider-dependent and server-dependent. Test your specific platforms on the stealth servers before counting on them.
Is provider X working in China right now?
Month to month, nobody can promise it — check the last two weeks of user reports, then verify on arrival. Any answer older than a month is noise.
Are free VPNs usable in China?
No. Their servers are blocked or overloaded, and the privacy cost of free providers is real. Treat "free" as disqualifying for China.
Can I use these on a router?
Most premium providers publish OpenVPN/WireGuard configs for routers; see the VPN router guide for the hardware side.