HMA VPN Review 2024: Is This a Safe VPN You Can Trust?

HMA (formerly HideMyAss) is a relatively cheap VPN that claims to offer more server locations than anyone else. However, it has faced some serious controversies in the past. Is it a VPN that can keep you safe and anonymous online?

To find out, I performed extensive tests on all its features and explored its updated privacy policy. I also checked out several connection issues customers have reported. Plus, I found out if its refund policy holds up and how long it takes to get your money back.

Overall, it’s a decent VPN. While it has many strengths, there are several areas where it underperformed. In many ways, these tests seriously surprised me. For a consistently reliable experience, I recommend trying one of our top-tier VPNs instead.

My global team and I couldn’t watch many top platforms safely with HMA. I utilized an international group of testers to see if we could still stream with our connections encrypted by HMA. It only worked about half the time, and there were some other annoying issues.

While you could technically use a VPN like HMA to access content outside of your region, you should know that this will probably be interpreted as copyright infringement. My teammates and I only connected to servers within our respective countries to perform our tests.

The VPN offers 6 optimized server locations for streaming. Since I live in the US, I was able to test the 4 US ones. My teammate in Germany tested the Frankfurt location, and my UK colleague executed similar tests with the Donkey Town server (yes that is a real place in the UK). Unfortunately, our results weren’t great even with these optimized servers.

Works With: Netflix, Max, Disney+, and YouTube

My team and I were only able to watch Netflix Originals with HMA. This is a version of Netflix that only has the content the platform owns, so you miss out on region-specific shows. This happened to me on the US optimized servers (where I live), and it also occurred for my teammates from Germany and the UK using the optimized servers in their respective locations.

The videos loaded nearly instantly any time I used the US optimized locations

I watched HD videos without buffering on Netflix and Disney+. So far, I was pretty impressed with how well the US optimized servers were working for me.

The US streaming optimized servers in Miami and New York let me watch Disney+ safely

I was also able to stream Max (formerly HBO Max) without issues. There was a strange new CAPTCHA-like puzzle I had to solve, but besides that, I could load videos quickly and watch in HD after about 4 seconds.

In addition, I could watch YouTube with HMA.

Doesn’t Work With: Hulu, BBC iPlayer, ITV, Peacock, and Amazon Prime Video

Using the US streaming-optimized servers, I couldn’t watch Hulu, Peacock, or Amazon Prime Video from the US. I’m a pretty heavy binge-watcher, and I have shows I like to keep up with on all these platforms, so that was disappointing. I never go online without an encrypted connection, so I need a VPN that won’t interrupt my viewing habits.

I also asked my colleague in the UK to test HMA with some more platforms in their region. Normal servers and the optimized location wouldn’t work with BBC iPlayer. On the UK streaming optimized server, they could log in to their ITV Hub account, but they couldn’t play any videos.

I contacted HMA’s support team, but their troubleshooting advice didn’t help. They told me to make sure that the VPN was properly connected to my device. Each IP checker I tested showed that HMA was successfully masking my real IP address. Unfortunately, they couldn’t provide any further advice.

Overall, I can’t recommend HMA for its streaming capabilities. It doesn’t work with many top platforms, and you’ll miss out on the content that’s specific to your region on Netflix when you’re connected. I recommend you try one of the top VPNs for streaming that are all more reliable.

HMA has okay speeds at best, and some servers slow you down a lot. But, you’ll have to use the WireGuard protocol to get decent speeds. OpenVPN was almost 10 times slower in several tests. I wasn’t even able to connect to Mimic, which I’ll elaborate on later.

These are the main factors we look at when running our tests:

• Download speed – measures (in Mbps) the amount of data you can receive from the internet in a determined amount of time.
• Upload speed – also measured in Mbps, determines the amount of data you can send from your computer in a specific time period.
• Ping – measures the time it takes for your information to reach the server and return a signal. This is important in gaming, as higher ping usually translates into lag.

We have a dedicated speed tester in the UK. This way, all of our tests are done with the same connection speed in the same location. In addition, these results are the averages of at least 10 tests on each server. Our tester records speeds on a wide variety of servers to demonstrate a VPN’s overall performance. As stated above, we do not condone any form of copyright infringement and ask that you adhere to all the terms of service agreements applicable to any service you use.

Our tester’s speeds dropped by 28% on nearby servers and 51% on distant ones

The nearby results weren’t bad, but the fastest VPNs might only slow you down by 15% at close range. HMA has made improvements in this area by adding 20 GBPS servers and including WireGuard, so I was hoping it would be faster. I was also surprised that the server in the UK lowered her rates by 37%.

This was the server “Lightning Connect” gave her (its quick connect feature)

HMA has in-app speed tests, but they’re not super accurate. This chooses several nearby servers and gives you download rates and ping results for them. However, these results were often much different from what I got doing tests on my own, so I didn’t find this feature super helpful.

Over 9,000 km from our tester, speeds were always poor. For example, the server in Brazil dropped her speeds by over 70%. That’s disappointing since many VPNs will only reduce your rates by 40% or even less on locations that far away. You can find a VPN that will maintain your speeds much better in this list.

HMA’s ping rates were so high I couldn’t even join an online game. Ping is the most important speed factor to look out for when you’re gaming. You want your rate to be below 85 ms for smooth gaming. Unfortunately, we were never able to get one below 100. This meant I couldn’t even connect to the Counter-Strike: Global Offensive network to find a match.

The closest server still gave me a ping rate of 145 ms

To be fair, all VPNs raise your ping rates some. I’ve also never found a VPN that lets me play games lag-free on long distance servers. However, there are many VPNs that won’t affect your gameplay on nearby servers. I recommend you check out this list of the best VPNs for gaming to stay safe while you play.

HMA has the most locations of any VPN I tested, but its server count isn’t very high. This means it lets you connect to nearly every country on the planet but with a limited number of servers, which can affect speeds. You saw how this played out in our speed tests. PIA offers the most servers at 2,600, but services like CyberGhost and NordVPN also provide many more servers than HMA.

HMA offers 1,110 servers in 210 countries. It has 189 optimized servers for streaming in 6 different locations, including 4 in the US, 1 in the UK, and 1 in Germany. It also has servers specialized for P2P in 8 locations — 3 in the US, 1 in the UK, and 4 in Europe.

I really like how neatly the servers are organized in tab menus on the left side of the app’s interface. You can choose from your favorite servers, the most recent ones you’ve connected to, or the ones optimized for streaming and torrenting without having to scroll through the whole list to find them. Additionally, the optimized servers are marked with icons, which is really helpful when you actually want to search through the whole list.

Torrenting-optimized servers are marked with “P2P”, and streaming ones have a play button

HMA offers great server coverage across the world, including lots of countries in the Middle East and Africa that VPNs usually neglect.

The table below shows you how many countries are offered in each region:

Part of the reason HMA has so many locations is because many of these servers are virtual. These give you an IP address of the country you choose — but they're actually based in another country. This can be safer if it keeps the VPN’s servers out of restrictive countries. But it also negatively affects your speeds when the server is farther away than you expect.

You can see a list of virtual servers on its website, and it also informs you after you’ve connected to a virtual server. However, I wish it told you where the virtual servers are actually located. You’ll have to do your own IP tests to find out.

HMA manages both its physical and virtual servers. Therefore, it still has full control over its servers even if it rents them from a third party. So, there’s no risk to the privacy and security of your data. On the website, it is also briefly explained why HMA uses virtual servers.

The VPN also offers a large number of city-level servers in different countries. For example, in the US, there are servers in more than 50 cities. I like this because when a VPN location is only specified by country, it’s hard to know how close it is. There are 3 city-level servers in Canada, Australia, and the UK, and 2 in France, Germany, Russia, Spain, and Ukraine.

Many people have had issues connecting to HMA, but I was always able to get it working with WireGuard. This was true of its 7-day trial and with the premium VPN. There is also no special trick to connecting, you simply press the connect button on the VPN’s main page. However, I could never connect to the Mimic protocol, and there were some instances where I had to reconnect on OpenVPN. It’s also a bit disappointing it doesn’t offer dedicated IPs like many of its competitors. These are useful for things like running a website.

HMA offers multiple security features. Besides the military-grade encryption, it also has reliable kill-switches, split tunneling, IP Shuffle, and an ad-blocker in its Chrome extensions. Moreover, it didn’t leak my personal information to the websites I was using.

Encryption & Protocols

HMA uses military-grade AES 256-GCM encryption and Perfect Forward Secrecy, which means your data is as safe as it gets. It can get a little technical, but all you really need to know is these features make your connection impossible to hack. If someone were to try, it would take them a few hundred years to get the encryption key.

It also offers 3 secure protocols — OpenVPN (TCP/UDP), WireGuard, and IKEv2/IPSec. WireGuard is only an option for Windows devices. You'll be limited to OpenVPN on Android. Mac and iOS can only use the IKEv2 protocol at the moment, which is nearly as fast as WireGuard. So, you’ll get slower speeds on your Android phone.

It also offers Mimic, but I could never successfully connect during my tests. This is supposed to be its own obfuscation technology that lets you use the VPN on restricted networks, like schools and work. The problems with this protocol could be one reason HMA does so poorly with streaming.

There are guides on HMA’s Knowledge Base page on how to install OpenVPN on macOS if you don’t want to use the IKEv2 protocol. There’s even an option where you can view your OpenVPN connection logs which is helpful if you ever run into some problems with the VPN.

Kill Switch

There are 2 kill switches, which is unique for a VPN. One is a system-wide kill switch, and the other is an app kill switch.

The regular system-wide kill switch cuts your internet connection if the VPN unexpectedly disconnects so that your IP doesn’t get exposed. The app kill switch secures the apps of your choice by blocking internet access to them if the VPN connection drops. The two kill switches are available for Windows and Android, but not for iOS. The system-wide kill switch is also available for macOS.

Keep in mind that none of the kill switches are active by default. This means that, unless you activate them from the Privacy tab, you won’t be fully protected.

IP, DNS, and WebRTC Leaks

HMA manages its own DNS servers and has built-in protection against IPv4, IPv6, and DNS leaks. DNS leaks happen when your DNS requests are accidentally routed through your ISP instead of the VPN. This way, your data will become visible and your ISP will see and log your internet activity. Since HMA has total control over its DNS servers, no third party can see your information.

HMA didn’t leak my IP, DNS, or WebRTC information

IP leaks are similar, but it’s your IP address that gets leaked — meaning that the websites you access will be able to see you and your location when you access them. I ran tests on US, UK, and Tokyo servers and was pleased to find no WebRTC, DNS, or IP leaks.

Split Tunneling

HMA offers split tunneling in its Android and Windows apps. This is a clever feature that allows you to choose which apps you want to secure with HMA. This way, you can route traffic on certain apps through the VPN and leave other apps’ traffic unencrypted, so that they pass through your normal ISP network.

For example, I like to run my browser app through the VPN. Meanwhile, I make sure my banking app routes through my ISP so that I don’t trigger any alerts on my account.

IP Shuffle

The IP Shuffle makes it harder for anyone to track your location because you can randomly change your IP address at a time interval of your choice. Though it’s worth noting that this feature is available for Windows, Android, and macOS but not for iOS.

There’s also an IP Refresh if you would like to manually and quickly change your IP. This feature is useful if you want to be completely protected. Since your IP address can change every 10 minutes, no one will be able to backtrace the connection to you.

Auto-Connect

The auto-connect feature lets you configure when the VPN connects automatically. This is very useful because you can set it to automatically connect and keep you safe when you’re on public WiFi, in case you forget to turn on the VPN yourself. It is available for Windows, Android, macOS, and iOS.

Ad Blocker

HMA’s Chrome extension offers a built-in ad-blocker. This is an awesome addition, especially for all of you that are tired of constantly dealing with unwanted ads like I am. Unfortunately, it’s only available with its extensions. I don’t recommend using these, which I’ll elaborate on later.

Virus Test

HMA’s apps are completely safe and malware-free. Before I downloaded the Windows app, I used the VirusTotal website to check that the installer is clean. I didn’t expect any issues, but I wanted to check just to make sure. Fortunately, the results met my expectations, and there weren’t any viruses or other types of malware in the file.

I tested HMA’s Windows app installer for viruses on VirusTotal

One thing that HMA is missing is multi-hop. This feature further strengthens your online security and privacy by routing your traffic through 2 or more servers, which makes your data practically untraceable.

While HMA has had its controversies in the past, it worked hard to overcome them with a new privacy policy. In 2011, a hacking group used HMA to attack the Sony company. HMA complied with authorities by identifying a hacker, leading to their arrest. There was another incident in 2017 where HMA once again helped identify a user with timestamps.

However, it created a new privacy policy in 2020 that has been verified by an independent audit. It was owned by a different company during its controversies, and there have been no incidents since it was acquired by Avast.

There have also been reports that HMA has sent letters to users about downloading copyrighted materials. This may make you wonder how it knows what people are downloading since it claims not to monitor anyone’s online activities. It’s also located in the UK, which isn’t a privacy-friendly country. So, I can’t call it one of the best VPNs for privacy.

Does HMA Keep Logs? No

Aside from the basic personal information that most VPNs collect to create your accounts (such as your email address, username, activation code, and subscription renewal date), HMA also records the date of connection and a rounded amount of data transferred. But, its policy claims it doesn’t record any information about your location or your online activities.

Additionally, in the Privacy Policy, there’s information on what data is kept on its VPN clients and for what purpose. This includes data about your connection events, i.e., attempts of connection and disconnection, or events when an error occurred during the process. This data is not linked to specific users. You’re reminded to update your apps to the latest versions to avoid potential privacy risks.

There’s an option on the Android app to turn off analytics data sharing with third parties. You can find this option in the Settings menu under the Personal Privacy tab. It is turned on by default, but if you don’t want it, you can turn it off anytime.

HMA keeps the service data for 2 years, and it’s all anonymized

Note that HMA’s web proxy extensions are a separate service to the VPN and the audit below doesn’t cover them. This means that these extensions keep logs and data such as your IP address, domain names of the websites you visit, and timestamps of requests. Because of this I don’t recommend using the extensions.

Was HMA Audited? Yes

An independent cybersecurity firm conducted an audit of HMA's no-logs policy. VerSprite evaluated it and deemed it to have a "low-risk user privacy impact." The firm also highlighted areas for enhancement in the VPN, demonstrating its commitment to delivering high-level security.

On top of that, HMA’s parent company — Avast — publishes a warrant canary 4 times a year. This means you can easily check and see all the requests Avast receives to disclose the VPN’s user data to government agencies. The company is taking transparent steps to distance itself from past instances of data sharing.

Based in the UK

The VPN is based in the UK, which is a member of the 5 Eyes Alliance (a group of countries that collects and shares citizen’s online data). This means that if the government requested your data, HMA would be obligated to hand it over. However, considering that the service has a proven no-logs policy, there shouldn’t be any valuable data that can be traced back to you.

Does HMA Work in China? No

HMA doesn’t consistently work in China.

In theory, its Mimic protocol should help it work in the country, but I could never connect to it.

While the Chinese government has blocked many VPNs, it rarely goes after people for using them. However, my team and I don’t condone any illegal activities. I recommend you read up on the laws before using a VPN in restrictive countries. If you choose to use a VPN in China, you can try one of these VPNs that reliably work in the country.

Torrenting is allowed with HMA. However, note that torrenting copyrighted material is against the DMCA. Torrenting is also completely banned in some countries, so you should check the laws and regulations of your country before deciding to do so. My team and I don’t condone illegal torrenting.

There are 8 server locations optimized for P2P traffic. P2P-optimized servers give you better connection speeds while protecting your privacy at the same time.

HMA’s P2P-optimized server locations have their own tab menu in the Windows app

I was actually able to increase my torrenting speed slightly with one of HMA’s P2P servers. During my test, I tried downloading a 700 MB copyright-free movie. With no VPN, I could finish it in about 7 minutes. So, I was pleasantly surprised when it could be finished in only 5 minutes with HMA’s optimized Miami server.

It doesn’t offer port forwarding, which is a feature that can improve torrenting speeds. But it doesn’t matter, since its optimized servers are so fast. So, I have no issues with HMA’s torrenting performance.