HMA Review 2024: Good and Safe VPN With One Major Flaw

Does HMA Provide High Speeds? Only on Local Servers

Throughout testing, HMA gave me quick speeds on most nearby servers. Still, there was a noticeable drop when I connected to distant servers (over 5,500 miles away). It was still fast enough to have minimal buffering, but results might vary if your internet speeds are slow.

There was also an increase in latency when I ran speed tests on servers far from my location. Although this won’t impact your daily browsing, high latency can be annoying when gaming online.

However, HMA’s speed can vary depending on which protocol you choose. Its Windows app uses WireGuard and OpenVPN protocol (TCP and UDP.) It also uses Mimic, a proprietary protocol developed by Avast RSO. Mimic works like obfuscation, helping you hide the data that shows a website you’re using a VPN, so it looks like a regular connection.

I found WireGuard and OpenVPN’s UDP version to be the fastest protocols. WireGuard’s lightweight design reduces latency, while OpenVPN’s UDP improves speed with streamlined communication. These protocols enhance overall HMA’s performance for a smoother online experience and are activated by default in its Windows app.

Speed Test Results

I was impressed by HMA’s fast speeds on nearby servers. This is due to the fact HMA added 20 Gbps speed-optimized servers to provide faster online experiences. During my testing, my speeds decreased only by 15% when connected to nearby European servers.

I also tried London, Belgium, Germany, France, Greece, Canada, the US, Japan, and Australia servers. The London server, closest to me, had a 9% speed decrease with low ping, which is great for all online activities, including gaming. Canadian and US servers, being farther away, had higher ping and dropped my speeds by around 70%.

HMA offers a “Lightning Connect” feature, which should pinpoint the fastest server for you. Unfortunately, it didn’t always work correctly. The automatically selected server in Spain wasn’t faster than those I manually chose in London or France.

The speed test feature built into HMA’s interface seemed like it would be useful to find the fastest server in each location. However, I found that its results didn’t line up with my external speed tests. It often said the traffic was slower than it was, so I wouldn’t rely on it.

If you want a reliable and consistently fast VPN, try ExpressVPN. I tested its distant servers in Melbourne, Australia, which is over 10,500 miles away from my location. My download speed only dropped by 25%, which is impressive considering the distance.

High Ping and Slower Gaming Speeds

I connected to a HMA server and played Counter-Strike: Global Offensive in an online lobby. My gameplay ran smoothly at first, but soon enough, I experienced some significant speed drops.

My baseline speed was 42 Mbps, and my ping was 9 ms before connecting to HMA’s US server. After connecting, my speed was 20 Mbps, which is a decrease of 52%. Also, my ping was way higher at 383 ms, an increase of over 4000%. This caused serious lagging in my online game, making it hard to enjoy playing.

Server Network — Medium-Sized Server Network With Working Connections From Anywhere

HMA offers 1,090+ servers in 210 countries globally, including its physical and virtual servers. This number of locations meant I didn’t have to deal with overcrowded servers and allowed for more reliable connections. It also has many city-level servers — in the US alone, it has servers in over 60 US cities.

It also uses its private no-log DNS servers for your DNS requests, ensuring a safer and faster online experience by encrypting your online communication. These servers also help block malware with content filtering and log less personal data compared to some public DNS services.

I was also impressed by HMA’s anti-DDoS protection on all its servers, which is available for Windows, macOS, iOS, Linux, and Android users.

Furthermore, it rents many of its servers from third-party data centers. While this practice is common, third-party-owned equipment may handle your data when you connect through HMA. Though HMA states that it installs, maintains, and fully controls all of these rented servers, the arrangement may still worry you if you’re a privacy-minded user.

If you want privately owned servers, try CyberGhost’s NoSpy servers. They’re located in privacy-friendly Romania and are fully owned and operated by the provider.

Virtual Servers

The server network HMA offers is especially extensive due to its wide range of virtual servers. These reroute your traffic through countries with physical servers. For example, choosing a virtual server in the US connected me to a physical server in Germany, which had a database of American IP addresses.

Virtual servers often provide flexibility in accessing IP addresses from countries with VPN bans or strict censorship. This helps protect your data in challenging online environments, which is a feature not as easily achievable with physical servers.

However, virtual servers can also put your data at risk if they are located in jurisdictions with weak data protection laws, are susceptible to security vulnerabilities, or are operated by entities that may log and mishandle user data, compromising privacy and security.

Unfortunately, HMA’s app doesn’t tell you if you’ve connected to a virtual server until after you connect. Also, it often doesn’t say where the server you’re connected to is. This is pretty standard, but considering HMA’s privacy issues in the past, I find it a little concerning.

HMA has P2P optimized servers in 8 locations, including the UK, the Czech Republic, France, Germany, the Netherlands, and 3 in the US. It also has streaming-optimized servers in 6 locations — 4 in the US, 1 in Germany, and 1 in the UK.

Security — Advanced Security Features

Encryption — Strong Protocols That Stop Hackers From Snooping on Your Data

HMA uses AES-256-GCM encryption, RSA-4096 handshake, and the SHA-256 hash algorithm, offering robust protection. This encryption is the best, as it’s used by military and government agencies worldwide. If it’s safe enough for them, it’s more than enough for browsing, streaming, and torrenting.

Each browsing session (on every device) is protected by Perfect Forward Secrecy (PFS). This process changes encryption keys each time you connect to HMA. Your key is entirely wiped at the end of each session, so if anyone managed to hack your connection, they could only access the data protected by that key.

VPN Protocols — Several Protocol Options, but All Limited to Specific Apps

HMA offers several protocol options, but all are available on specific apps. For example, HMA’s OpenVPN protocol (TCP and UDP) is only available on Windows and Android apps. Its IKEv2/IPsec protocol can be used on iOS and macOS apps, while WireGuard and Mimic protocols are limited to its Windows app.

HMA’s Mimic protocol is designed by its experts to bypass VPN restrictions and can be compared to ExpressVPN’s obfuscation technology. This means the Mimic protocol helps hide any data that tells websites you’re using a VPN, but can be much slower due to the extra security.

OpenVPN is used for excellent security and fast speeds that make your connection run almost as smoothly as regular traffic. However, the setup can be complicated since OpenVPN is becoming more prone to being blocked by firewalls.

Smart Kill Switch That Prevents Any DNS Leaks

On my Windows and Android devices, the Smart Kill Switch function blocked my internet connection each time I changed the server location or turned off HMA. This prevented DNS leaks briefly while I was disconnected from a VPN server. It also stopped my real IP from being exposed to prying eyes.

HMA offers 2 kill switches in the Windows app. Its regular kill switch secures the overall connection, is activated by default, and is available on Windows, iOS, and Android apps. Its app kill switch can be activated through the app’s settings and helps prevent specific apps from sending data if the connection is lost.

Unfortunately, I couldn’t get the kill switch to work on macOS and iOS devices. If you need a VPN that offers the kill switch and other protective features on iOS, try CyberGhost’s advanced security options on multiple devices instead.

Full Leak Protection on Every Server

I found zero IP, DNS, or WebRTC leaks on HMA’s US, UK, Germany, Australia, and Japan servers. Even though it has its own IP checker feature, I used a third-party leak test site to produce independent results.

My testing showed that HMA hid my location every time, as the results displayed the provider’s server location and IP address instead of mine. This means no one can snatch your personal information if you’re connected to an HMA server.

Split Tunneling — Works Great on Android, but Not Other Devices

For such an established VPN, I expected HMA to provide the split tunneling feature across multiple operating systems, but the option is available only on Android. That’s disappointing as it’s a convenient feature to have. This is especially true if you control LAN devices (like printers) through your WiFi or don’t want to encrypt your connection.

Enabling split tunneling lets you select specific apps and websites not to use the VPN tunnel, so you can still use them to watch local content. For complete multitasking freedom, I recommend you use ExpressVPN’s split tunneling feature for Windows, Android, macOS, and even routers.

IP Shuffle Adds an Extra Layer of Anonymity

HMA takes your anonymity one step further with its IP Shuffle feature, which refreshes your IP address without disconnecting you from the VPN. 

There are 2 ways to use IP Shuffle — you can do it manually by pressing the “Refresh” button on the main screen or by setting a frequency for the IP address to change. I turned it on to refresh my IP address every 30 minutes, but you can create a custom interval. This makes it a lot harder for your online activities to be tracked.

Ad Blocker Available Only Through HMA’s Chrome Extension

With HMA, you also get an ad blocker, but it’s only specific to its Chrome extension and is not part of the VPN. However, this is still very useful, especially if you visit ad-heavy websites, like torrenting sites or YouTube. It worked perfectly when I tested it — I had zero ads while browsing Chrome.

Privacy — Located in the UK but Has a Strict No-Logs Policy

Company Jurisdiction Puts User Privacy at Risk

HMA’s headquarters are in the UK, which means it’s subject to the UK’s extensive data retention laws, passed with the UK Investigatory Powers Act. They allow the government to:

• Intercept electronic communications without a warrant.
• Force ISPs, VPNs, and other companies that handle user data to design backdoors to allow government agencies to bypass encryption.
• Hack devices such as laptops, smartphones, and more.

Being located in the UK also places it under the 5 Eyes intelligence-sharing alliance’s jurisdiction. The location isn’t ideal for a VPN, as any collected user data can be shared with alliance member states, including the US, Canada, New Zealand, and Australia.

I found this alarming, especially since HMA’s history has several instances of cooperation with government authorities.

HMA Handed Over Evidence to the Authorities

In 2011, Sony was hacked by the LulzSec group, which used HMA to carry out a cyber attack. HMA turned over evidence to the authorities in the hacking case, which resulted in the user’s arrest.

Another incident in 2017 led to the arrest of an ex-judge who used HMA to harass an ex-girlfriend. Though it isn’t clear if HMA actively helped in this case, investigators uncovered his IP address using VPN connection timestamps.

At the start of 2020, there was another incident. Avast, HMA’s parent company, was selling user data through a subsidiary company called Jumpshot, which collected internet activity through a browser extension. The data was anonymized to protect users, but people discovered the information could easily lead to individuals. Once the scandal became widely known, Avast closed down Jumpshot.

HMA’s past cooperation with authorities and undesirable jurisdiction keep me from trusting it 100%.

For total confidence that a VPN doesn’t meddle with your personal data, you should use ExpressVPN instead. It is located in the British Virgin Islands, where the laws don’t require businesses to keep, analyze, or share user data.

When Turkish investigators seized ExpressVPN’s server in 2017, they found no personally identifiable information — solid proof of its no-logs policy. This assures me that my data won’t be sold or shared with third parties without my approval.

New No-Logs Policy to Bring Back Trust

After many users turned away from the service, HMA implemented a strict no-logs policy that prioritizes customers’ privacy protection — HMA doesn’t check or record your original IP address, browsing activity, connection timestamps, or any other data that could identify you. This is an industry-standard level of privacy VPNs are expected to provide their customers, so I was relieved to see that HMA is taking this seriously.

It’s worth mentioning that it does collect a small amount of data for analytical purposes. It keeps the data for 35 days before deleting it from the servers. The collected information consists of:

• The day and general time a connection is made (morning or evening)
• The amount of transmitted data (rounded to the hundredth Mb)

Note that the collected data can’t be used to identify you or check your browsing habits. It’s the bare minimum needed to keep HMA running at its best, and it’s a common practice.

HMA is also very open about the third-party trackers they use. I found that its desktop apps use no third-party tools, but iOS and Android apps rely on 3 analytics programs: Google Firebase, Google Fabric Crashlytics, and AppsFlyer. These collect unidentifiable data to help find existing issues and tweak HMA’s marketing approach. Luckily, I could easily opt out of the data collection by toggling the option in the Personal Privacy settings.

Beware of HMA’s free proxy browser extension — it logs your IP address, what websites you visit, and the files you download. Even though you can bypass geo-restrictions quickly with a proxy, it doesn’t fully encrypt your connection. Unlike a VPN, a proxy leaves you vulnerable to being monitored or hacked.

I wouldn’t recommend installing or using its proxy extension to keep your device safe online. Instead, download HMA directly onto your device and use a VPN server to secure your connection.

Independent Audit Verifies No-Logs Policy

As a step to rebuilding its reputation, HMA underwent an independent audit to prove its no-logs policy. Trusted cybersecurity firm VerSprite conducted extensive privacy checks in August 2020 and confirmed the policy seems legitimate.

However, its website fails to discuss the report details, which I find odd considering the positive findings. I contacted VerSprite directly online to ask, but the support representative has yet to reply.

Torrenting — P2P-Optimized Servers but Has Suspended Accounts for DMCA Violation

HMA claims to support torrenting and even provides P2P-optimized servers in 6 locations — the Czech Republic, Germany, the UK, the US, the Netherlands, and France. During tests, I quickly downloaded 2×30 GB files from the public domain in a few hours. So whether you’re after movies, games, or music, you’ll have no problems getting the files on your devices fast.

However, the true stance HMA holds on torrenting is unclear. I found contradictory info on message boards. Users complained their accounts were suspended for using it to violate the Digital Millennium Copyright Act (DMCA).

I contacted HMA directly to confirm the allegations and check if these account suspensions happened before it switched to its strict no-logs policy, but its representative didn’t give a concrete answer. Instead, they only confirmed P2P server locations and suggested restarting my torrent client after connecting, which wasn’t even a part of my question.

For this reason, I don’t recommend HMA for torrenting, even though I had no issues downloading files during my tests. After trying over a hundred VPNs, I found that CyberGhost’s P2P-optimized servers are great for torrenting.

CyberGhost’s excellent security features and strict no-logs policy make downloading files a breeze. Furthermore, its privacy policies ensure a secure and private VPN experience for all online activities, including torrenting. You can rest assured that your online activities won’t be monitored or reported.

Does HMA Work in China? No, HMA Can’t Bypass China’s Firewall

I wasn’t surprised to learn that HMA can’t bypass China’s notorious firewall because only a few VPNs work in China. It offers special sign-up URLs to bypass China’s internet restrictions, but even with these, it still doesn’t work in this restrictive region.

If you need a VPN to maintain access to popular sites blocked in China, use ExpressVPN instead. Its obfuscation technology passes the country’s firewall, so you can use ExpressVPN to access the web in China — as long as you install it before arriving.

However, please note that the protection of a VPN doesn’t give you the license to commit illegal acts.

The customer support options were underwhelming. According to the website, support is available through live chat, email, and the website. However, I couldn’t find a live chat option anywhere on its website, even though it says it has one. I also waited over a week to receive an email reply to my inquiry.

Thankfully, the online resources are very detailed and often provide step-by-step instructions to solve common issues, so it only took me 5–10 minutes to get the answers I sought.

Live Chat — Unavailable at All Times

Even though HMA says its live chat is available in one of its FAQs, I couldn’t find the live chat option to contact an online representative, no matter how hard I tried. When I clicked on the “Help” button in the bottom right corner, I was only presented with FAQs related to my query. I also had an option to contact the Support team through an online ticket.

Live chat is my favorite way of getting help, as it lets me get detailed answers quickly. The fact that it’s not available in support options meant I had to craft a long message and wait for an email response. This is disappointing because I know HMA used to have a live chat feature.

Email Support Team Is Slow to Respond Even to the Most Basic Queries

When I failed to contact live chat support, I turned to HMA’s email ticketing service to get help, only to find it took almost a week to receive a simple answer.

About 5 minutes after submitting my request, I received an automated email saying someone would get back to me as soon as possible. From my experience with other VPNs, I expected to hear back within a maximum of 48 hours — but that didn’t happen. After 5 days, I had to send a follow-up email to chase whoever was responsible for resolving my query.

I finally had a response a few days later — it was very disappointing. The HMA agent was friendly and apologized for the delay but gave me the same information that already exists on the website. Then, he asked why I wanted to cancel my account, even though I never asked to cancel. This made me think that he didn’t properly read my question.

I didn’t get the in-depth answer I was looking for from HMA’s email support team

The only good thing about HMA’s email support is that it doesn’t prioritize paying customers over the free trial users. In both cases, I had the same experience when contacting customer support, so at least you’ll get help regardless of how much you pay.

Website — The Best Way to Get Detailed Help Fast

HMA’s website is very accessible, and out of all available options, Knowledge Base and FAQs are the best way to find troubleshooting help without much delay.

I had no problems navigating through its FAQs — the Help page has a handy search bar, so I only had to type in a word or a phrase. Alternatively, all articles are categorized based on the operating system they relate to or general troubleshooting solutions. Each article contains in-depth information, and some include step-by-step guides with images or videos to guide you.

However, its community forum is no longer available. Even when it was active, many user questions were left unanswered. The ones that were answered usually said that the customer team would contact the user through an email.

If you get HMA and need help, visit the Knowledge Base articles first. Simply type in a term you’re struggling with, like “refunds” or “can’t connect,” it will automatically generate a list of related posts that could help you.

If instant customer support is important to you, use ExpressVPN instead. Its live chat is available 24/7 and offers very responsive and detailed help. It took less than 15 seconds for me to connect to the available advisor. It also took an extra 2 minutes to get easy-to-understand answers, even to the most technical questions.