Is your VPN server where it says it is?

Every VPN lists where each of its servers is. The country a website sees when you connect can still be a different one. That is not always a lie: location is a database's best guess about an address, and some providers place a server somewhere other than the label on purpose. This page explains why the two can differ, how to check yours in a few minutes, and what our own measurements show.

Why a server can be somewhere else than its label

Virtual locations. A provider can list a server under one country while the machine itself sits in another, usually because real servers are scarce or costly in the listed country. The server's address is then set up to look like it belongs to the listed country, so a location database can agree with the label. Some providers say so on their own sites, so look for the word "virtual" in a provider's server list or help pages.
Databases that disagree or lag. A location database is built from registry records, measurements and guesses. Countries are usually right; cities often differ from one database to the next. When an address moves to another place, a database can keep the old answer for a while. Many databases also copy each other, so two agreeing is weaker proof than it sounds.
An address registered in one place and used in another. The records for an address say who holds it and where that holder is registered, not where the machine is. VPN companies often rent servers from hosting companies, so the owner of an address is not always the VPN company, and the registered place can be far from the server.

An example from our own checks: one tunnel sold as Denmark came back from two location databases as two different cities. Both were in Denmark, so the country agreed and the city did not. The address belonged to a hosting company, not to the VPN provider. Nothing in that is a lie. It is what you get when you ask more than one database, which is the point of asking.

Check it yourself

You need a server in a country other than your own, so that a wrong answer shows. These steps use Cloudflare's trace page and ipinfo. Both are theirs, not ours: your browser or terminal asks them, and we are not involved.

Connect and note the label. Connect to one server and write down the country (and city, if it shows one) that your VPN's app says it is in.
Read the country Cloudflare sees. Open https://1.1.1.1/cdn-cgi/trace and look at the line that starts loc=. It is a two-letter country code (such as US or DE), Cloudflare's own answer for the address it sees. From a terminal, run curl https://1.1.1.1/cdn-cgi/trace. On Windows PowerShell, type curl.exe, because plain curl there is something else.
Ask a second source. Open ipinfo.io in the same browser. It shows the address with a country and a city. In a terminal, curl https://ipinfo.io/country prints just the country code. It is ipinfo's database, a different one from Cloudflare's.
Compare the three answers: the label, Cloudflare's country and ipinfo's. Then see the next section.

A hint from ping

Distance sets a floor under delay. Light in fibre covers about 100 km for every millisecond of round trip, and real cables are longer than straight lines, so a server that answers in 10 ms is at most about 1,000 km from you. That makes a fast answer good evidence and a slow one only a hint.

Turn the VPN off. You want the delay from your own connection to the server, not through the tunnel.
Ping the server's own address. Take it from the Endpoint line of a WireGuard config, or from the server's name in your VPN's app. If your app shows only a city, download a WireGuard configuration from your provider's website and use its Endpoint address. Run ping -c 5 address on macOS and Linux, or ping -n 5 address on Windows, and read the average time in ms.
Read it this way. If you chose a server on another continent and it answers in a few milliseconds, it is not on that continent. If a server that should be near you answers slowly, it may be farther away than its label says, but a busy server, a weak Wi-Fi link or a long route can also cost time, so it is a hint and not proof.

Many servers don't answer ping at all. If yours doesn't, you learn nothing from it, and that is not a sign of anything wrong.

What the answers mean

All three agree on the country. As far as the databases can tell, the server is where it says. They can be wrong together, which is why the ping hint is worth a try.
The country agrees and the city doesn't. Normal. City answers differ between databases more than country answers do.
Cloudflare and ipinfo agree with each other but not with the label. The address looks like it belongs to another country. The server may be a virtual location, or the label may be out of date. Look at the provider's own server list and help pages for a note on it.
Cloudflare and ipinfo disagree with each other. One of them is wrong, or lagging. Try another server, or check again another day. This is the same case as "Sources disagree" in our tables.

None of this tells you whether the VPN protects you, only what the internet believes about the address. For the other checks, see the guides below. Websites go by the database's answer, not the label, so the country a site treats you as being in is the one the databases give.

What our data shows

Every row in a node's results table has a Location cell with two lines. Claimed is where the provider's own server list says the server is, quoted exactly. Measured is the country most of our two location databases agree the server's address is in, then how many of the databases that answered agree, so "(2/2)" is both of them. A city is added only when two sources name the same one. If the two differ, the line says "Sources disagree" and the row's details list each answer. That is not a verdict on which one is right: location databases are guesses, and many copy each other, so the count matters more than the word.

Beside it, Served From (CDN) shows where two content networks say they served the tunnel from, a hint that is kept out of the Measured line. Our checks run from inside each tunnel, at a node of ours, so they ask about the server's address, not yours. Each node has its own table, because each is a different place on the internet. Open one with its rows sorted by country (sorting puts one column in order and nothing else: it is not a ranking):

Asia Residential, home line: table sorted by country
Asia Data Center, data center line: table sorted by country
South Africa Residential, home line: table sorted by country

How each source is asked, and what it does and doesn't tell you, is in Methodology: the first location source, ipinfo, Cloudflare's data center and Netflix's server. See also what each column means.

Coming soon

Our own location check, which asks several databases about your address at once, is coming to this page. Until then, the steps above use Cloudflare's trace page and ipinfo.