One letter in the source, twelve euros in the price
#privacy #Proton #ABtesting #OnyxAudit
Before anything else
The value in doing thorough work is not in the pat on the back, it is in the rest that comes after knowing you have done all you could humanly have done to remain impartial and coherent in all matters of the spirit and mind, most of all when the company under examination is one you have praised in earlier work.
On this note it must be made transparent. I am a Proton VPN user, and the VPN service itself is beyond reproach. What I am about to disclose is a different matter entirely, not about the potency of product, or the tardiness of service, it is about the first two letters of the alphabet, a hyphen, and a test.
A systematic literature review of 141 primary studies describes A/B testing as comparing two variants of a piece of software in the field, from an end user's point of view, to enable data-driven decision making.
I reached that paper through Brave's AI summary on 8 August 2026, which surfaced eight references. Seven were companies selling A/B testing software. One was peer-reviewed. I read the peer-reviewed one and cite it here; the wording above is the authors', not a summary of them.
Two words in that definition do the work. In the field, meaning on live users rather than in a lab. And two variants, meaning the same software behaving differently for different people.
The randomisation here was Proton's, not mine. Mine was repetition under fixed conditions: same device, same exit country, same currency, same term tab, signed out, cache and cookies cleared between every reading. Eight readings, with a clear methodology and a precise scope of work followed, because anything less than true is just adjacent to it. An imposter, we don't do those here.
What was already known before I started
Windscribe's published captures show a different price pair from the one I later observed. That matters, because it means the values visible in the test were not necessarily static across time. I therefore treat Windscribe's figures as contemporaneous external evidence of the test, not as a measurement of the results reported below.
This needs saying at the top, because the meta tag at the centre of this story was not my discovery and the piece would be dishonest if it read that way.
On 8 August 2026, Windscribe, a competing VPN provider, published a thread stating that Proton's pricing page serves one of two prices at random, that this was A/B testing rather than an expired sale, and that Proton was lying in saying otherwise. They named the meta tag.
In the r/ProtonVPN thread the same tag had been posted by another user, with a desktop developer-tools screenshot showing both variant values.
So by the time I took my first reading, two independent parties had already published the tag's existence and its two values.
What nobody had done was pair the tag to the price. Showing that a letter changes is not the same as showing what each letter costs. That is the gap this piece fills, and it is the only part of this I claim.
The explanations on the table
Windscribe drew one distinction carefully, and it deserves preserving: price sensitivity testing quotes different people different prices for the same product to see whether sales hold at the higher one. It is not the same as adaptive or dynamic pricing, which uses personal data to tailor a price to an individual. Windscribe said this was the former, not the latter. On that point my readings agree with them.
Earlier, on the r/ProtonVPN thread, Proton VPN's General Manager had replied to users reporting different quoted prices. His comment made three separate statements:
- There is no adaptive pricing going on.
- A sale ended recently and intro prices are going back up; it looks as though this has not universally refreshed.
- The prices in the original screenshots are lower than either previous or current pricing, which looks like an error on Proton's end.
His comment predates both the Windscribe thread and the developer-tools post. He was responding to screenshots of prices, not to the tag. As of writing, there is no statement from Proton after the tag became public. That absence is a fact about the record, not an accusation.
Those explanations make different predictions, which is what makes them testable. Stale content changes once and then stays changed. An A/B assignment does not.
The instrument
The variant letter is server-rendered into the HTML. It appears as a meta tag:
<meta name="ab-test:VpnHpAndPricingVpnPlusSensibility300726" content="A"/>
The prices are not in that document. They hydrate client-side, after the page loads, in the browser.
A plain fetch of protonvpn.com/pricing therefore returns the assigned letter and placeholder values where the prices should be. Any check that does not use a real browser can prove the test exists and cannot show what it charges.
That is the whole methodological problem in one sentence. The letter is on the server; the price is in the browser. To pair them you need to read the source and the rendered page in the same session, on the same device, and photograph both.
Conditions
Held constant across every reading:
- Samsung Galaxy A56 5G, Brave browser, private window
- Proton VPN Secure Core, Finland exit
- Currency set to EUR
- 2 years term tab selected
- Signed out throughout
- Full cache and cookie clear between every reading
- Target: protonvpn.com/pricing
One reading deliberately varied currency, as a control. It is marked below.
The correlation
Two variants, consistently throughout my observation window:
Variant A. VPN Plus at 70% off. €9.99 struck to €2.99/month. Save €168. Billed €71.76 for the first 24 months, then renews at €83.88 every 12 months.
![Screenshot_20260808_070902_Brave]
Variant B. VPN Plus at 65% off. €9.99 struck to €3.49/month. Save €156. Billed €83.76 for the first 24 months, then renews at €83.88 every 12 months.
Eight readings. Eight matches. No exceptions.
Five are exhibited below with device-generated file timestamps. The remaining three were recorded in an earlier working session on the same conditions, logged at the time but not carried into this record as image exhibits. They are counted, not exhibited, and I flag that distinction rather than bury it.
Timestamped sequence, 8 August 2026 (SAST)
| Time | Variant | VPN Plus displayed |
|---|---|---|
| 06:45:24 | B | €3.49, 65% off, billed €83.76 |
| 07:09:02 | A | $2.99, 70% off, save $168 (currency control) |
| 07:32:30 | B | €3.49, 65% off, save €156 |
| 07:34:47 | A | €2.99, 70% off, billed €71.76 |
| 07:59:23 | B | €3.49, 65% off, save €156 |
Windscribe's earlier captures show different promotional figures from those recorded here. I do not treat that discrepancy as a contradiction. Their captures precede my observation window, and my claim is narrower: during the 06:45 to 08:01 SAST window documented here, the assigned variant and rendered VPN Plus price matched on every reading. Whether the test was subsequently reconfigured, contained additional variants, or used a different allocation at that earlier time is not established by these observations.
Tag readings from the same sessions: content="B" at 06:50:41, content="A" at 07:34:36, content="B" at 08:01:44.
The 07:34 session ran tag, price and tab switcher inside 17 seconds. The 08:01 tab switcher shows the source tab reading B and the pricing tab reading €3.49 in a single frame, so the tag-to-price link requires no inference.
The ordering is the argument
B, A, B, A, B. Across 74 minutes. One device, one network, one morning.
Stale content does not alternate. It changes once and remains changed. A sale that had not been universally refreshed cannot produce a sequence that goes back and forth five times in an hour and a quarter.
The currency control
The 07:09 reading was taken in USD and returned $2.99, 70% off, save $168.
Identical numerals to the EUR readings. Proton prices in local numerals rather than converting, so changing currency changes only the symbol. Currency cannot explain any price difference in this series.
The arithmetic
Both variants discount from the same €9.99 list price.
- 70% of €9.99 is €2.997, displayed €2.99
- 65% of €9.99 is €3.4965, displayed €3.49
- €9.99 over 24 months is €239.76
- €239.76 less €71.76 is €168.00, matching A's displayed saving
- €239.76 less €83.76 is €156.00, matching B's displayed saving
Both reconcile to the cent. The list price does not move. Only the discount rate does.
The control
This is the finding that closes the question, and it is visible in single screenshots rather than assembled from several.
In one continuous capture under variant B, and again in one continuous capture under variant A, Proton Unlimited sits directly beneath VPN Plus on the same page and does not move:
38% off. €12.99 struck to €7.99/month. Save €120. Billed €191.76 for the first 24 months, renewing €119.88 every 12 months.
Digit for digit identical under both letters, in the same render, in the same frame as the VPN Plus card that is changing.
Staleness cannot flip one card and spare the card immediately below it in the same document, on the same load.
The tag is named VpnHpAndPricingVpnPlusSensibility. It names VPN Plus. VPN Plus is the only product that moves.
It propagates coherently
The duration selector at the top of the page reads 2 years, 70% OFF under A and 2 years, 65% OFF under B. The comparison table further down the page carries the same figure as the hero card.
One letter governs the entire document consistently. Cache artefacts are not coherent.
A second Proton pricing page
proton.me/pricing sells the same VPN Plus product.
Its source contains no ab-test tag anywhere. Verified twice: find-in-page for ab-test returns 0 of 0, and the full retrieved source contains no such meta tag at all.
It shows one stable price. On the yearly term, VPN Plus at 60% off, €3.99/month, billed €47.88 for the first 12 months, then renewing at €83.88 every 12 months.
The test is scoped to protonvpn.com, exactly as the tag name suggests.
A correction to the public record
The developer-tools post in the Reddit thread stated that the tag reads B in a normal tab and A in a private tab.
My data contradicts this. Every one of my readings was taken in a Brave private window, and I received both letters, alternating five times across 74 minutes.
Private browsing does not determine the variant. Browser state does. The assignment persists across reloads and across new private windows within the same state, and resets on a full cache and cookie clear.
That claim was upvoted and repeated. It is wrong, and correcting it is more useful than confirming the parts everyone already agrees on.
Assignment is browser state, not identity
Following from the above: it is not keyed to IP address. Finland and Japan exits returned the same variant within a single browser state.
This is the part that will be misread, so it needs stating plainly. The evidence points to ordinary randomised assignment. It does not support pricing driven by personal data, location, or device profiling. Anyone citing this work to claim otherwise is going beyond what the readings show.
On the General Manager's first statement, that there is no adaptive pricing going on, my evidence agrees with him.
Bounded impact
The difference is €12.00, once.
€83.76 against €71.76 across the first 24 months. After that both variants renew at €83.88 every 12 months, and that figure is constant across variant A, variant B, and proton.me.
Whatever entry price a visitor is assigned, everyone converges on the same standing rate of €6.99 a month.
The evidence that runs the other way
Stale content does demonstrably exist at Proton, and this belongs in the record because it is the strongest available support for the explanation my readings otherwise contradict.
On 8 August 2026, protonvpn.com advertised more than 20,000 servers in over 140 countries. proton.me advertised more than 15,000 servers in over 120 countries.
Same product. Same company. Same morning. Two different numbers.
That is real, it is unflattering to my conclusion, and I found it in my own captures. Marketing content at Proton does go stale across properties.
What it does not do is explain the pricing behaviour, because staleness cannot alternate five times in 74 minutes, and it cannot flip one card while leaving the card beneath it untouched in the same render.
What this establishes
The promotional price displayed for VPN Plus on protonvpn.com is set by an A/B variant assignment. The claim that displayed pricing varies between visitors reproduces independently, and the variant letter predicts the price every time.
What this does not establish
- That only two variants exist across the entire experiment. Windscribe's earlier captures show a different price pair. My evidence establishes two variants within my observation window, not the complete variant architecture of the test.
- That anyone was misled deliberately. Nothing here speaks to intent.
- That any individual was singled out. Assignment is random per browser state.
- That the difference is statistically significant in the formal sense. Eight readings under fixed conditions demonstrate a correlation, not a powered result.
- Whether
300726is a date, as has been suggested, or an identifier. I have no evidence either way. - What any particular person at Proton knew, or when. The General Manager's comment predates the tag becoming public.
The correlation is what the evidence supports. Everything past it is inference, and inference is not what gets published here.
Sign-off
Looking back on this, it took a lot of testing, and it tried my patience at the best of times. But it was worth every second.
There are still unknowns. Why Proton ran this test, or whether there was any real intent behind it at all, beyond what is published here.
There is something human about how the response to this is shaping. Immediate outrage, then the mood settles a little as the academic way seeks out the answers beyond inference. And no doubt, after reading this, there will be a split of sorts. Some more outraged than before, some will hold their ground.
I am not here to pick their sides. I am here to pick the side of truth.
There is a character in the anime Fire Force, his name Benimaru. He is the calm, stoic warrior who just gets it done without talking too much. Before heading into battle he said:
"Always remember that we are animals first, human second, and everything else is just vanity."
I think that sums up everything in a very appropriate way.
Sources
- protonvpn.com/pricing. Captured 8 August 2026, 06:45 to 08:01 SAST.
- proton.me/pricing. Captured 8 August 2026, 08:03 SAST.
- Quin, F., Weyns, D., Galster, M., and Costa Silva, C. (2023). A/B Testing: A Systematic Literature Review. arXiv:2308.04929 [cs.SE]. https://arxiv.org/abs/2308.04929 · DOI: https://doi.org/10.48550/arXiv.2308.04929
- Windscribe (@Windscribe), thread on X, 8 August 2026, 00:45 SAST. https://x.com/i/status/2085859988090581461
- r/ProtonVPN thread. https://www.reddit.com/r/ProtonVPN/comments/1vhcp0c/
- PetersonProton (General Manager, Proton VPN), comment. https://www.reddit.com/r/ProtonVPN/comments/1vhcp0c/comment/p283fuv/
- ThermalGuacamole6912, comment. https://www.reddit.com/r/ProtonVPN/comments/1vhcp0c/comment/p2d3fmk/
Archived copies retained. Screenshot exhibits retained with original device filenames and timestamps, available on request.
Clayton Bax
Published under ONYX Digital Intelligence Following the #OnyxAudit methodology.
- X: @onyxaudit
- Email: onyxdigitalintelligence85@protonmail.com
- https://github.com/Baximus855
- @Onyx_Digital@mastodon.social
"Adjacent to true is not true."
Truth has no flag nor favour, only a standard. And it's heavy