Obscura VPN
| Developer(s) | Sovereign Engineering Inc. |
|---|---|
| Initial release | February 11, 2025 |
| Engine | |
| Operating system | macOS, iOS, Android, Windows |
| Type | Virtual private network |
| Website | obscura |
Search Obscura VPN on Amazon.
Obscura VPN is a virtual private network (VPN) service operated by Sovereign Engineering Inc., a software company based in the United States. Launched in February 2025, the service routes subscriber traffic through two relays operated by separate organizations: an entry relay run by Obscura and an exit relay run by the Swedish VPN provider Mullvad.[1][2] The company was founded by Carl Dong, previously a maintainer of Bitcoin Core.[3][4]
The design is a response to documented cases in which VPN providers' "no logs" claims were contradicted by law enforcement records, including a 2016 affidavit showing IPVanish had provided user logs to Homeland Security, and a 2017 case in which PureVPN's logs were used to identify an alleged cyberstalker.[5][6] The service's launch, its expansion to Android, its security audit, and its release of a Windows application each received coverage in TechRadar and Tom's Guide.[7][3][8][9][10][11][12]
History
Obscura VPN was developed by Sovereign Engineering, a company whose staff includes developers from the Bitcoin community, including founder Carl Dong, a former Bitcoin Core maintainer.[3][4] The service launched on 11 February 2025, the same day Mullvad publicly confirmed the partnership.[1][2]
The service initially supported only macOS and iOS. In July 2025, it expanded to Android, with the application distributed through Google Play and the open-source distribution tool Obtainium; the release was covered by both TechRadar and Tom's Guide.[8][9]
In May 2025, the German cybersecurity firm Cure53 conducted a twenty-day penetration test and code review of Obscura VPN's macOS application, network extension, and protocol design.[13] The results were published in December 2025 and received coverage in TechRadar and Tom's Guide.[10][11]
In November 2025, the service added support for Monero as a payment method alongside Bitcoin's Lightning Network.[4]
On 26 August 2026, the company released a native application for Windows 10 and 11, with coverage in TechRadar.[12][14] Alongside the Windows release, the company increased the number of simultaneous device connections per account from three to five and announced that a Linux version was in development.[14] The GitHub repository shows active Linux development, including package build scripts for Debian, Ubuntu, Fedora, RHEL, and Arch Linux.[15]
The client software is written in Rust, with platform-specific components in Swift and TypeScript, and its source code is published on GitHub.[15][13]
Design
Obscura VPN uses a two-hop architecture in which the two hops are operated by different legal entities. A user's device first connects to an entry server operated by Obscura, which can observe the user's IP address but not the contents or destination of the traffic. Traffic is then relayed to an exit server operated by Mullvad, which can observe the traffic's destination but not the user's original IP address.[1][2] Coverage in TechRadar and Tom's Guide contrasted this arrangement with conventional single-provider VPNs, in which one company controls both ends of the connection.[7][3]
The service uses the WireGuard protocol, with client traffic transported over QUIC, which the company states makes VPN connections harder to distinguish from ordinary web traffic.[3][4] The company's architecture writeup describes this as a "Two-Party Relay" inspired by Apple's iCloud Private Relay and the [[Internet Engineering Task Force|IETF]]'s MASQUE working group, and notes that QUIC's unreliable datagram extension (RFC 9221) avoids the TCP-over-TCP performance degradation common in earlier stealth VPN protocols.[16]
Accounts are identified by a randomly generated number rather than an email address and cost US$8 per month, with payment options including credit card (via Stripe), the Lightning Network, and Monero.[4]
As of August 2026, the service offers 34 exit server cities across 24 countries operated by Mullvad, and 27 first-hop relay cities operated by Obscura.[4]
Security audit
In May 2025, Cure53 conducted a twenty-day white-box penetration test and code review of Obscura VPN, covering three work packages: the macOS application, the network extension, and the protocol design.[13] The assessment identified six findings: two vulnerabilities (one rated Medium, one Low) and four miscellaneous issues rated Informational. The Medium vulnerability involved unbounded memory allocation in the QUIC message handler; the Low vulnerability involved unbounded parallel QUIC handshakes during relay selection. All identified issues were subsequently fixed and verified by Cure53.[13][17]
Cure53's report concluded that "the implementation does not seem to suffer from any major security issues within the defined threat model" and described the two-party relay system as "a significant architectural achievement."[13] The results were published in December 2025 and received coverage in TechRadar and Tom's Guide.[10][11]
Reception
Coverage in TechRadar framed the two-party design as a response to longstanding trust problems in the VPN industry, while Tom's Guide focused on the company's claims that the service can resist internet censorship.[7][3]
A full review in Tom's Guide evaluated the service's performance and feature set.[18]
A review published by the privacy tool directory PrivacyTools.io rated the service in its "hardened" category, stating that the architecture means the entry operator "cannot log your activity even if it wanted to," while noting platform coverage as the service's main practical limitation at the time of review.[19]
A 2026 review published by Blockdyor tested the service on a connection to a distant server in Tokyo and measured a reduction in download speed from 69 Mbps to 60 Mbps, alongside increased latency attributable to the double-hop routing. The review judged the service suitable for browsing and streaming but noted that the added latency could affect real-time uses such as gaming.[20]
A six-month hands-on review published by bitcoinproducts.com tested the service's multi-hop architecture and payment options.[21]
See also
References
- ↑ 1.0 1.1 1.2 "Mullvad has partnered with Obscura VPN". Mullvad. 11 February 2025. Retrieved 27 August 2026.
- ↑ 2.0 2.1 2.2 "Mullvad Partners with Obscura VPN to Offer Two-Hop VPN System". CyberInsider. February 2025. Retrieved 27 August 2026. line feed character in
|title=at position 34 (help) - ↑ 3.0 3.1 3.2 3.3 3.4 3.5 "Introducing Obscura VPN – the privacy-focused VPN that claims to outsmart internet censorship". Tom's Guide. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 30 (help); Check date values in:|date=(help) - ↑ 4.0 4.1 4.2 4.3 4.4 4.5 "Obscura VPN official website". Retrieved 27 August 2026.
- ↑ Ernesto (4 June 2018). "IPVanish "No-Logging" VPN Led Homeland Security to Comcast User". TorrentFreak. Retrieved 27 August 2026. line feed character in
|title=at position 9 (help) - ↑ Farivar, Cyrus (9 October 2017). "VPN logs helped unmask alleged cyberstalker, say feds". Ars Technica. Retrieved 27 August 2026. line feed character in
|title=at position 4 (help) - ↑ 7.0 7.1 7.2 "Obscura VPN promises to "set the standard for the next-generation of VPNs"". TechRadar. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 33 (help); Check date values in:|date=(help) - ↑ 8.0 8.1 "Android users have just gained access to a new VPN app as Obscura VPN lands on Google Play and Obtainium". TechRadar. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 31 (help); Check date values in:|date=(help) - ↑ 9.0 9.1 "Obscura VPN finally arrives on Android – and it's offering a launch discount". Tom's Guide. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 31 (help); Check date values in:|date=(help) - ↑ 10.0 10.1 10.2 "Obscura VPN just aced its first independent audit". TechRadar. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 32 (help); Check date values in:|date=(help) - ↑ 11.0 11.1 11.2 "Obscura VPN passes first independent audit". Tom's Guide. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 37 (help); Check date values in:|date=(help) - ↑ 12.0 12.1 "Obscura VPN lands on Windows, bringing its "next-gen" privacy to PC users". TechRadar. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 30 (help); Check date values in:|date=(help) - ↑ 13.0 13.1 13.2 13.3 13.4 "Audit-Report Obscura Protocol & MacOS VPN Client 06.2025" (PDF). Cure53. June 2025. Retrieved 27 August 2026. line feed character in
|title=at position 32 (help) - ↑ 14.0 14.1 "Introducing Obscura VPN for Windows". Obscura VPN. 26 August 2026. Retrieved 27 August 2026. line feed character in
|title=at position 24 (help) - ↑ 15.0 15.1 "Obscura VPN Rust library and App". GitHub. Retrieved 27 August 2026.
- ↑ "Bootstrapping Trust". Obscura VPN. Retrieved 27 August 2026.
- ↑ "Obscura's First Independent Audit by Cure53". Obscura VPN. Retrieved 27 August 2026. line feed character in
|title=at position 16 (help) - ↑ "Obscura VPN wants to be the best darn VPN out there – can it?". Tom's Guide. VERIFY. Retrieved 27 August 2026. line feed character in
|title=at position 33 (help); Check date values in:|date=(help) - ↑ Holmberg, Marcus. "Obscura VPN Review: Private VPN in 2026". PrivacyTools.io. Retrieved 27 August 2026. line feed character in
|title=at position 12 (help) - ↑ "Obscura VPN Review 2026". Blockdyor. 2026. Retrieved 27 August 2026.
- ↑ "Obscura VPN Review: Multi-Hop Privacy Testing". bitcoinproducts.com. 2026. Retrieved 27 August 2026. line feed character in
|title=at position 30 (help)
External links
This article "Obscura VPN" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Obscura VPN. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
