What is NymVPN?

June 16, 2026 · View on GitHub

NymVPN is the most private way to be online. Open-source, cross-platform VPN client written in Rust. NymVPN routes traffic through Nym's decentralized mixnet for metadata-level anonymity, or over multi-hop AmneziaWG (WireGuard) for low-latency, censorship-resistant tunneling. Unlike conventional VPNs, no single node can correlate who you are with what you do.

What is NymVPN?

A decentralized VPN (dVPN) that protects traffic patterns, not just packet contents. Conventional VPNs replace your ISP with a single trusted operator who can see both your IP and your destinations. NymVPN removes that trusted party:

Mixnet routing — 5-hop onion-encrypted routing through Nym's Noise Generating Mixnet. Anonymized packets are sent through randomized routes, mixed other packet flows and cover traffic, and timing obfuscated to defeat traffic-analysis attacks.
Multi-hop WireGuard — 2-hop AmneziaWG tunneling for performance-sensitive use, with no single node seeing both your origin IP and that of your destination on the web.
Zero-knowledge credentials (zk-nyms) — authentication and payment are cryptographically unlinkable from network usage. No email or account identity is required to connect.
No single point of failure — operated by independent node operators, with no central server to compromise, subpoena, or surveil.

Tech details and cryptography are documented in the NymVPN Litepaper and the Nym Whitepaper.

NymVPN Downloads

Two VPN modes

Two routing modes in a single client, selectable per connection.

Mixnet mode — 5-hop Mixnet. Routes traffic through Nym's mixnet: five independently operated hops with Sphinx packet format, per-hop onion encryption, packet reordering, and cover traffic. Breaks the timing and volume correlations that deanonymize traditional onion and VPN traffic. For threat models where metadata exposure matters — crypto wallets, email, private messaging.

Fast mode — 2-hop AmneziaWG. A decentralized 2-hop tunnel on AmneziaWG, a censorship-resistant WireGuard fork. Lower latency for streaming and browsing, while still ensuring no single operator observes both endpoints.

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│                 │ -> │   Mixnet     │ -> │   Destination   │
│                 │    │  (5 hops)    │    │                 │
│    NymVPN App   │    └──────────────┘    └─────────────────┘
│    (Rust Core)  │    ┌──────────────┐    ┌─────────────────┐
│                 │ -> │  AmneziaWG   │ -> │   Destination   │
│                 │    │  (2 hops)    │    │                 │
└─────────────────┘    └──────────────┘    └─────────────────┘

NymVPN Features

Multi-hop by default — no node sees both your IP and your activity
zk-nym credentials unlink payment/auth data from network usage; no email or account identity required
No centralized logging — the multi-hop architecture makes meaningful traffic logs impractical to keep
Multi-layer onion encryption
Entry/exit node selection
Built-in kill switch with data-leak prevention
Custom DNS
Split tunneling to include or exclude apps from the VPN tunnel
Built-in ad blocking to stop ads, trackers, and malware
Censorship resistance via AmneziaWG, Stealth connect, and QUIC to prevent VPN blocking

Cryptographic stack: Curve25519, AES, ChaCha20-Poly1305, BLAKE2/BLAKE3, Lioness wide-block cipher, Pointcheval-Sanders signatures, Pedersen commitments, NIZK proofs, BLS12-381, post-quantum key exchange.

Independent audits: JP Aumasson (2021), Oak Security (2022), Cryspen (2023–2024), Cure53 (2024). See Nym Audits.

Platforms & Stack

This monorepo contains all NymVPN client source, separate from the Nym network monorepo.

Component	Path	Stack
Core VPN engine	`nym-vpn-core`	Rust
Android	`nym-vpn-android`	Kotlin
iOS / macOS	`nym-vpn-apple`	SwiftUI
Linux / Windows (desktop)	`nym-vpn-app`, `nym-vpn-windows`	Tauri + TypeScript
WireGuard integration	`wireguard`	Rust / C

Contributing

Contributions welcome across the stack: Rust core (networking, crypto, protocols), mobile (Kotlin/SwiftUI), desktop (SwiftUI/Tauri), protocol research, and security review. See the Contribution Guide, Code of Conduct, and Security Policy. Localization is crowdsourced via Crowdin.

Resources

Litepaper · Whitepaper · Roadmap · Audits · Trust Center · Blog

Licensing & Acknowledgements