VPN: the truth
A VPN is useful, but sold with a lot of lies. Here’s what it actually protects.
What a VPN does NOT doA VPN does not protect you from Chat Control’s client-side scanning: that reads
your messages on your device, before encryption and therefore before the VPN. It’s also not an
invisibility cloak: your OS and apps see more than your VPN provider does.
What a VPN does wellIt hides your activity from your ISP and masks your IP address
(and thus location) from the sites you visit. Useful against network surveillance, geolocation
and censorship. One piece of the puzzle, not the solution.
What it's for
A VPN that masks your IP address and encrypts your traffic up to its servers, without ever
asking for a single piece of personal information.
Why it matters
It’s the privacy gold standard. No email, no name: at signup you’re given a plain account
number. Audited no-log policy, a single honest price (€5 per month, no tiers, no false
promises), and payment in cash or Monero. That’s exactly what matters the day a state tries to
cut off VPN access: an account that can’t be tied to your identity, and a payment banks can’t
block.
For whom & when
Everyone, from the citizen bypassing an ID check to the high-risk profile. It’s the VPN to
recommend first.
Install & use
Go to mullvad.net. If the site is blocked in your country, open it through the Tor
Browser or its .onion address. Click “Generate account number”: no email or name is
asked. Save this number in your password manager and never share it, it’s your only access
key.
Choose the duration and payment method. The price is flat. Three routes: bank card (simplest
if not blocked), cash sent by post, or cryptocurrency.
Anonymous crypto payment: click “Create a one-time payment address.” Mullvad shows an
address (Bitcoin or Monero) and an exact amount. Send that amount from your wallet. For
maximum anonymity, prefer Monero (private by default); Bitcoin is simpler but
traceable. See section 09 to buy crypto. Allow about 30 minutes for confirmation.
Download the app from mullvad.net/download (via Tor if the site is filtered) and
install it. On mobile, use the App Store, Google Play, or the official APK if the app was
pulled from your store.
Launch the app, enter your account number, then connect to a server
outside your country, ideally outside the EU (Switzerland, US…). Enable the “kill
switch” (which cuts the internet if the VPN drops) and Mullvad’s DNS.
What it's for
The VPN from the Proton ecosystem, with a genuine free tier (rare and honest).
Why it matters
Swiss-based, audited, open-source. Its free tier has no ads, no data resale and no data cap
(only the number of countries is limited). It’s the ideal on-ramp for a beginner, especially if
you already use Proton Mail.
For whom & when
Beginners, and anyone already in the Proton ecosystem who wants a single account for everything.
Install & use
Go to protonvpn.com and sign in with your Proton account (or create one).
- Install the app (Windows, macOS, Linux, Android, iOS).
Use “Quick Connect” or pick a country, then enable the kill switch and NetShield (ad and
tracker blocking).
What it's for
A small, especially rigorous and transparent VPN provider, on the same model as Mullvad.
Why it matters
Audited no-log policy, no mandatory email, payment in crypto or cash. It even offers
anti-tracking options (network-level tracker blocking) and signup with no identifier at all.
For whom & when
A solid alternative to Mullvad, for pseudonymous and high-risk profiles who want to diversify.
Install & use
At ivpn.net, generate an account (an ID is created for you, no email).
- Pay in crypto or cash, as with Mullvad.
Install the app, connect outside the EU, enable the kill switch and the WireGuard protocol.
What it's for
A VPN with two modes: a fast mode (2 servers, WireGuard) and an anonymous mode that
routes traffic through a 5-node mixnet, mixed with cover traffic.
Why it matters
The mixnet blurs metadata (who talks to whom, and when), even against an observer watching the
whole network, which a classic VPN does not do. Decentralised server network, open-source apps
(GPL), audited by Cure53. Payment can be unlinked from usage through anonymous “zk-nym”
credentials.
For whom & when
Those who want to go beyond a classic VPN against traffic analysis, and accept an anonymous mode
that is much slower and unsuited to streaming and downloads. Paid subscription, with a free
trial.
Good to knowThe Nym network pays node operators with a token (NYM). You don’t need to hold any to use the
VPN.
Install & use
Install NymVPN from nym.com (desktop and mobile).
Use the anonymous mode for messaging and sensitive browsing, the fast mode for
the rest.
To keep your identity unlinked from your usage, pay in cryptocurrency or with zk-nym
credentials.
What it's for
A private encrypted network linking your devices to your server, without ever exposing it on the
public internet.
Why it matters
Instead of opening ports (and getting attacked), Tailscale builds a WireGuard tunnel
between your authorised devices only: your server has no public attack surface. Headscale
is the self-hosted version, so you depend on no third party. WireGuard alone gives full
control, at the cost of manual setup.
For whom & when
Every self-hoster. It’s the safe way to reach your Nextcloud or photos from outside.
Install & use
Install Tailscale on your server and on your phone/PC, connect them to the same account.
Your devices instantly see each other on a private network; reach your server at its Tailscale
address.
- For zero dependency, replace the coordination server with self-hosted Headscale.