NymVPN is the most private way to be online. Open-source, cross-platform VPN client written in Rust. NymVPN routes traffic through Nym's decentralized mixnet for metadata-level anonymity, or over multi-hop AmneziaWG (WireGuard) for low-latency, censorship-resistant tunneling. Unlike conventional VPNs, no single node can correlate who you are with what you do.
README
NymVPN is the most private way to be online. Open-source, cross-platform VPN client written in Rust. NymVPN routes traffic through Nym's decentralized mixnet for metadata-level anonymity, or over multi-hop AmneziaWG (WireGuard) for low-latency, censorship-resistant tunneling. Unlike conventional VPNs, no single node can correlate who you are with what you do.
What is NymVPN?
A decentralized VPN (dVPN) that protects traffic patterns, not just packet contents. Conventional VPNs replace your ISP with a single trusted operator who can see both your IP and your destinations. NymVPN removes that trusted party:
Mixnet routing — 5-hop onion-encrypted routing through Nym's Noise Generating Mixnet. Anonymized packets are sent through randomized routes, mixed other packet flows and cover traffic, and timing obfuscated to defeat traffic-analysis attacks.
Multi-hop WireGuard — 2-hop AmneziaWG tunneling for performance-sensitive use, with no single node seeing both your origin IP and that of your destination on the web.
Zero-knowledge credentials (zk-nyms) — authentication and payment are cryptographically unlinkable from network usage. No email or account identity is required to connect.
No single point of failure — operated by independent node operators, with no central server to compromise, subpoena, or surveil.
Two routing modes in a single client, selectable per connection.
Mixnet mode — 5-hop Mixnet. Routes traffic through Nym's mixnet: five independently operated hops with Sphinx packet format, per-hop onion encryption, packet reordering, and cover traffic. Breaks the timing and volume correlations that deanonymize traditional onion and VPN traffic. For threat models where metadata exposure matters — crypto wallets, email, private messaging.
Fast mode — 2-hop AmneziaWG. A decentralized 2-hop tunnel on AmneziaWG, a censorship-resistant WireGuard fork. Lower latency for streaming and browsing, while still ensuring no single operator observes both endpoints.
Independent audits: JP Aumasson (2021), Oak Security (2022), Cryspen (2023–2024), Cure53 (2024). See Nym Audits.
Platforms & Stack
This monorepo contains all NymVPN client source, separate from the Nym network monorepo.
Component
Path
Stack
Core VPN engine
nym-vpn-core
Rust
Android
nym-vpn-android
Kotlin
iOS / macOS
nym-vpn-apple
SwiftUI
Linux / Windows (desktop)
nym-vpn-app, nym-vpn-windows
Tauri + TypeScript
WireGuard integration
wireguard
Rust / C
Contributing
Contributions welcome across the stack: Rust core (networking, crypto, protocols), mobile (Kotlin/SwiftUI), desktop (SwiftUI/Tauri), protocol research, and security review. See the Contribution Guide, Code of Conduct, and Security Policy. Localization is crowdsourced via Crowdin.
.png)
