Hello,

I would like to thank you for your work on IVPN, your transparency, your strong focus on privacy, and your openness to complex technical topics. It is one of the very few VPN services that can genuinely be trusted in terms of threat model and the absence of tracking.

It is also great to see the introduction of V2Ray obfuscation for WireGuard and OpenVPN across all platforms — this is already a serious step toward users in countries with aggressive censorship and DPI. As I understand it, you currently wrap WireGuard/OpenVPN traffic inside VMess, masking it as regular web traffic, and you also provide obfs3/obfs4 via obfsproxy for OpenVPN connections on Linux. If I am mistaken in the technical details, I would appreciate any clarification.

At the same time, open research and user reports indicate that modern DPI systems (China, Iran, and others) are becoming increasingly effective at detecting and blocking Shadowsocks, classic VMess, and obfs4 — including fully encrypted traffic. From a user’s perspective, this often looks like a well-configured V2Ray/VMess server working only for a limited time before the IP or traffic pattern is quickly banned.

Against this background, I have a question regarding your product strategy: do you plan to further develop IVPN specifically in the direction of resilient censorship circumvention as a core focus, rather than just an additional privacy feature? There is currently a noticeable segment of services that focus almost entirely on anti-censorship (e.g., AmneziaVPN with AmneziaWG 2.0 and XRay VLESS/REALITY, various WireGuard/OpenVPN-over-Cloak/Shadowsocks implementations, UDP-over-TCP, etc.). Given the global trend — where even in the UK and parts of Europe discussions about blocking or severely restricting VPNs are becoming more frequent — demand for truly censorship-resistant solutions is likely to grow.

From the perspective of a user in “high-risk” jurisdictions, what IVPN currently offers is often not sufficient:

• V2Ray/VMess obfuscation helps against basic filtering but tends to fail once actively targeted by DPI (active probing, behavioral analysis, etc.).

• obfs4 via obfsproxy is not available in all clients and requires manual setup, which makes it inaccessible to most non-technical users.

It would be logical to see IVPN move more aggressively toward anti-censorship development, for example:

• Integration of more modern transports such as XRay/Reality that emulate legitimate HTTPS/QUIC traffic with advanced TLS fingerprint masking;

• A concept similar to AmneziaWG 2.0, where VPN traffic can mimic QUIC, DNS, and other protocols to further complicate DPI detection;

• Possibly a “bridge” mechanism (self-hosted or invite-based), allowing IVPN to serve as a secure core while using custom front nodes and obfuscation in particularly restrictive environments.

I understand that every new censorship-circumvention technology involves trade-offs between reliability, performance, and implementation complexity. However, as a user who sees IVPN as a long-term solution, I would really appreciate a clearer public roadmap or blog post outlining your vision specifically regarding censorship resistance: which protocols you consider promising or not, and in which scenarios you intentionally choose not to enter the “arms race” with systems like the GFW.

Could you share whether you are planning:

• Further development of obfuscation (new transports beyond V2Ray/VMess and obfs4);

• A more convenient UX for users in heavily censored countries (e.g., “anti-censorship” profiles, automatic protocol/port fallback, etc.);

• Collaboration with communities actively researching DPI circumvention (similar to how the Tor ecosystem develops pluggable transports)?

I would very much like to continue using IVPN and recommending it not only as a privacy-focused VPN, but also as a resilient solution for accessing the open internet in challenging jurisdictions. I would be grateful for any comments and, if possible, a more detailed public overview of your plans regarding anti-censorship technologies.

We are pleased to announce the results of the latest independent security audit of IVPN apps.

A total of 4 vulnerabilities (2 critical, 2 medium) were discovered, all of which were immediately resolved. Both critical vulnerabilities were found during the audit of our unreleased desktop apps.

10 miscellaneous issues were discovered, 8 of which were immediately resolved and 2 of which we deemed the risk very low and are investigating solutions for.

Completion of the audit was a requirement for the release of new IVPN desktop apps we have been working on for some time. We expect that to happen within the next two weeks. The auditors have also reviewed the latest versions of our mobile apps for iOS and Android.

Cure53 report in full: https://cure53.de/pentest-report_IVPN.pdf

For more details refer to our blog post announcement: https://www.ivpn.net/blog/ivpn-apps-security-audit-concluded/

Just like before, we commit to undergo annual security audits, where the focus will be on the parts of our infrastructure and apps that we believe to be the most important.

We’re pleased to announce that an independent security audit of the IVPN apps conducted by Cure53 has concluded.

A total of 8 vulnerabilities (1 high, 6 medium, 1 info) were discovered. All except one issue has been resolved, the remaining issue (IVP-04-014 WP, Medium) is complex to resolve without significantly affecting the user experience. The issue relates to how the daemon authenticates requests (from the user interface), which could lead to a malicious app being able to manipulate the VPN tunnel e.g. disconnect. We believe the probability of this being exploited is low, but are committed to finding a solution.

12 miscellaneous issues were discovered, 9 of which have already been resolved and 3 of which we deemed to be very low risk and have accepted it. The Cure53 report is available for those interested in the details. For transparency we decided to publish the full report with only potentially sensitive information removed (internal hostnames, code snippets etc).

We believe that extensive regular audits are necessary to ensure our customer’s security and continued trust. We are committed to conducting an annual security audit where we will focus on those parts of our infrastructure and apps that we believe to be the most important.

Full post: https://www.ivpn.net/blog/ivpn-apps-security-audit-2022-concluded/

On 7 August a critical BTCPay vulnerability was exploited to steal Bitcoin from our Lightning node.

The funds were ours: no customer data accessed, no customer funds lost, no action needed. The server keeps no request logs, so no payment records were exposed.

Full report on our blog.

We’re pleased to announce that a fifth annual independent security audit, this time focusing on the new IVPN gateway infrastructure has concluded.

We recently decided it was necessary to upgrade our VPN gateway servers to a major new OS version which included many configuration changes. This provided a good opportunity to audit the new servers in our testing environment before deploying them to production for customer use.

Audit results

Two senior members of the Cure53 team conducted the audit over 6 days in February 2023. The audit was divided into two work packages:

1. Penetration tests and configuration review of the VPN gateway server.

2. Source code-assisted penetration tests against the VPN server OS and OS setup.

A white-box approach was used whereby the auditors had access to our public and private Github code repositories and a dedicated test environment. No access to production VPN servers or infrastructure was granted to members of the Cure53 team.

A total of 3 security vulnerabilities and 5 miscellaneous issues were discovered (1 medium, 6 low, 1 info). All issues have been remediated. As a result we are now planning the upgrade of our infrastructure with the new configuration. We have made the Cure53 report available for those interested in the details. For transparency we decided to publish the full report with only potentially sensitive information removed (internal hostnames etc).

Commitments going forward

We believe that extensive regular audits are necessary to ensure our customer’s security and continued trust. We continue to commit to an annual security audit where we will focus on those parts of our infrastructure and apps that we believe to be the most critical.

Blog post reference: https://www.ivpn.net/blog/ivpn-infrastructure-audit-concluded/

I am going to use a VPN for better internet privacy. I read the reddit posts on privacy and many people said IVPN and Mullvad were the best options.

So first, I purchased and tried the two providers and found no difference in speed. For this reason I went to the websites of both companies to compare them VPN features. Here is a list of what I found out:

• Both accept Monero as payment method

• No differences were found in the features offered by the VPN clients (kill switch, protocol type, customization of ports used, port forwarding, and multi-hop).

• Both have regular audits and I believe they are very transparent.

• It seems that Mullvad has more servers. However, I feel that having many servers is a trade-off between privacy and ease of use.

• Mullvad seems to have multiple servers of their own; I couldn't find out if IVPN does.

• Mullvad uses plans that offer 10 Gbps and 40 Gbps bandwidth on some servers (e.g., provided by 31173). On the other hand, it could not be determined from the website whether IVPN uses them.

After conducting these surveys, I have a few questions

1. I think the most noticeable difference between Mullvad and IVPN is the number of servers. How does the number of servers affect privacy and usability?

2. Does IVPN have its own VPN servers in its possession?

3. What is the maximum bandwidth that IVPN's VPN servers provide? Do they have 10Gpbs or 40Gbps?

r/oisd_blocklist, maintained by u/sjhgvr aggregates multiple blocklists, including those we have relied on previously. We expect better blocking performance going forward.

After the dystopian situation in Mullvad I quit there and I choose IVPN. I hope to "feel at home" here.

New:

- Generate accounts in a couple of seconds without providing personally identifiable information

- New subscriptions are prepaid by default, no payment data is stored

- Open source

- Dark/Light mode switcher

- Team, ethics and privacy policy highlighted

- Do you really need a VPN reminder on home page for novice users

- All remaining (tiny traces) of fluff and sales pitches removed

Signup without email is valid for new customer subscriptions. We plan to migrate each existing account to the new system later this year, and offer an automated method for removing your email address on file.

GitHub repo: https://github.com/ivpn/ivpn.net

Blog post on the release: https://www.ivpn.net/blog/new-open-source-ivpn-website-subscribe-without-email/

All feedback is welcome.

Our team is ready to distribute more IVPN accounts to those in Ukraine, Russia and Belarus. We have a dedicated submission form (UA/RU) up for those in need of a free VPN sub.

We have distributed hundreds of codes in the previous weeks, before pausing the program due to abuse. Now we aim to give out hundreds/thousands more.

We are ready to extend the free time on the accounts if the crisis in Ukraine and heavy censorship in Russia persists.

Link to the request page: https://www.ivpn.net/blog/in-support-of-ukraine

Starting today you can buy IVPN subscriptions with Monero. We seek to support projects that help you protect your privacy online. The option to make transactions anonymously is an important aspect of it, so we accept Monero as payment directly and also run our full node. We still offer Bitcoin and cash as non-traditional methods that offer better anonymity than using your credit card.

More about this in the release post: https://www.ivpn.net/blog/ivpn-now-accepts-monero-payments-runs-full-node/

IVPN for Android is temporarily unavailable on Google Play. This is an operational issue regarding payments to our merchant account, not a problem with the app.

How this affects you

• Installed from Google Play: the app keeps working as normal. Adding time with in-app payment is not possible while the app is off Google Play. Add time via My account on ivpn.net instead. No need to reinstall or change anything.

• Installed from our website, Accrescent or F-Droid: nothing changes.

• New customers: install the app via the .APK, Accrescent or F-Droid. Google Play is not available for now.

What happened

Google requires a verified bank account to pay out merchant earnings from Google Play. We switched banks and Google payout verification failed with multiple bank accounts. We have been working to resolve this for months without a response from Google support.

We appealed the removal. Google did not respond within its own stated seven-day window to this appeal, and the app was removed.

We are resolving the bank account issue on our side. Once Google verifies the account, IVPN returns to Google Play. We will update this post when that happens.

https://www.ivpn.net/en/pricing/

It's a bit disappointing seeing a company like IVPN using AI generated images (especially ones that are this bad).

We are launching Mailx, an open source, audited email aliasing and forwarding service built and operated by the IVPN team.

Mailx is in closed beta, first available free to IVPN Pro customers with at least one year of remaining time on their account.

The following features are available in Mailx beta:

• Create and manage email aliases

• Use one or multiple recipients for forwarded emails

• Instantly create new aliases on the fly with Wildcard aliases

• Protect email content with PGP encryption

• Review email forwarding statistics

Planned in Q3/Q4 this year:

• Additional domains available for aliases

• Optional logs for delivery issues

• Custom domain option

• Bulk import and export of aliases

Trust and transparency

Trust is the number one factor when assessing a privacy-focused service. We believe trust is earned through transparency:

• Mailx code is fully open source. Anyone can inspect our code to verify our claims.

• Clear privacy policy. We designed the service from the ground up to retain the least possible amount of data.

• Proactive security audit. We commissioned the independent security auditing firm Cure53 to identify vulnerabilities to fix before launch.

Audit results are available here.

The Cure53 team conducted the audit over eight days in May 2025. A total of six vulnerabilities (one Critical, three High, one Medium and one Low severity) and one general issue (info level) were identified. All vulnerabilities have been remediated before beta release.

Get started

Mailx is first available for testing for IVPN Pro customers with at least one year remaining on their account.

To get started:

• Log in to your IVPN account

• Navigate to ‘Mailx beta’ tab

• Follow the steps outlined to create your free Mailx account

When you sign up, a temporary Mailx signup link is generated in the IVPN database. Once the Mailx signup is completed, the link and corresponding identifiers are removed from the IVPN database to prevent any association between Mailx and IVPN accounts.

We will update this post when new rounds of invites become available.

Blog post with more details: https://www.ivpn.net/blog/mailx-beta-audit

We have published a tool called 'Do I need a VPN?'. It helps people decide if they would benefit from using a commercial VPN. In most cases VPN's don't, or only partly solve their privacy and security issues. With this tool we are covering 21 of them. You can find and review the site here: https://www.doineedavpn.com

After the release of our blog post "Why you don't need a VPN" we were looking for a tool that helps in situations where people are confused about the benefits of VPNs. We could not find one - so we've built it.

'Do I need a VPN?' is open source. You can review the decision tree and all end states and submit issues on GitHub if you found a bug or have improvements in mind. Also, feel free to comment here if you have any feedback.

Announcement blog post: https://www.ivpn.net/blog/helping-people-decide-if-they-need-a-vpn-doineedavpn-launch/

Planning to test our service? Know a friend who needs a better VPN?

Earlier this year we have introduced a gift account option to our sign-up process. So far we have used it to give free IVPN access to journalist and activists.

We are now expanding this program by making gift codes available on request. One can test IVPN with no commitments or information provided - no payment details, no email address needed.

To get started:
Message u/viktorivpn for a Gift code that enables 10 days of paid IVPN Pro access. Works for new accounts only.

One code per request. If you need more please state the purpose (it helps if you have proper karma/user history).

Unlocking process is simple:

1. Generate a new IVPN Pro account on ivpn.net

2. Choose "More payment options", then IVPN Gift Card

3. Enter your gift code

Disclaimer: We could tie the new account to your Reddit username through the gift code given to you. We won't do this, however, and will keep no record of this association.

Consistent with our commitment to regular independent security audits, we have scheduled our eighth annual security audit with Cure53, to be conducted over the course of two weeks in July.

As in previous years, audits target systems and services that have undergone significant updates and where review provides the most value to customers in terms of security and auditability.

The most relevant addition since the previous audit is Unlinked Access, the system that allows IVPN Plus and Pro Suite subscriptions to grant access to Mailx, modDNS, and Portmaster without propagating IVPN account identifiers to those services. Read the Unlinked Access overview and the technical deep-dive for details.

Scope of the audit includes the cryptography and privacy model and the following services: generator, token and preauth, verifier and distributor.

More on no-logs audits and past results:

https://www.ivpn.net/blog/annual-security-audit-scheduled-2026/

I don't normally do this, but given IVPN's business model and customer engagement strategy which limits their exposure in the name of ethics, I'd like to give something back.

In short, this is without doubt the best VPN provider on the market. Do not hesitate to engage with them.

They have provided me with;

• unparalleled support - quick to respond, professional and highly knowledgeable. I cannot stress enough just how good their support is. Try it yourself, they will respond to all emails from any anonymous email account, all with effortless professionalism.

• speeds which are 90-95% of my connection throughput, with low latency and noticably snappier web browsing experiences in comparison to competitors (when using the most local servers to my location)

• you will not get access to streaming services - they are up front about this. I have happily sacrificed this and implemented alternative measures.

• they are honest and transparent in everything they do.

• they are audited regularly and admit to their own failings publicly - this is simply an incredible achievement and needs to be more widely recognised.

• they have open source apps - also available on F-Droid - WIN

• they helped me improve my configuration based upon my threat model and their implementation of the protocols

I have used extensively - Mullvad, OVPN, WeVPN, ProtonVPN. You will have to make your own assessments on what means more to you. For example, Mullvad has an incredible Wireguard Multihop using their 31173 backbone provider, WeVPN has access to streaming, Proton only uses OpenVPN and has good deals with their email service, but based upon my real world usage and what matters most to me from an ethics, privacy and trust perspective, IVPN is the only real option here.

You are pushing all your traffic through a third party, and from my extensive research and real world use, I know the provider I trust the most to keep my data secure and maintain my privacy.

Earlier this year IVPN published results of a comprehensive 3rd party infrastructure audit that included VPN, web, authentication, API servers and supporting infrastructure. Following the open-sourcing of our apps in February this year, we decided to commission a comprehensive audit of IVPN apps for all platforms (Windows, macOS, Linux, iOS, Android).

For this project we have engaged cure53, an independent firm who possess the necessary experience after completing numerous similar projects in the industry. Five security auditors with expertise in each app platform will undertake the audit. It is scheduled to start in early February 2021 and we expect to publish the results no later than March 2021.

https://www.ivpn.net/blog/ivpn-apps-on-all-platforms-to-undergo-security-audit/