Introducing Mixnet Tuning in NymVPN

How NymVPN's new controls let you balance speed and anonymity on the Noise Generating Mixnet

14. Juli 20263 Minuten Lesezeit

Most privacy tools give you a single choice: on or off. The Nym mixnet works differently. Every packet you send is deliberately delayed, reordered, and mixed into a stream of decoy traffic, and the precise timing of that process decides how much anonymity you get and how fast your connection feels.

Until now those timings were fixed. Mixnet Tuning opens them up, letting you move NymVPN along the spectrum between raw speed and maximum anonymity while you stay connected. This post explains what the mixnet actually does with your traffic, which controls Mixnet Tuning gives you in the app, and how to choose settings that fit what you're doing.

How the mixnet protects your metadata

A normal VPN hides the content of your traffic and swaps your IP address. It does nothing about metadata: the size, timing, and pattern of your packets, which is often enough for a well-resourced observer to work out who is talking to whom. Nym's Noise Generating Mixnet is built to erase that pattern.

Your traffic travels through three independent mix nodes (plus an entry and exit gateway), one per layer of the network.

At each mix node, every packet is held for a short, random delay drawn from an exponential distribution, then released. Because the delay is random and every mix node is routing traffic from many anonymized users, someone watching a node can't match incoming packets to outgoing ones. This is what mixing means: the more packets reordered together, the harder any single one is to follow.

Two things also run constantly in the background.

Your client sends traffic at a steady, randomized rate whether or not you have data to send; when its queue of real traffic to send is empty, it emits cover traffic, decoy packets that are cryptographically indistinguishable from real ones.
A second stream adds still more cover traffic.

To anyone watching the network, an idle user and a busy one look the same. Every packet is also wrapped in the fixed-size Sphinx format, so packets can't be told apart by length.

What Mixnet Tuning changes

All of this behavior is governed by a few numbers:

How long each node holds a packet
How often your client sends
How much cover traffic it generates.

Nym ships sensible defaults: a 15-millisecond average delay per hop, a packet roughly every 20 milliseconds, and a background cover packet roughly every 200 milliseconds. Together they aim for strong anonymity at a cost of about 1 Mbps of steady throughput and a few tens of milliseconds of added latency.

Mixnet Tuning makes those fixed numbers adjustable. The NymVPN client can now send configuration commands to its underlying service and change how the mixnet behaves mid-session, with no reconnect. In practice, you decide where NymVPN sits on the tradeoff between latency, bandwidth, and anonymity.

Ania Piotrowska, Nym's Chief Scientific Officer, walks through Mixnet Tuning with NymVPN

The two controls

In the app, Mixnet Tuning comes down to two settings:

Send traffic continuously sets how much steady traffic your client keeps up, from about 0.7 Mbps to 2 Mbps. This is your cover traffic: the higher setting maintains a denser, more constant stream that hides your real activity more thoroughly; the lower setting uses less data.
Packet mixing profile sets how long each of the three mix nodes holds your packet, from Low (no added delay) to High (up to 200 ms per hop). More mixing reorders your traffic with more other packets — stronger anonymity, at the cost of latency.

Between them they govern the two things that make the mixnet private: when your packets move, and how well they blend into the crowd.

Tuning for speed or for anonymity

NymVPN already offers two modes: Fast mode, which routes you through a two-hop WireGuard dVPN, and Mixnet mode, which sends your traffic through the mixnet. Mixnet Tuning adds fine control within the mixnet path.

Set both controls low and the mixnet stays light and responsive: little added delay, a lean cover-traffic stream, still private but with a thinner margin against traffic analysis. Set them high and you reach the mixnet's strongest protection, with your metadata buried in randomized timing and a dense stream of cover traffic, hard for even a network-wide observer to follow.

Most of the time you won't need the extremes. The Packet mixing profile is the bigger lever for anonymity, since delay is what actually reorders your traffic; Send traffic continuously mainly changes how much cover you keep up, and how much data that costs.

Using Mixnet Tuning in the app

Both controls live in NymVPN's settings and apply to the mixnet, so they take effect in Mixnet mode. The defaults protect you out of the box, and changes apply to your live connection without reconnecting.

A simple approach:

Leave the defaults for everyday use
Raise the Packet mixing profile when you're doing something genuinely sensitive and can absorb the extra latency
Turn Send traffic continuously up when you want a denser cover stream, or down to save data on a metered or mobile connection.
If a task just needs speed with lighter privacy, Fast mode remains the simpler choice.

Privacy you can dial in

Strong privacy shouldn't depend on one fixed configuration that's wrong for half the things you do. Mixnet Tuning treats anonymity as something you can adjust: safe defaults for everyone, and real control for the people who need to push further. The math underneath doesn't change — only how you choose to use it.

Mixnet Tuning: FAQs

No. The defaults are unchanged and tuned for strong anonymity. Mixnet Tuning only adds the option to adjust them.

Lowering the Packet mixing profile and the continuous-traffic rate reduces your margin against traffic analysis, but it keeps the core protections of layered routing and encryption. The strongest anonymity comes from a higher mixing profile — which is also what adds the most latency. That's the tradeoff to weigh.

Über die Autoren

Ania M. Piotrowska, PhD

Ania ist Chief Scientific Officer von Nym. Sie konzentriert sich auf Sicherheit, verteilte Systeme und anonyme Kommunikation, einschließlich Onion-Routing und Mixnetze.