Choose a configuration
Which configuration you need falls out of the threat model, not from tool popularity. Decide who you are hiding from, then read the row. Each verdict is P1 (identity) or P2 (request linkability) against one actor; the detail text gives the condition. Click a configuration to see its path and full assessment.
| Configuration | IP hiddenP1 @ L2 | Requests unlinkableP2 @ L2 | Local networkP1 @ L3L | Global networkP1 @ L3G | Fast |
|---|---|---|---|---|---|
| Unprotected | ❌identity and contents arrive together | ❌requests trivially grouped by client IP | ❌endpoints, timing and volume visible | ❌L3L and L3G collapse into one observer | ✅ |
| VPN | ✅hides the client IP; the destination sees the VPN's exit IP | ❌connection state groups requests; the exit IP re-identifies across sessions | ❌no in-transit timing protection | ❌the operator sees both ends, effectively a global observer | ✅ |
| dVPN · single exit | ✅the destination sees the exit gateway's IP, not the client | ❌one NATed flow within a session; weak across sessions (exit crowding) | ❌activity fingerprintable | ❌end-to-end flow correlation | ✅ |
| dVPN · multi-exit | ✅the destination sees exit IPs, not the client | ✅given per-request exit rotation and baseline hygiene | ❌as single-exit: activity fingerprintable | ❌as single-exit: end-to-end correlation | ✅ |
| Mixnet · single exit | ✅destination sees the exit gateway's IP, not the client | ❌a fixed exit behaves like a single dVPN exit at the destination: rotate the exit per request | ✅constant-size packets, Poisson rate, cover traffic | ◐resists per-packet correlation; long bulk flows weaken it | ❌5-hop + mixing delays |
| Mixnet · rotating exit | ✅the destination sees exit IPs, not the client | ✅given per-request exit rotation | ✅as single exit: constant-size, Poisson, cover | ◐as single exit: resists per-packet; long flows weaken it | ❌5-hop + mixing delays |
| ★ Hybrid | ✅the bulk tunnel hides the client IP | ✅sensitive requests unlinkable to bulk and to each other (per-request rotation) | ◐bulk activity fingerprintable; sensitive requests unobservable | ◐bulk correlatable but uninformative; sensitive requests protected | ✅fast bulk (dVPN) / slow but timing-safe sensitive (mixnet) |
| End to end | ✅no untrusted destination; the Nym peer never learns your IP | ✅no untrusted destination to link requests | ✅constant-size packets, Poisson rate, cover traffic | ◐resists per-packet correlation; long flows weaken it | ❌5-hop + mixing delays |
Which adversary?
Start from your primary concern and read across.
| Your concern | The adversary | Configuration |
|---|---|---|
| Hide my IP from the service I connect to | L2 identity (P1) | Any transport: dVPN or mixnet |
| Stop the service linking my requests to each other | L2 linkability (P2) | Rotate exits: dVPN multi-exit, or mixnet rotating (not yet shipped, see below) |
| Hide my traffic pattern from network observers | L3L / L3G | Mixnet only (mixing, Poisson, cover) |
| I talk to another Nym client, not a clearnet server | No L2 exists | End to end |
| Fast bulk transfer and timing-safe sensitive requests | All of the above | ★ Hybrid (recommended; its P2 verdict depends on the same rotation) |
Per-request exit rotation is not available in the Nym SDKs yet. A client picks one exit and keeps it, which behaves like a single exit at the destination: P1 holds, P2 does not. So the row above describes the configuration that closes request linkability, not one you can ship today.
Until it lands, the destination can still group your requests. What you can do now is close the other half of the problem, which the transport was never going to close anyway: baseline hygiene disciplines the timing and content of the requests themselves. For a wallet, the difference is between "the server cannot tell which addresses I care about" and "the server can group my queries, but they are padded and decorrelated".
By use case
The same choice framed by what you are doing.
- Latency matters (browsing, streaming, downloads, calls), and your concern is ISPs, advertisers, and websites rather than a network-wide adversary. A dVPN configuration hides your IP at line rate.
- Metadata exposure is dangerous (journalism, activism, whistleblowing, legal work), or your adversary can watch traffic at several network points, and added latency is acceptable. Use the mixnet, the only option that hides the traffic pattern from network observers.
- Both at once: the hybrid runs bulk traffic over dVPN and small sensitive requests over the mixnet.
No transport closes the timing and content vectors (V2/V3) at the destination on its own. That is the job of baseline hygiene, owed regardless of which row you pick.
Reading the verdicts
- ✅ the property holds, subject to the condition in the cell text.
- ◐ partial: it holds against some observation, not all (see the per-configuration page).
- ❌ the property fails.
The "Fast" column is throughput, not privacy. The mixnet's mixing delays make it slow. So bulk traffic belongs on dVPN, and only small, timing-sensitive requests belong on the mixnet.