Double VPN, as the name suggests, routes your traffic through two VPN servers. Not all VPNs offer this feature, because a single layer of VPN encryption is already enough to protect user data in the vast majority of cases. But it is valuable when online anonymity is paramount. Powerful surveillance agencies (imagine nation-states and global ISPs) can launch complex traffic correlation attacks. By monitoring IP linkages, metadata, and packet timing, they may trace outgoing activities to a single user. However, that’s a challenging task. But that’s also a risk that investigative journalists and political activists cannot take. Below, I will explain how Double VPN works, the different data nesting methods, and when you should use it.
What Is a Double VPN?
Double VPN is an advanced online anonymity feature. It routes traffic through a second VPN server, either encrypting it twice on a user’s device or re-encrypting it along the way. I will explain the exact methods in the following paragraphs. The standard VPN routing model sends encrypted user traffic through one VPN server. That server decrypts and forwards it to the target destination. This way, the VPN server sees both the original user IP address and where it’s going. If the server is compromised or logs data, it gets the full picture. Adding a second server ensures that neither one has access to the full details. Of course, that is futile if your chosen VPN inspects browsing activities on both servers. Otherwise, following users online with a Double VPN feature turned on becomes significantly harder.
How Does a Double VPN Work?
You will sometimes see VPN providers, like Surfshark, calling the Double VPN feature Multi-Hop. However, that label carries some technical inaccuracies. Multi-Hop, which is basically VPN chaining, sends traffic through two VPN servers using the following scheme: VPN app encrypts and sends traffic to → server A, which decrypts, re-encrypts, and sends traffic to → server B, which decrypts traffic and sends it to → the target destination. This way, server A does not see the destination address, because the VPN app reserves it solely for server B. Simultaneously, server B does not know the original user IP address, because it only sees traffic coming from server A. This adds protection if any of the servers are compromised. Neither server has the original IP address and target destination as combined data, so tracing it back to a specific user becomes much harder. A genuine Double VPN method, or nested encryption, also sends the traffic through two VPN servers. But in this case, the VPN app encrypts it twice on the user’s device, so you get two encryption layers. It first encrypts data using server B’s public key, and then encrypts it again using server A’s public key. Server A then strips the outermost layer of encryption using server A’s private key. It forwards it to server B, which decrypts the inner layer with its private key and forwards it to the target destination. Both methods are somewhat similar, but only the second one uses genuinely double-encrypted packets. Mullvad and Private Internet Access use the second method. Meanwhile, NordVPN and Surfshark use the first.
Is Double VPN Enough To Protect Anonymity?
A VPN is not enough if you seek comprehensive online anonymity and privacy protection. For casual internet users, standard VPNs repel hackers, and Internet Service Providers (ISPs) cannot inspect their browsing activities. But for political activists and people living under authoritarian regimes, a VPN is but one, yet mandatory, online safety tool. Currently, browser fingerprinting is a highly accurate and widely deployed online tracking method. Whenever you browse online, websites gather a lot of information about your device. These details include:
- Hardware information (GPUs, operating system drivers, display settings, exact graphic card model)
- Browser details (name, version, rendering engine, extensions, plugins, installed fonts)
- Regional settings (timezone, system language, date formatting, daylight saving time setup)
- Network layer (HTTP headers and formatting, ISP, IP and ASN data, network type, TLS handshake information)
- Interface setup (screen metrics, color and pixel ratios, touch support).
The list is not exhaustive. In reality, each browser setup is so unique that it becomes a highly accurate user tracking method. Notice that a VPN masks only some network-layer details. Alongside VPNs, privacy-focused browsers (like Tor Browser), private search engines, and privacy-oriented operating systems help you obfuscate more details from this list.
Pros and Cons of Using a Double VPN
Pros
- Separation of origin IP and target destination
- Protects against single-server breaches
- Double encryption (with the nested-encryption method)
- IP address changes twice
Cons
- Significant connection speed drop
- Increased connection latency
- Uses more device resources
- Still vulnerable to global-adversary timing correlation attacks
- More frequent connection drops
When Should You Use a Double VPN (and When You Shouldn’t)?
To summarize, Double VPN is a feature reserved for specific circumstances. It is highly relevant for investigative journalists and political activists seeking to evade governmental surveillance. Also, users attempting to bypass censorship under authoritarian governments should consider connecting to Double VPN servers. However, it will interfere too much with casual online activities. You should not use it if you are using a VPN for streaming, torrenting, online gaming, securing a public Wi-Fi connection, or simply hiding your browsing activities from ISPs.