Obscura: a VPN designed so it cannot log your activity

Obscura, a VPN service run by Sovereign Engineering, drew attention on Hacker News for one architectural claim: it presents itself as the first VPN that cannot log what users do online, rather than one that merely promises not to. Ordinary "no-logs" VPNs, the company argues, still see both who you are and what you do, so privacy rests on trust in a policy.

Two parties instead of one

Obscura's answer is a two-party relay: a connection runs from the user's device to an Obscura server and on to an independent exit hop operated by Mullvad, which reaches the internet. Traffic is WireGuard end to end, and Obscura says its relays cannot decrypt the packets they forward, because those packets are encrypted to a Mullvad server's WireGuard public key. In the other direction, Mullvad's exit hop sees an Obscura address instead of the customer's, since Obscura performs NAT on the way out. The client connects to Obscura's servers over QUIC, the transport behind HTTP/3, so the tunnel looks like ordinary web traffic and is harder to block.

What users can verify

The app displays the current exit hop's WireGuard public key on its Location page, so it can be matched against the keys Mullvad publishes, and the client source code is on GitHub. In December 2025 the company published an independent audit by Cure53 of its macOS app, network extension and protocol; Cure53 reported no major vulnerabilities within the defined threat model and called the two-party relay design "a significant architectural achievement". Obscura says the few findings were low-impact bugs, since fixed, whose worst case was a crash, not data exposure.

Linux, GPLv3 and the fine print

On September 22, 2026 the service arrived on Linux as a native app with a graphical interface and an experimental command-line version, packaged for the Debian, Ubuntu, Fedora and Arch families; a launch offer gives 25% off with the code LINUX26. The same post announced relicensing from the PolyForm Noncommercial License to GPLv3. Obscura costs $8 a month, takes cards via Stripe as well as Bitcoin over Lightning and Monero, and allows five simultaneous connections per account. WireGuard configuration files cover platforms without a native app, though without the QUIC obfuscation.

One caveat: the no-logging guarantee is the vendor's own description of its design, and the published audit covered the macOS client and protocol, not the whole service. The claims are architectural and open to inspection, but they remain the company's claims.