Technology1 min read

rVPN – stealth VPN with end-to-end encryption

By · Published by Everything Blog

In short

The protocol disguises its communication as regular HTTPS on port 443 and serves a real decoy website whenever censors actively probe the endpoint. Written in Rust to eliminate specific security vulnerabilities, it uses a Double Ratchet mechanism to continuously rekey messages and protect against compromised keys. To evade detection during heavy usage, rVPN relies on pooled multiplexing with credit-based flow control across a small set of long-lived connections. Single-round-trip reconnects are also accelerated using TLS 1.3 session tickets.

Key points

  • The open-source project is distributed under the AGPLv3 license with verifiable reproduci…: The open-source project is distributed under the AGPLv3 license with verifiable reproducible builds on GitHub.
  • PDG Global Limited fully funds development alongside revenue from mobile app sales and co…: PDG Global Limited fully funds development alongside revenue from mobile app sales and community donations.
  • Users can deploy the software via native desktop and mobile applications or a dedicated c…: Users can deploy the software via native desktop and mobile applications or a dedicated command-line interface.

Sources checked by our analysis pipeline: 1

rVPN is an open-source protocol that carries your traffic safely across the internet, indistinguishable from ordinary HTTPS, so it works even where VPNs are blocked.

We believe privacy should be proven, not promised. Every line is open to read, audit, and run yourself.

curl -fsSL https://assets.rvpn.org/install.sh | sudo bash

A censor watching the wire sees ordinary web traffic on port 443. No tell-tale handshake, no blockable fingerprint. If they probe the server, it answers like a normal website.

A Double Ratchet rekeys every message, so a stolen key never unlocks the past or the future.

Probe the endpoint and it serves a real decoy site. Nothing to confirm, nothing to block.

The core is written in Rust, so entire classes of vulnerability cannot occur.

One TLS connection per flow means hundreds of parallel sessions under load: slow to establish, and a shape worth flagging. Pooled multiplexing carries every flow over a handful of long-lived connections, so the wire stays small and ordinary no matter how busy you are.

Every flow pays a full TCP + TLS + WebSocket + X3DH…

Technology