rVPN – stealth VPN with end-to-end encryption

rVPN How it works Verify Open source Docs

EN EN中文RU

Sign in Download

open source · AGPLv3

Secure transport anyone can verify.

rVPN is an open-source protocol that carries your traffic safely across the internet, indistinguishable from ordinary HTTPS, so it works even where VPNs are blocked.

We believe privacy should be proven, not promised. Every line is open to read, audit, and run yourself.

View source

$ curl -fsSL https://assets.rvpn.org/install.sh | sudo bash copy

auto-detects your OS · verifies checksum · macOS, Linux, FreeBSD

// trusted properties, not promises 100%

open source

:443

looks like HTTPS

0

logs kept

Rust

memory-safe core

// how it works

Hidden in plain HTTPS.

A censor watching the wire sees ordinary web traffic on port 443. No tell-tale handshake, no blockable fingerprint. If they probe the server, it answers like a normal website.

What the network sees

TLS 1.3 · :443 · application/octet-stream indistinguishable

You

your device

encrypted · :443

rVPN node

HK2 · :443

exits clean

Open internet

the open web

Active probe? The node answers like an ordinary website: 200 OK. Nothing to confirm, nothing to block.

01

Forward secrecy

A Double Ratchet rekeys every message, so a stolen key never unlocks the past or the future.

Probe the endpoint and it serves a real decoy site. Nothing to confirm, nothing to block.

The core is written in Rust, so entire classes of vulnerability cannot occur.

One TLS connection per flow means hundreds of parallel sessions under load: slow to establish, and a shape worth flagging. Pooled multiplexing carries every flow over a handful of long-lived connections, so the wire stays small and ordinary no matter how busy you are.

f1

f2

f3

f4

f5

f6

⋮

fN

Every flow pays a full TCP + TLS + WebSocket + X3DH handshake. A busy client holds hundreds of parallel TLS sessions to one server.

f1·f5

f2·f6

f3·f7

f4·fN

Flows share a small pool of long-lived connections. Credit-based flow control keeps bulk transfers from starving interactive ones, and reconnects resume TLS 1.3 tickets in a single round trip.