Double VPN Explained: What Multi-Hop Adds and What It Costs

Double VPN, also called multi-hop, sends your traffic through two VPN servers in a row. The first sees your real IP address, the number that identifies your connection. It does not see where you are going. The second sees your destination but only the first server’s address. Spying on you costs more, but the route is longer and slower.

How a single hop works, and what changes with two

On an ordinary VPN connection, your device builds one encrypted tunnel to one server. A tunnel is a private, encrypted path through the internet. The server decrypts your traffic and forwards it to the website or app you asked for, using its own address as the source. The site sees the server. Your internet provider sees only that you are talking to the server.

The server is the one place where both halves of the picture exist. It knows your IP address and your destination at the same time. That is why a VPN moves your trust to the provider rather than removing the need for trust. Our how a VPN works explainer covers this.

A double VPN splits that picture. Your traffic is encrypted for the exit server, then encrypted again for the entry server. The entry server is the first one you connect to. The exit server is the one that talks to the website.

The entry server strips the outer layer. It sees scrambled data, called ciphertext, heading for a second VPN server. It knows who you are but not what you are doing. The exit server strips the inner layer and sends your request on. It knows what you are doing but sees only the entry server’s address.

Providers describe this as encrypting your traffic twice. That is true, but it is misleading as a security claim. A cipher is the method used to encrypt data. The cipher protecting your data was not the weak point, and a second layer does not make the first one stronger. The gain is in what each server can see, not in how hard the encryption is to break.

The providers’ versions differ in ways that matter:

• NordVPN’s Double VPN connects you to pre-set pairs of servers.
• Surfshark’s Dynamic MultiHop lets you choose both the entry and the exit yourself.
• Proton VPN’s Secure Core always enters through servers that Proton says it owns and runs in Switzerland, Iceland and Sweden. Its servers page listed 125 Secure Core servers on 31 October 2026.
• Mullvad offers multihop as a WireGuard setting and lets you chain any two of its servers.
• IVPN offers multi-hop on both WireGuard and OpenVPN.

WireGuard and OpenVPN are protocols, the sets of rules a VPN uses to build its tunnel. Two features with the same name work differently. Private Internet Access’s Multi-Hop routes your connection through a VPN server plus an additional proxy. A proxy is a server that passes your traffic on to its destination. Windscribe’s Double Hop requires the desktop app together with the browser extension.

The threat model: three cases where a second hop helps

A threat model is a description of who might try to watch you, and how. A second hop helps in three cases.

A compromised or seized exit server. VPN servers are often rented machines in data centers the provider does not control. A data center is a building full of servers. The countries are often chosen for speed rather than for their laws. Someone might gain access to the exit server through a software flaw, an insider or a warrant served on the data center. With a single hop, the user’s real address is then visible on that machine for the length of the session. With two hops, the exit server holds only the entry server’s address.

This is the case Proton makes for Secure Core. It says that if the second server is somehow compromised, your traffic and IP address remain safe. The reason is that the entry server runs on hardware Proton owns, in countries it chose.

A hostile network near you. Anyone watching your side of the connection, such as a network operator, sees you connect to an entry server. With a single hop, that server’s address is also the one that appears at the destination. That gives an observer a simple target to monitor or to request records from. With two hops, the address the destination sees belongs to a different machine, often in a different country.

Correlation. Correlation means linking a user to a destination without logs. An observer matches the traffic going into a server with the traffic coming out of it, by timing and volume. Mullvad’s help page says a single-hop VPN may still allow traffic correlation. It says routing through two servers in separate countries raises the level of privacy, even if one server were compromised. A legal demand would also need the cooperation of two countries rather than one.

There is a limit. An observer who can watch both ends of the chain at once can still match the traffic. Multi-hop makes that more costly, but not impossible. That is why Mullvad offers a separate defense against traffic analysis, called DAITA. Extra hops alone do not stop correlation.

What double VPN does not add

Protection from the provider. Both servers run the same company’s software and answer to the same management. If the company logs, it logs at both hops. So whether a double VPN protects you depends on what the provider keeps, and whether anyone has checked. Our no-logs explainer covers that question.

An audit is an independent check of a company’s claims. NordVPN had its no-logs policy checked by PwC in 2020 and by Deloitte in December 2024. Both checks explicitly included its Double VPN servers in their scope. NordVPN is the only provider in our data whose audit scope names its multi-hop servers.

Anything above the network layer. The network layer is the part of the connection that moves data between machines. A double VPN changes which servers see your data. It does nothing about browser fingerprinting, cookies, the account you log into, or malware on your device. Fingerprinting means recognizing your browser from its unique mix of settings.

A DNS or WebRTC leak bypasses both hops, just as it bypasses one. DNS is the system that turns website names into addresses. WebRTC is a browser feature for voice and video calls. Both can leak your details outside the VPN, and our WebRTC leak test checks for that.

Tor’s separation of operators. Tor is a free network for anonymous browsing. It routes your traffic through three relays run by different volunteers, so no one organization sees both ends. A relay is a computer that passes traffic along. A double VPN uses two servers run by one company. Our VPN vs Tor page covers NordVPN’s Onion Over VPN and the trade-offs between the two approaches.

The cost: a longer path

Every piece of your data travels to the entry server, across to the exit, then to its destination. On the way it is decrypted and encrypted again one more time than usual. The providers say this costs speed:

• NordVPN’s feature page says Double VPN also slows down your connection and may be overkill in everyday situations.
• Surfshark’s page says that in most cases it reduces your overall speed.
• Mullvad says multihop will generally make your connection slower over distance. It also notes that poor peering between internet providers can sometimes make a two-hop route faster than a direct one. Peering is how internet providers connect their networks to each other.
• IVPN calls its multi-hop connections slightly slower than single-hop.

We have not yet tested any of this in our lab, so this page gives no numbers. Our how we test page explains what we will measure.

The protocol you choose also matters. Mullvad’s multihop is a WireGuard setting. NordVPN says that if Double VPN is not visible in its app, you should switch to OpenVPN. Our WireGuard vs OpenVPN page explains why that matters for speed.

Who needs it

Double VPN is for people whose risk includes the exit server being watched. That includes:

• Journalists and their sources
• People organizing under hostile governments
• Anyone who must assume that the data center at the far end could be searched

It also suits users of a provider whose exit servers are rented in countries they do not trust. With two hops, the entry can be placed somewhere else. It is not for streaming, gaming or torrenting. Those need bandwidth, which is how much data your connection can carry, and they gain nothing from a second hop. Our torrenting guide ranks what matters there.

For most people, a kill switch and a provider with a tested no-logs record do more than a second hop. A kill switch blocks your internet if the VPN connection drops.

Which providers offer double VPN (verified 31 October 2026)

The reviews hub links to each provider’s full record. Our privacy ranking weighs multi-hop alongside audits, jurisdiction and payment options. Jurisdiction is the country whose laws a provider must follow.

Related

• VPN vs Tor: which one you need
• What a no-logs policy really covers
• Five, Nine and Fourteen Eyes explained
• WireGuard vs OpenVPN
• What a VPN kill switch does
• Best VPNs for privacy
• Mullvad vs Proton VPN