What Is Double VPN? Multi-Hop Chains, Tor and When to Use One

Double VPN is a mode in which traffic runs through two VPN servers in sequence instead of one. The entry server takes your connection in, the exit server talks to the website, and no single point learns both who you are and where you browse. Vendors also say multi-hop or server chain.

How the chain carries traffic

Your app opens an encrypted tunnel to the entry server, and inside it a second tunnel runs to the exit server, often placed abroad. The exit strips the final layer and sends the request to the site; replies retrace the route in reverse.

The middle matters. In a nested-tunnel design, the inner tunnel runs from your device straight to the exit, so the entry server only relays ciphertext it cannot open. In hop-by-hop relaying, the entry server decrypts and re-encrypts each packet, which means it sees more. Mullvad's documentation of multihop over WireGuard describes the nested case: data stays encrypted end to end even if the first server is compromised. Read the provider's documentation before trusting the label.

Who sees what along the chain

What the second server buys, and where it stops

The gain is split visibility. Seizing or tapping one machine yields half the picture, and entry and exit can sit in different countries. The catch: one company typically operates both servers. If that company logs, it can reassemble the two halves, so an independent no-logs audit says more than the hop count.

Timing analysis is the second weak spot. An observer who watches traffic entering and leaving a network can match patterns of volume and time. Hops in separate jurisdictions and hosting companies raise the cost of that work, and mixnets go further by padding the stream with cover traffic and delays. A chain also does nothing against DPI, which recognises the VPN protocol itself (the job of obfuscation), nor against cookies, browser fingerprinting or accounts you sign into.

Double VPN next to Tor and its hybrids

A Tor circuit, as the Tor Project describes its relay types, runs through guard, middle and exit relays kept by unrelated volunteers. Each relay knows only the hop before and after it, sites see the exit relay's IP, and because relays are listed publicly, some banks and streaming services block them.

Two details sit outside the table. In the Tor over VPN order, your provider sees only the encrypted VPN tunnel and so never learns you use Tor; the guard relay, for its part, sees the VPN server's address instead of your real IP. VPN over Tor, the rare reverse order, helps with sites that refuse Tor exit relays and keeps your IP beyond the VPN company's reach.

The price in milliseconds

Every extra leg stretches the path: latency grows with distance while throughput falls. You also choose from fixed server pairs rather than the full list, and phones drain faster with two tunnels running.

When to switch it on, and when to leave it off

Turn it on for source protection, reporting from monitored networks, activism, or research where linking you to a page is the threat. Leave it off for streaming, gaming, big downloads and everyday browsing on a trusted provider; there the chain only adds lag. Keep the kill switch armed either way: if either leg drops, it cuts traffic so nothing leaks to the ISP in the clear. A self-made chain of two providers (router plus laptop app) splits trust between two companies, but expect routing conflicts and DNS leaks unless you test the stack.

Which services offer double VPN

Out of 543 consumer VPNs VPNRadarLab checked, 57 advertise double VPN or multi-hop, 39 state they lack it, and 447 do not mention it at all. Within those 57, fourteen carry an independent no-logs audit and six add a Tor route. Naming varies: CitadelVPN calls it Double VPN, IVPN multi-hop, Proton VPN runs Secure Core with entry through Switzerland, Iceland or Sweden, NordVPN sells Double VPN alongside Onion over VPN, Surfshark uses Dynamic MultiHop, IPVanish Double Hop, Mullvad multihop, NymVPN pairs a 2-hop mode with a 5-hop mixnet. The double VPN ranking compares these services on scores, prices and terms.

FAQ

Is double VPN safer than a regular VPN?

Against threats aimed at one compromised server, yes. Against a logging provider that runs both ends, no; the audit record decides there.

Does it slow the connection?

Yes: the extra leg adds latency and cuts throughput, and how much depends on how far apart the two servers are.

Double VPN or Onion over VPN?

Onion over VPN distributes trust among volunteer operators and hides Tor use from the ISP; double VPN is faster but leaves both ends with one firm.

Can I stack two VPN apps at once?

Sometimes, typically router plus device. Test for DNS leaks before relying on it.

Double VPN in short

Two servers in a row: one knows who you are, the other knows where you go. It helps against a single watched or seized node, not against a logging provider, and it costs latency and speed.