Protocol · MIRAGE
The VPN that
isn’t there.
Some networks don’t just block VPNs — they hunt them. MIRAGE is our stealth protocol for exactly those networks: nothing on the wire that reads as a VPN, and servers that answer strangers like ordinary websites. Hiding is not something you trade speed for here — calls, games and 4K run over MIRAGE the way they should. Here is what that looks like.
PLAINTEXT · on your device only
GET https://mybank.com/account HTTP/2
1. The Request
Your app makes a request — same as any other day.
2. Sealed On-Device
Encrypted end-to-end before it leaves your hands.
3. The Mirage
To anyone watching the wire, there is nothing to classify — and nothing to block.
4. The Exit
It emerges in the country you picked, from a server that answers strangers like any ordinary site.
- Nothing that reads as a VPN — nothing to classify, nothing to flag
- A connection to an unremarkable server, behaving unremarkably
- Active probes get a normal website response — and nothing else
Not one hop. Several.
MIRAGE relays your sealed traffic across multiple servers. Each hop knows only its neighbours — so there is no single machine, log or operator that could ever reconstruct who did what. You still come out where you chose: the country on the button is the country the internet sees, and the extra hop is picked for you.
You
Knows: you. Sees: sealed data only.
Entry hop
Picked for you, and not always the same one. Knows you exist, not where you’re going.
Relay hop
Knows neither who you are nor your destination.
Exit hop
The country you chose. Knows the destination, has no idea who you are.
No single server ever holds the whole picture.
When someone knocks
🔴 A censor probes the server
It answers like an ordinary website. Nothing to see, nothing to block.
Verdict: boring. Moves on.
🟣 Your app presents its key
The mirage parts — a sealed tunnel opens for you alone.
Verdict: connected. Invisible.
No signature to find
Deep-packet inspection classifies traffic by its shape. MIRAGE leaves no shape that reads as a VPN — there is simply nothing to match.
Answers like a website
Censors actively probe suspected servers. A MIRAGE node responds to strangers like an ordinary web server — boring, and therefore safe.
Entry by key alone
Only a client holding your key can open the tunnel. Without it, no handshake, no tell, no evidence a tunnel was ever possible.
A moving target
What cannot be fingerprinted must be guessed — and MIRAGE is engineered so the guesses stay expensive and wrong.
Built for live traffic
Games, voice and video calls need packets that arrive now rather than perfectly. MIRAGE carries them as the real-time traffic they are, so calls stay clear and matches stay playable.
Two lanes, one tunnel
A call and a download want opposite things. MIRAGE can run both at once — the live one on the low-latency path, the bulk one on the resilient path — so a large download never makes a call stutter.
Tuned to where you are
Networks fail differently in different countries. MIRAGE starts from what is known to work in yours, then corrects itself from what it actually observes on your connection. A wrong first guess costs a little speed — never the connection.
Nothing left half-connected
Name lookups leave from the exit node rather than your device, so they resolve even where your own network interferes with them. And a server that can carry IPv6 does; one that cannot turns it off rather than leaving you waiting on a connection that will never open.
Why we publish behaviour, not blueprints
MIRAGE exists for people on networks where being identified has consequences. Its entire defence is that there is nothing to fingerprint — so its internals stay unpublished, on purpose, permanently. What we do publish is its behaviour: what observers see, what probes get, and what your key unlocks. Judge it by that.
MIRAGE is available on Android, iOS, Windows and macOS with Premium, Family and Business plans.
Just need everyday speed and privacy? Meet Aurora — full speed, fully sealed →
Get MIRAGE →