Obfuscated servers are VPN servers that disguise your VPN traffic so it looks like ordinary web traffic, which lets you connect on networks that block VPNs. They hide the fact that you’re using a VPN from the network you’re on, such as hotel, office or school Wi-Fi. They don’t hide it from the websites you visit, which can still see a VPN server’s address. They’re also usually slower, so turn them on only when a normal VPN connection fails.
Last updated 31 October 2026.
What obfuscation actually hides
A normal VPN encrypts what you do. Nobody on the network can read which sites you open. But the encrypted traffic still has a recognisable shape, and that shape gives the game away.
NordVPN’s obfuscated servers page puts it plainly: when you connect to a regular VPN server, “your ISP can’t see where you go online. But it knows that you’re using a VPN from the way your data looks.” Firewalls built to block VPNs look for exactly that shape.
An obfuscated server changes the shape. The traffic is still encrypted, but it no longer looks like VPN traffic, so the filter lets it pass. That’s the whole job. It doesn’t add more privacy than a normal VPN connection; it adds reach, on networks where a normal connection never gets started.
Here’s the sentence most people miss, from the same NordVPN page: “websites and services that you use can still detect that your traffic is coming from a VPN server based on the IP address.” Obfuscation hides your VPN from the network you’re sitting on. It does nothing about the address the far end sees. If a website blocks VPN addresses, an obfuscated server won’t change that.
So split it into two audiences. The network between you and the VPN server (the hotel router, the office firewall, your internet provider) is who obfuscation is aimed at. The sites and apps at the other end are a separate question entirely, and obfuscation doesn’t answer it.
How obfuscation works
Providers use a few techniques, and they explain them in their own words.
NordVPN describes two. One wraps the VPN data in an extra layer of SSL/SSH encryption so the VPN metadata is out of sight, which its page calls “encryption to conceal your encryption.” The other scrambles the packet header so the data “looks like regular HTTPS traffic filled with meaningless information.”
Proton VPN built a separate protocol for it. Its Stealth announcement says Stealth uses “obfuscated TLS tunneling over TCP,” and explains why that matters: traditional protocols such as OpenVPN, IKEv2 and WireGuard “are relatively easy to recognize on a network,” especially as deep packet inspection spreads.
NordVPN’s newer protocol, NordWhisper, takes a similar line. It “uses web tunnel technology to disguise VPN traffic as regular internet activity,” so it blends in with what browsers send every day.
Deep packet inspection, for the record, is when a network looks inside traffic for patterns rather than just checking where it’s going. Turns out that’s the main thing obfuscation is built to beat. A simpler blocker that just keeps a list of known VPN server addresses is a different problem, and switching servers or protocols is often enough for that one.
What each provider calls it
The feature goes by a different name at almost every VPN, which makes comparing them harder than it should be. Here’s what the five VPNs we cover say on their own pages.
| Provider | Name | How you get it |
|---|---|---|
| NordVPN | Obfuscated servers, plus the NordWhisper protocol | Pick NordWhisper, then “Obfuscated” under Specialty Servers |
| Proton VPN | Stealth protocol | Settings → Connection → Protocol → Stealth |
| Surfshark | Camouflage Mode and NoBorders | Camouflage works on OpenVPN; NoBorders is under Settings → Advanced |
| ExpressVPN | Obfuscation built into its Lightway protocol | Part of Lightway, per its server page |
| PureVPN | Not a headline feature on the pages we read | Check its help centre for your app |
NordVPN runs a group of obfuscated servers in its Specialty Servers list, and its page is unusually frank about who they’re for: “Obfuscated servers are not intended for casual use.” More on NordVPN’s other features in our NordVPN review.
Proton VPN says Stealth is available on all plans, including the Free plan, on its Android, Windows, macOS and iOS apps. That makes it the cheapest way to try obfuscation, since it costs nothing.
Surfshark uses two names. Its VPN in China guide says Camouflage mode “hides typical VPN traffic patterns by using the OpenVPN protocol,” and its ISP guide says obfuscation is included “for the OpenVPN (UDP or TCP) protocol.” Its NoBorders page describes a separate mode that switches on when the app detects someone is restricting your network, “like your school’s firewall or internet provider,” and then shows a list of servers that work best under restrictions.
ExpressVPN doesn’t sell a separate server group. Its server page says its Lightway protocol offers advanced obfuscation, so it’s part of the normal connection rather than a mode you go looking for.
When obfuscated servers help
Honestly, most people at home never need them. A normal VPN connection works fine on almost every home broadband line. Obfuscation earns its place in a few specific situations.
Hotel, airport and conference Wi-Fi. NordVPN’s NordWhisper post names “airports, cafes, conferences, or other locations with managed internet access” as the places where filters often block VPNs. If you’ve ever opened your VPN app in a hotel lobby and watched it spin forever, this is the fix to try.
Office and school networks. Some workplaces and campuses block VPN connections on their Wi-Fi. Don’t forget that these are someone else’s networks with their own rules. If your employer or school forbids VPNs on its network, obfuscation doesn’t change the rule; it only changes whether the firewall notices. Ask first, and if a workplace policy says no, use your mobile data instead.
Journalists and travellers carrying sensitive messages. NordVPN’s page mentions journalists and activists working in restricted areas. A reporter on assignment who needs to reach their newsroom’s email securely from a guesthouse with filtered Wi-Fi is the textbook case.
Traffic-based throttling. Some networks slow down traffic they recognise as VPN traffic. NordVPN lists avoiding this kind of bandwidth throttling as one reason to use obfuscation. A slow connection has other causes too, so rule those out first.
A word on the law, plainly. Some countries restrict or ban VPN use, and NordVPN’s own FAQ acknowledges that a few have banned VPN connections entirely. We don’t give advice on getting around a country’s rules. NordVPN’s NordWhisper post says the same: users should make sure their use “complies with all applicable laws, agreements, and network policies.” When you travel, check the local law before you rely on any VPN, obfuscated or not, and follow it.
The speed cost
Disguising traffic takes extra work, and that work costs speed. The providers say so themselves.
NordVPN’s NordWhisper post says “Due to the extra processing required to disguise traffic, NordWhisper may be slower than protocols like NordLynx or OpenVPN,” and recommends other protocols on regular, unrestricted networks. Proton says Stealth runs over TCP, unlike most popular protocols that use UDP. TCP checks that every packet arrives in order, which is reliable but adds delay on a busy link. Proton does say Stealth can beat “older obfuscated VPN protocols that are generally built on top of OpenVPN over TCP,” but it doesn’t claim Stealth matches its normal protocols.
In practice, the rule is simple. Use your VPN’s fastest default protocol (NordLynx, WireGuard or Lightway) wherever it connects. Switch to obfuscation only when the default fails. Switch back when you leave that network. Skip the habit of leaving obfuscation on all the time; there’s no privacy gain from it on an open network, only a slower connection.
A worked example: three days at a conference hotel
Say you’re a consultant at a three-day conference. The hotel Wi-Fi is fast enough for video calls, but your VPN won’t connect. You have a 40-minute client call on day one and want your work email protected all week.
Step 1: check the basics. Open a browser and finish the hotel’s sign-in page first. Many “blocked” VPNs are really waiting on a sign-in page that the VPN stopped from loading.
Step 2: try the default protocol on two or three servers. If NordLynx or WireGuard still fails on every server, the network is probably filtering VPN traffic, not just one address.
Step 3: switch on obfuscation. On NordVPN, choose NordWhisper and the Obfuscated group. On Proton VPN, choose Stealth. On Surfshark, switch to OpenVPN so Camouflage works, or turn on NoBorders.
Step 4: check the result. Open a “what is my IP” page. If it shows the VPN server’s address, you’re protected.
The connection may feel slower than at home. For a 40-minute video call that’s usually fine; for a large file upload, it may take noticeably longer. If you’ve got a big upload, consider waiting until you’re on a network that allows your normal protocol. When you check out on day three, switch back to the default protocol. That’s the whole routine, and it takes about two minutes.
How to turn obfuscation on
These steps come from each provider’s own pages, read on 31 October 2026. App menus change, so check the provider’s help centre if a label looks different.
NordVPN. Its obfuscated servers page gives three steps: switch to the NordWhisper protocol (it says the Windows app will select it automatically), select “Obfuscated” from the list of Specialty Servers, and to pick a location, click the three dots next to “Obfuscated” and choose a country. Note one wrinkle: the NordWhisper post says NordWhisper “is not selected automatically” as a protocol in general, so on other platforms pick it yourself. NordVPN also suggests switching on the automatic Kill Switch while you’re there, which our guide to what a VPN kill switch is explains.
Proton VPN. Open the app, go to Settings → Connection → Protocol, and choose Stealth.
Surfshark. Its NoBorders page says the mode should activate automatically, but you can turn it on yourself: open the app, go to Settings, scroll to the Advanced tab and toggle NoBorders. For Camouflage, connect with the OpenVPN protocol.
ExpressVPN. Use the Lightway protocol, which carries its obfuscation.
Common mistakes
Expecting it to hide you from websites. It doesn’t. The site still sees a VPN server’s address. NordVPN says so on its own page.
Leaving it on everywhere. It’s slower, and on an open network it adds nothing. Use it as a fallback, not a default.
Mixing it with features that don’t support it. NordVPN says NordWhisper “is not compatible with features such as Dedicated IP and Onion Over VPN.” If you pay for a dedicated IP, our guide on whether you need a dedicated IP covers that trade-off.
Treating it as permission. A firewall that can’t spot your VPN still belongs to someone with rules. Obfuscation is a technical tool, not a legal one.
FAQ: obfuscated server questions
Are obfuscated servers safe?
Yes. They use the same encryption as a normal VPN connection; they just disguise its shape. NordVPN’s FAQ says they provide the same security and privacy level as a regular VPN, while also masking that you’re using one.
Do obfuscated servers make me anonymous?
No. They hide that you’re using a VPN from the network you’re on, not who you are. Accounts you sign in to still know it’s you, and sites still see a VPN server address. Our guide to what a VPN can and can’t hide covers the rest.
Is a Stealth or obfuscated VPN slower?
Usually, yes. NordVPN says NordWhisper may be slower than NordLynx or OpenVPN because of the extra processing, and Proton’s Stealth runs over TCP. Use them only on networks where your normal protocol won’t connect.
Is it legal to use obfuscated servers?
That depends on where you are and whose network you’re on. Some countries restrict VPNs, and many workplaces and schools set their own rules. Check the local law and the network’s policy, and follow both.
The short version
- Obfuscated servers disguise VPN traffic so networks that block VPNs let it through.
- They hide your VPN from the network, not from the websites you visit.
- Each provider names it differently: NordVPN obfuscated servers and NordWhisper, Proton Stealth, Surfshark Camouflage and NoBorders, ExpressVPN’s Lightway.
- They’re slower, so use them only when a normal connection fails, then switch back.
- Follow local laws and the network owner’s rules; obfuscation changes neither.