AeroNyx Privacy Network vs Traditional VPN: Honest Comparison

AeroNyx Privacy Network is the VPN in the AeroNyx App. Today its trust model is close to that of a traditional VPN, with AeroNyx as the provider. Your traffic goes through one AeroNyx-operated node, and that exit node can see where you connect and which domain names you look up. The real differences are that the node software is open source, that access uses blind-signed vouchers, and that the network statistics are public and aggregate.

Short answer

Question	Traditional VPN	AeroNyx Privacy Network today
Who runs the servers?	The VPN company	AeroNyx. All production nodes are operated by AeroNyx.
How many servers does your traffic pass through?	One	One. The VPN is a single-node gateway.
Can the exit server see destination IP addresses?	Yes	Yes
Can the exit server see DNS lookups?	Usually yes, when it runs the resolver	Yes. The node runs a DNS forwarder for VPN clients.
Can it read HTTPS page content?	No	No
Is the server software open source?	Usually not	Yes. The software is AGPL-3.0, at github.com/AeroNyxNetwork/AeroNyx.
Is the client app open source?	Varies	No. The AeroNyx App is closed source.
How does the server know you may connect?	Usually by account login	By a blind-signed voucher and a throwaway client key
Does the provider keep session records?	It depends on the provider	Yes. The backend keeps a record of each session (see below).

If you need protection from the VPN provider itself, AeroNyx does not offer that today. Like any VPN, it moves trust from your network operator to the VPN operator, which is AeroNyx.

How a connection works

The app gets a batch of access vouchers from AeroNyx. The app blinds each voucher before AeroNyx signs it, so the signature cannot later be linked to the request that produced it.
You pick a node. The app opens an encrypted UDP tunnel to it and presents one voucher along with a client key generated just for that connection.
The node checks the voucher's signature against AeroNyx's published issuer keys and accepts the tunnel. It does not receive your wallet address or account.
The node forwards your traffic to the internet. It also forwards your DNS queries to a public resolver.

The current node list, with locations and health, is published at GET https://api.aeronyx.network/api/privacy_network/vpn/servers/. Today it includes nodes in Japan, South Korea, Germany and Taiwan.

What the exit node can see

The exit node forwards your traffic, so it handles everything a VPN server handles:

Destination IP addresses and ports. The node necessarily sees the destination of the traffic it forwards.
DNS lookups. The node receives your DNS queries and forwards them to a public resolver. The node software does not parse or log query names, but the queries pass through it and the upstream resolver sees them.
Your network address, traffic volume and timing. A single node sees both your connection and your traffic toward the internet, so it could correlate them.
Unencrypted content. If a site uses plain HTTP, the exit node and anyone after it can read or alter the traffic. HTTPS keeps page content encrypted from the exit node.

What AeroNyx records

The AeroNyx backend keeps a record of each VPN session. The record includes the node, the client key, bytes in and out, the start and end times, and a SHA-256 hash of the client IP address. Node operators can see the same per-session records for their own nodes in Nodeboard. From there they can end sessions and queue bans for a client key.

When the app connects with a voucher, the client key in that record is a throwaway key that does not identify your account. AeroNyx still knows which account requested vouchers and how many connections it uses, because it counts connections against your plan. Vouchers stop a session record from naming you. They do not rule out linking by timing.

For how long records are kept and how legal requests are handled, see the AeroNyx Trust Center.

What is actually different

The node software is open source. It is published under the AGPL-3.0, so anyone can read it and check what a node does with traffic, including the DNS forwarder and the session reports. Anyone can also run their own node. Note that you cannot verify which build a production node runs, and the app itself is closed source.
Access uses blind-signed vouchers. The node checks a credential that was signed without AeroNyx seeing it, instead of checking a login. See Blind-Signed Vouchers and Anonymous Access Credentials.
Statistics are public and aggregate. Network-wide traffic, session counts and node health are published at GET https://api.aeronyx.network/api/privacy_network/vpn/public/network-stats/. They contain no per-user data. See AeroNyx Network Stats and Privacy Boundary.
Chat can use a two-hop route. This applies to chat, not to web traffic. With the optional Use privacy route first setting, one-to-one chat messages go through two AeroNyx nodes in onion layers, so neither node sees both ends. The setting is off by default. The VPN tunnel itself remains one hop.

The VPN does not make your chat more private on its own. Turning on the VPN does not change how chat messages are routed.

Limits

AeroNyx does not provide anonymity against AeroNyx itself, against a single compromised node, or against anyone who can watch both sides of a connection. It does not hide traffic patterns. It does not protect a compromised device. Users remain responsible for how they use the network. For stronger privacy, use HTTPS everywhere, use encrypted DNS in the apps that support it, and choose tools that match your threat model.

Frequently asked questions

Is the AeroNyx VPN decentralized?

No, not today. The VPN is a single-node gateway, and AeroNyx operates every production node. The node software is open source, so others can audit it and run it.

Can the AeroNyx exit node see which websites I visit?

Yes, the exit node can see the IP addresses you connect to and your DNS lookups, like any VPN server. HTTPS still keeps the content of pages encrypted. The node software does not log DNS query names, but you cannot verify which software a production node is running.

Does AeroNyx keep VPN logs?

Yes. The backend keeps a record of each session: the node, client key, byte counts, start and end times, and a hashed client IP address. It does not record destinations or DNS queries. When the app uses a voucher, the client key is a throwaway key and does not identify your account. For retention, see the AeroNyx Trust Center.

Is AeroNyx multi-hop like Tor?

No. VPN traffic goes through one node. Only one-to-one chat messages can optionally use a two-hop route through AeroNyx nodes. That route is far smaller than Tor and does not resist an adversary that watches the whole network.

What does a blind-signed voucher protect?

A blind-signed voucher lets a node check that you may connect without learning your account. AeroNyx signs the voucher without seeing it, so the voucher a node receives cannot be matched to the account that obtained it. It does not hide your traffic from the node, and timing could still link a session to an account.

AeroNyx Privacy Network vs Traditional VPN