Amnezia VPN (self-hosted with obfuscation) vs Self-hosted WireGuard on a cheap VPS: which wins in 2026?
Head-to-head on the facts that decide the purchase: real prices in the provider's own unit, minimum, KYC, proof, payment and terms - every number sourced in the linked reviews.
The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your own $5 VPS over SSH and it deploys the server for you, so your traffic never touches an Amnezia-operated machine. Its signature AmneziaWG protocol is the WireGuard cryptographic core with a serious anti-DPI layer (dynamic headers, randomized packet sizes, QUIC/DNS mimicry), and version 3.1 was rushed out after Russia's June-July 2026 hybrid attack - mass IP blocking, DDoS, and phishing against the team - that knocked the service around for a month and a half. The honesty ledger cuts both ways: security audits by 7ASecurity in 2022/2024/2025 and open code, but also a corporate structure that has drifted from Portugal (IP holder) to Estonia (operations) to a Cyprus-registered entity per today's footer, no public ledger of funding beyond donations and its paid services, self-hosting advocates calling the setup wizard opaque, and an open GitHub issue (since Aug 2024) documenting AmneziaWG being DPI-detected on Russian mobile networks. It is a censorship tool first; as an anonymity or streaming product it is the wrong category.
Not a VPN service - the protocol every commercial VPN wants to be built on, and the most evidence-backed tunnel protocol in existence. You are the provider: generate keys, run wg-quick on a 5-dollar VPS or a Raspberry Pi, and there is no company to subpoena, no privacy policy to believe, and no logs unless you write them yourself. The receipts are unusual even by open-source standards: roughly 4,000 lines of code against 600,000 for OpenVPN+OpenSSL, four independent formal/security analyses (Tamarin symbolic proof, eCK computational proof, INRIA's CryptoVerif proof of the entire protocol including data transport, and the ProVerif Noise-IK model), machine-verified Curve25519 code, a clean third-party audit before 1.0, and mainline Linux kernel status since 5.6 (January 2020 merge, March 2020 release). The trade-offs are structural, not incidental: UDP only with a fingerprintable handshake (Russia began blocking OpenVPN/WireGuard connections in 2024; AmneziaWG exists precisely for this), key management is entirely yours, per-process split tunneling is clumsy enough that HN users call it a huge usability issue, and the Windows client lives at the mercy of Microsoft's driver signing (an April 2026 signing termination forced an emergency release). It will also never anonymize you from your own VPS provider or home ISP - a self-hosted exit IP is just your own identity in a new place.
Short answer: Amnezia VPN (self-hosted with obfuscation) wins overall (6.2/10 vs 4/10). Facts checked 2026-11-03.
The facts
 Amnezia VPN (self-hosted with obfuscation) |  Self-hosted WireGuard on a cheap VPS | |
|---|---|---|
| Overall score (0-10) | 6.2 | 4 |
| Privacy & proof | ||
| Logging claim | 'If you use the AmneziaVPN app for a self-hosted VPN, we do not collect any data about… | none by design - WireGuard is stateless and logs nothing; the only logging that exists… |
| Logging evidence | independently audited | no logging claim at all |
| Audits | 7ASecurity 2024, 7ASecurity 2022, 7ASecurity 2025 | Benjamin Dowling and Kenneth G. Paterson (Royal Holloway, Un… moreBenjamin Dowling and Kenneth G. Paterson (Royal Holloway, University of London) 2018, Kevin Milner and Jason A. Donenfeld (Tamarin prover) 2018, Benjamin Lipp, Bruno Blanchet, Karthikeyan Bhargavan (INRIA) 2019, Nadim Kobeissi and Karthikeyan Bhargavan (Noise Explorer, ProVerif) 2018, HACL* and Fiat-Crypto projects 2019 |
| Jurisdiction | Cyprus (EUPHORIATECH LIMITED, Nicosia, reg HE 484287 per sit… moreCyprus (EUPHORIATECH LIMITED, Nicosia, reg HE 484287 per site footer, verified 2026-11-02; IP rights in Portugal with Amnezia LDA, ops in Estonia) - for self-hosted users the operative jurisdiction is wherever their own VPS is hosted | none - a protocol and codebase with no servers, no accounts… morenone - a protocol and codebase with no servers, no accounts and no operator entity to subpoena; copyright and the WireGuard trademark are held by Jason A. Donenfeld (wireguard.com footer, fetched 2026-11-03) |
| Owner | unknown | unknown |
| Money | ||
| Intro price | $5 /mo | $5 /mo |
| Renewal price | not published | not published |
| Anonymous payment | unknown | unknown |
| Account | ||
| Personal info | none | none |
| Kind | Self-hosted | Self-hosted |
| Facts checked | 2026-11-02 | 2026-11-03 |
Score breakdown
Amnezia VPN (self-hosted with obfuscation) leads on privacy & logging (+6), security (+3.5), censorship resistance (+1).
Amnezia VPN (self-hosted with obfuscation) at a glance
++ What holds up
- Self-hosted mode is free, GPL-3.0 open source, and requires no account - your traffic goes only to your own VPS (GitHub README + FAQ, fetched 2026-11-02)
- AmneziaWG is documented in unusual technical depth, protocol mechanism by mechanism, with the WireGuard crypto core unchanged (docs.amnezia.org)
- Survived the largest state attack in its history (summer 2026: IP/subnet blocking, DDoS, API probing, phishing) and published a candid postmortem with compensation to subscribers
- Built and battle-tested where it matters: Russia, Iran, Myanmar, Turkmenistan, China are the actual user base, and an HN user confirmed the setup scripts were 'above board' on a throwaway VPS
- Free tier in genuinely censored countries (Instagram/Facebook/X access) and a Civil Rights Defenders partnership giving free Premium to journalists and activists
- Independent 7ASecurity security audits of clients and protocols in 2022, 2024 and 2025
-- What to watch
- You own the failure modes: a single-user VPS is trivial to block, and Iranian/Russian authorities block hoster IP ranges wholesale - community threads show constant server-hopping
- AmneziaWG has been detected by DPI before (open GitHub issue #1010 since Aug 2024, Russian MTS) and the project itself admits each protocol version is a temporary answer in an arms race
- Corporate opacity: operator entity is a small Cyprus company (EUPHORIATECH LIMITED) per the site footer, while the 2025 TorrentFreak answers named a Portugal IP holder and Estonia operator - jurisdiction depends on which page you read
- No public accounting of funding beyond donations (Patreon/crypto) and revenue from Premium/Hosting/Business - reviewers and community threads raise the question and get no ledger
- Setup wizard hands the app your VPS SSH credentials and historically hid its server scripts; HN users found buggy UI and a server private key embedded in exported config JSON (2025-12)
- Weak OpenWrt packaging (community-maintained packages), Premium torrenting limited to Netherlands and Switzerland with no port forwarding, and Amnezia Free is speed-capped at 8 Mbps without YouTube
- Useless during full internet shutdowns - Amnezia itself says so for Iran-style whitelists, where only satellite or mesh links work
Self-hosted WireGuard on a cheap VPS at a glance
++ What holds up
- Formally verified four independent ways - Tamarin symbolic proof, eCK computational proof, INRIA CryptoVerif proof of the full protocol incl. transport data messages, ProVerif Noise-IK model (operator formal-verification page, IACR ePrint, Noise Explorer - all fetched 2026-11-03)
- About 4,000 lines of code vs 600,000 for OpenVPN+OpenSSL - attack surface an individual can actually review (Ars Technica 2018, fetched live)
- In the Linux kernel mainline since 5.6 (merged Jan 2020, shipped Mar 2020) - first-party kernel module, no DKMS rebuilds (Ars Technica 2020)
- Stateless: no logs exist unless the operator configures them; no provider means no subpoena target and no policy to doubt (operator protocol docs)
- Runs on anything: official packages for Windows/macOS/iOS/Android/BSDs/OpenWRT plus a Go userspace implementation; HN users run peers on 128 MB-RAM VPSes (install page + HN voices fetched 2026-11-03)
- Instant handshakes: about 100 ms connect vs 8+ seconds for OpenVPN in Ars Technica's testing (2018 review)
- Linus Torvalds on the code: compared to OpenVPN and IPsec, 'it's a work of art' (LKML, quoted in the fetched Ars review)
-- What to watch
- UDP only and trivially identifiable - no obfuscation in the core; Russia began blocking OpenVPN/WireGuard connections in January 2024 (439-pt HN thread) and AmneziaWG is a whole fork built to patch this
- Key management is all yours: generation, rotation, distribution and per-peer AllowedIPs hygiene, with no dashboard in wg-quick
- Scoping a VPN to a subprocess is clumsy - HN: 'Wireguard has huge usability issues due to that'; workarounds like wireproxy exist (HN, Oct 2026)
- Windows distribution depends on Microsoft code signing - in April 2026 Microsoft terminated the signing account and WireGuard shipped an emergency release (HN thread 47719942)
- Port quality varies outside Linux: kernel-mode support was pulled from FreeBSD 13.0 in 2021 before being reintroduced via pfSense packages (Wikipedia, fetched 2026-11-03)
- No geo-unblocking value: your exit IP is your own VPS/home IP, so no streaming catalog changes, no shared clean IPs
FAQ
Which is cheaper, Amnezia VPN (self-hosted with obfuscation) or Self-hosted WireGuard on a cheap VPS?
Tie - both from $5 /mo.
Which has better logging evidence, Amnezia VPN (self-hosted with obfuscation) or Self-hosted WireGuard on a cheap VPS?
Amnezia VPN (self-hosted with obfuscation) has the stronger logging evidence; Self-hosted WireGuard on a cheap VPS makes no no-logs claim at all.
Which renewal price is honest, Amnezia VPN (self-hosted with obfuscation) or Self-hosted WireGuard on a cheap VPS?
Amnezia VPN (self-hosted with obfuscation) is free - there is no renewal price to hide; the honest question is what the "free" is funded with. See the linked reviews.
Which needs less KYC, Amnezia VPN (self-hosted with obfuscation) or Self-hosted WireGuard on a cheap VPS?
Both have the same KYC stance (none).
Which has the longer track record?
Self-hosted WireGuard on a cheap VPS has the longer track record (since 2015).
Scores and facts: meta-reviews with dated sources - Amnezia VPN (self-hosted with obfuscation) · Self-hosted WireGuard on a cheap VPS. Method: how we verify. More: all providers compared · all head-to-heads.