The security-community's default answer to 'how do I get my own VPN': Ansible scripts from Trail of Bits that build a WireGuard/IKEv2 server on a $5 VPS with deliberately strong defaults, and no operator between you and your traffic - the logs question mostly disappears because there is nobody to hand logs to. It is honest about its limits: the FAQ says the project has NOT been audited, explicitly does not claim anonymity or censorship resistance, and the cloud provider you pay sees connection metadata. Best read as a hardened, disposable privacy-from-the-ISP tunnel, not a stealth tool: it will not beat the Great Firewall, and v2.0.1's changelog shows even supported cloud providers break with Ansible updates. Choose it over Outline when you want WireGuard and cryptographic minimalism; choose Outline when you need to look like ordinary HTTPS traffic.
site reachable · checked 19 h ago · daily check
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-09 · facts as of 2026-11-03 · how we verify
Algo is not a VPN provider but an open-source toolkit from Trail of Bits that automates setting up your own WireGuard or IKEv2 server on a cloud VPS you control. There’s no central service, no account, and no operator - just scripts that deploy a hardened server. You trust your cloud provider (DigitalOcean, AWS, etc.), not Trail of Bits. It’s ideal for tech-savvy users who want full control but demands comfort with the command line.
Algo has no central logging because there is no central operator - your server, your logs. By default, it logs minimal system events (SSH failures, firewall blocks, service status) and IPsec client logins (names, timestamps, source IPs) in /var/log/syslog, all rotated after 7 days. WireGuard itself logs nothing beyond live endpoint state (sudo wg). Trail of Bits makes no no-logs claim and explicitly states the project has not been audited. Your cloud provider still sees traffic metadata, and your billing identity is tied to your VPS account - perfect privacy is impossible, as the README admits.
The Algo software is free (AGPL-3.0). You pay your cloud provider for the VPS - typically $5-6/month for entry-level instances at DigitalOcean, Vultr, or Hetzner. There is no renewal trap because there is no subscription: you pay the cloud provider directly, and costs scale with usage (e.g., egress overages). The derived_pricing fields are null because no bundled billing exists. You fund the VPS as you choose - monthly, hourly, or prepaid - with no long-term commitment baked into the tool.
Algo supports WireGuard and IKEv2 with strong defaults: ad-blocking DNS, QR codes for mobile setup, and Apple mobileconfig profiles. It lacks obfuscation, multihop, split tunneling, and kill switches. P2P is allowed, but streaming geo-unblocking is not feasible. You can connect Windows, Mac, Linux, Android, iOS, and routers (via OpenWrt). Server count and countries depend on your VPS choice. No performance tests are conducted here, but BitLaunch (2020) measured Algo at half the speed of a manual WireGuard install on the same hardware - likely due to routing and firewall overhead.
Algo is developed by Trail of Bits, a New York-based security consultancy founded in 2012. It’s a side project, not a product, with release gaps (v1.1 in 2019, v2.0.0 in 2025). The GitHub repo shows active maintenance (last push 2026-10-28), but support is community-driven via public issues. Red flags include slowed development and a speed penalty versus bare-metal WireGuard. The project is honest about its limits - no anonymity, no audit, no censorship evasion - and that reputation holds across HN and review sites.
Algo does not support obfuscation and is not designed for censorship circumvention. It uses standard WireGuard (UDP 51820) and IKEv2 (UDP 500/4500), which are easily detectable and often blocked in China, Iran, or Russia. The FAQ explicitly states it won’t help in restrictive regimes. This tool is for privacy from your ISP or securing public Wi-Fi, not bypassing state-level firewalls. Use Tor or Shadowsocks if you need stealth.
Use Algo if you’re technically confident and want a disposable, self-owned WireGuard or IPsec server with minimal trust in third parties. It’s not for beginners, streaming, or beating censorship. You pay your cloud provider - not Trail of Bits - and accept their logging and identity requirements. No affiliate trail exists: Trail of Bits earns nothing beyond a DigitalOcean referral link in the README.
| Intro price | $5 /mo |
|---|---|
| Notes | The Algo software is free and open source (AGPL-3.0). You pay your cloud provider for the VPS: entry-level droplets run about $5-6/month at DigitalOcean, Vultr, Hetzner, Linode, Lightsail and similar (HN comment 2025-08-09: 'a $5 cloud instance and installing Algo VPN on it gets you the same thing' as a commercial VPN; alphasec guide 2022: 'self-hosting options start as low as $5/month'). Heavy use may add egress overage billed by the provider. The README contains a DigitalOcean referral link (m.do.co/c/...) - the project's only monetization visible on its pages. |
See the 3-year total next to the marketing number: true-cost calculator →
| Sign up at | github.com |
|---|---|
| Identity check | none for the software itself - Algo requires no account, email or identity; your cloud provider will require a billing identity (name + payment card) under their KYC |
| Payment | fiat |
| Apps | windows, mac, linux, android, ios, router |
Check the renewal price above before any multi-year plan - true-cost calculator.
Legal domicile: United States - Algo is developed by Trail of Bits, a New York-based security consultancy founded 2012 (Wikipedia, REST summary fetched 2026-11-03). The software itself has no jurisdiction of its own: the operative jurisdiction for an Algo user is wherever their rented VPS physically sits, plus the country of their cloud provider (e.g. a DigitalOcean droplet in Amsterdam is Dutch-hosted).. Logging claim: From the README 'Privacy and Logging' section (fetched 2026-11-03): 'Algo takes a pragmatic approach to privacy. By default, we minimize logging while maintaining enough information for security and troubleshooting.' What IS logged by default on your own server: system security events (failed SSH attempts, firewall blocks, system updates), kernel messages and boot diagnostics, WireGuard client state (visible via sudo wg - shows last endpoint and handshake time), basic service status; 'All logs automatically rotate and delete after 7 days'. The FAQ: 'WireGuard doesn't save any logs... There isn't any out-of-the-box way to monitor actual user activity (e.g. websites browsed, etc.)' - evidence class: no logging claim at all. No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator pages (GitHub README, docs/faq.md, repo and release APIs, Trail of Bits launch blog), Wikipedia (Trail of Bits), four independent review sites, HN Algolia API and GitHub issue archives all fetched live 2026-11-03; community voice paraphrases drawn from comments actually read on 2026-11-03 (not fully verified) as of 2026-11-03 - read the sources below.
Evidence classes and scoring: methodology · user experiences: meta-review.
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Based on our checks as of 2026-11-03: Algo (Trail of Bits personal VPN script) scores 3/10 in our weighted review. We logged 3 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
You get free, open-source Ansible scripts that deploy a WireGuard or IKEv2 server on your rented VPS. You pay your cloud provider (~$5/month) for the server, not for Algo itself.
There is no renewal price - Algo is free software. Your VPS costs recur at your provider’s rate (e.g., $5/month), totaling around $180 over three years, plus potential overages.
There is no audit or court-tested evidence. Logging is minimal and local to your server, with no central operator to collect data. Trail of Bits has never seen your traffic or logs.
No. Algo does not obfuscate traffic and uses protocols that are easily detected and blocked. It is not designed for censorship resistance.
The Algo software requires no payment or identity. But your cloud provider (DigitalOcean, AWS, etc.) requires billing identity and payment, so anonymity ends there.
Since you control the server and the code is open-source (AGPL-3.0), your setup keeps running. Updates and fixes would depend on community forks or self-maintenance.
Algo itself is the alternative - free, self-hosted, and transparent. For even simpler setup, consider Outline (censorship-focused) or run WireGuard manually on a $5 VPS.
Comparable providers of the same kind only - a free app is never "an alternative" to a commercial VPN. Ranked by the same deterministic score.
The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your…
The gold standard for connecting your OWN devices, and a poor substitute for a consumer VPN - which is exactly what it says on the tin. Tailscale is a…
The incumbent of self-hosted business VPNs, and still a safe pick in 2026 - with one honest fork in the road. Access Server is the polished, supported way to…
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.