What is a double VPN and is multi hop worth it?

A double VPN, also called multi hop, sends your traffic through two VPN servers in sequence. The first sees your real address but not your destination. The second sees your destination but not your address. That splits what each operator knows, at the cost of speed. It does not protect a compromised device.

How does it work?

Your device builds an encrypted tunnel to server A. Inside that tunnel it builds a second encrypted tunnel to server B. The packet is wrapped twice, like a letter in two envelopes. Server A removes the outer layer and forwards what is left to server B, which removes the inner layer and sends the traffic to the open internet.

The wrapping idea is the same one behind a single tunnel, such as IPsec's tunnel mode in RFC 4301, where an entire packet becomes the payload of a new one. Multi hop simply repeats it. The NIST glossary entry for a virtual private network describes the single hop case, and the double version extends it.

What does the second hop buy you?

With one server, the operator can in principle see both ends: your source address and the sites you visit. Trusting that operator is a policy question, not a technical guarantee. With two servers run by different operators in different jurisdictions, one party cannot link the two facts without the other's cooperation or without correlating traffic timing.

The benefit is mostly about reducing trust in a single provider. If you use one provider that runs both hops, you gain far less, because the same organization sits at both ends.

What does it cost?

• Speed. Two encryptions and a longer path add latency and reduce throughput.
• Complexity. More moving parts to configure and to fail.
• Reliability. Either hop going down breaks the connection.
• Some sites object. Exit addresses shared by many users can trigger captchas or blocks.

What does it not fix?

• Malware or a stolen device. The tunnel carries whatever the device sends.
• Logins. If you sign into an account, the site knows who you are no matter how many hops you use.
• Timing correlation. An observer who sees traffic entering the first hop and leaving the last may match patterns by volume and timing. Strong adversaries can do this.
• Unencrypted traffic after exit. Use HTTPS so the last link is also protected.
• Fingerprinting. Browser and device characteristics can identify you without your address.

Constructed example: a journalist in a country that monitors outbound connections uses multi hop so the first server only sees an encrypted connection and the exit server sees a destination but not a home address. It helps against casual network watching. It would not help if their laptop carried spyware.

Is it useful for company access?

Rarely. Businesses are usually better served by tight access controls to specific applications than by hiding a source address. NIST's zero trust architecture puts weight on authenticating each request, which a tunnel alone does not do. If you provide remote access to staff, a single well managed gateway with strong authentication and narrow routes is simpler and easier to audit.

How to check or apply this

1. Write down the threat you care about: an untrusted Wi-Fi network, a curious provider, a hostile local network or a targeted adversary. A double VPN helps with some of these and not others.
2. Check who operates each hop and whether they are independent.
3. Look for a published independent audit or clear no logging claims you can evaluate, and treat marketing statements as claims, not proof.
4. Confirm DNS requests go through the tunnel and test for leaks using a leak test site.
5. Keep HTTPS and device security in place regardless.
6. Measure the speed hit with your actual workload before committing.
7. For anything higher risk, get advice built for your situation instead of a consumer feature.

Quick check

Sources

• RFC 4301, Security Architecture for the Internet Protocol
• NIST glossary, virtual private network
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 18 October 2026.