Censorship resistance

Nym is built for privacy and censorship-resistance. For a browser integration the honest answer is split. The mixnet makes a single endpoint hard to block. The strong anti-blocking tools live in dVPN mode, in the NymVPN app and the nym-smoldvpn SDK, not the browser packages.

What the mixnet gives the browser

Your network sees your IP address and that you use Nym. It cannot see which RPC endpoint you reach, how much data you move, or when. A network that cannot see the endpoint cannot block only that endpoint. The constant stream and the cover traffic hide the pattern from it.

The limits in the browser

• A network can detect that you use Nym, and can block Nym as a whole.
• Before any mixnet traffic exists, the client fetches the network topology from the nym-api over ordinary HTTPS (validator.nymtech.net on mainnet). A censor that blocks this host stops the tunnel before it starts. The browser packages have no stealth bootstrap yet.
• A provider that blocks by IP address or country sees the exit gateway’s IP address, not yours. Public RPCs answer shared exits with 403 and 429 errors.

The strong circumvention is in dVPN mode

Deep Packet Inspection systems, deployed by ISPs and governments, identify VPN protocols by their handshake patterns, packet sizes, and timing. Countries including China, Russia and Iran deploy them against VPN use. The answers are dVPN-mode techniques, in the NymVPN app and, in part, in nym-smoldvpn, the native Rust dVPN SDK. The browser mix-* packages have none of them.

• AmneziaWG. A fork of WireGuard that adds decoy packets before the handshake, so DPI rules that match the standard WireGuard handshake no longer fire. WireGuard’s security properties stay intact.
• QUIC transport. It wraps the tunnel in a QUIC layer, so the traffic looks like ordinary HTTPS or HTTP/3, not a VPN. Blocking QUIC outright would break much of the web, so it is an unattractive target. nym-smoldvpn exposes this as a QUIC-tunnelling two-hop mode, for clients behind DPI that blocks plain WireGuard.
• Stealth API Connect. It routes the bootstrap API requests through a channel that is harder to identify and block, so the client reaches the Nym network even where the API is censored. NymVPN app only; the nym-smoldvpn SDK does not have it yet.

Censorship resistance is an arms race, and none of these are guarantees. For a browser wallet in a censored region, the practical answer today is dVPN mode, via the NymVPN app or nym-smoldvpn, for the hard cases.