NymVPN uses WireGuard to power Fast mode, but not the usual way. Instead of one company server, it runs WireGuard across a decentralized 2-hop path with an extra layer of encryption, hardened against censorship by AmneziaWG. The result: everyday speed, with no single node able to see both who you are and what you do.
The 2-hop design
Your traffic passes through two independent WireGuard nodes run by different operators. The first sees your IP but none of your activity (everything through it is encrypted). The second sees where your traffic is going but not who you are: it only ever sees the first node's address, never yours. A traditional single-server VPN sees both at once; here, no single node can make that link. More in how the Nym network compares to traditional VPNs.
Tunnel-in-a-tunnel encryption
A plain 2-hop chain still shows the first node more than it should, so NymVPN wraps one WireGuard tunnel inside another. The first node decrypts only the outer layer, learning where to forward the still-encrypted inner tunnel; the second decrypts the final layer and sends your traffic on.
AmneziaWG: censorship resistance built in
Standard WireGuard has a recognizable packet signature that deep packet inspection can block. NymVPN runs AmneziaWG, a fork that sends decoy packets before the handshake to scramble that signature, keeping connections reliable on restrictive networks without losing WireGuard's speed. It's the default for all Fast mode traffic. See the AmneziaWG announcement.
What about Anonymous mode?
Anonymous mode doesn't use WireGuard: it routes through the 5-hop mixnet with the Sphinx packet format, adding cover traffic and timing protection for sensitive tasks. Fast mode with WireGuard is the pick for everyday browsing, streaming, and downloads. See What's the difference between NymVPN Fast & Anonymous mode?
Related questions
Does the double encryption slow things down?
Barely. WireGuard's crypto is very efficient, and packet sizes are tuned per platform to avoid fragmentation. See How is the MTU set for NymVPN?
Can I get a WireGuard config file for my router?
No static config files, since NymVPN's rotating zk-nym credentials work differently, but OpenWRT routers can run the full client via a community package. See Where can I find the NymVPN WireGuard configuration files?