Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s how we research.
Three separate things get discussed as if they were one, and choosing between them is impossible until you know which is which.
Double VPN routes your traffic through two servers belonging to the same provider, encrypting it twice along the way.
Onion over VPN sends your traffic through a VPN and then into the Tor network — three volunteer-run nodes operated by strangers rather than your provider. How Tor compares to a VPN on its own is a separate question with a different answer.
Running two different VPNs is a third thing entirely, and usually just breaks your connection.
Here is what each does, what it costs, and the honest answer about whether you need any of them.
How Double VPN Actually Works
The mechanism goes by the name nested encryption, and understanding it explains the entire privacy benefit.
Your device encrypts each packet twice — first with the key for the second server, then wraps that in another layer for the first. The first server strips its layer and passes the still-encrypted packet on. The second decrypts it fully and sends your request to the internet.
The result is a split view:
The first server sees your real IP address but cannot read your data or see where you’re going.
The second server sees your destination but has no idea who you are.
Neither one holds the complete picture, which is the point. It also prevents what’s called first-hop compromise — if the entry server were breached, the attacker would still have nothing useful.
How Onion Over VPN Differs
You connect to a VPN, then tunnel that connection through Tor. Your traffic bounces through at least three volunteer-operated nodes before reaching the open web, adding several more layers of encryption.
Why it’s stronger: those nodes are independent and decentralised, run by different people in different places. Even if your VPN provider were compromised entirely, the Tor layers would still hide your destination.
Why it’s worse in practice: the latency is severe enough to make streaming, gaming and large downloads unusable. And a great many websites block traffic coming from Tor exit nodes outright, so pages simply refuse to load.
One practical advantage: Onion over VPN works with almost any VPN, since Tor does the second half. Double VPN only works with providers that build it in. If you are deciding which of the two to actually pick, the answer turns on what you are doing rather than on how many layers each applies.
What It Costs You
Published estimates put multi-hop speed loss at up to 30%, and historically the “multi-hop tax” ran to 50% or more. For context, a single hop on a good provider costs 3–15%.
That has improved in 2026. Providers now run WireGuard on both hops rather than older protocols, which cut the overhead substantially. Some mix transports — WireGuard over UDP for the first hop, OpenVPN over TCP port 443 for the second, so the traffic resembles ordinary HTTPS.
Onion over VPN is far worse, and no protocol improvement fixes it. Tor’s volunteer network was never built for speed.
There is also a battery cost on mobile, since double encryption means more processing on your device.
Do You Need It? Probably Not
The honest answer, and independent sources say it plainly: in most cases a double VPN is overkill.
A single VPN connection already hides your IP from the sites you visit, encrypts your traffic against your ISP and the network you’re on, and — with an audited no-logs provider — leaves nothing to hand over. That covers the threat model almost everyone actually has.
Double VPN genuinely helps if you handle information where exposure carries serious consequences: journalism involving sources, activism under a hostile government, or work with classified material. The common thread is that a single point of failure is unacceptable.
Onion over VPN makes sense if you need anonymity that survives your VPN provider being compromised or compelled — a higher bar again, and one most people never reach.
Who It’s Actually For
For everyone else, the speed cost buys protection against a threat that isn’t aimed at you. If your concern is privacy from your ISP or safety on public Wi-Fi, a normal VPN connection covers it.
The Names Confuse Everyone
Providers call the same feature different things, which is why searching for one term misses providers that have it.
| Provider | What they call it |
|---|---|
| NordVPN | Double VPN — available across 10 countries |
| Surfshark | MultiHop |
| Proton VPN | Secure Core |
NordVPN is also the only one of the five we rank offering Onion Over VPN as a built-in option, alongside Double VPN in its specialty servers list. Full detail in our NordVPN review.
Surfshark’s MultiHop works slightly differently: it offers fixed server pairs rather than letting you choose both ends freely — see our Surfshark review.
⚠️ Neither ExpressVPN, CyberGhost nor PureVPN offers multi-hop. Among the providers we cover, NordVPN, Surfshark, Proton VPN and IPVanish do — the last of these added Double Hop in December 2024.
What About Running Two Different VPNs?
Technically possible, usually a bad idea.
Two VPN clients on the same device generally conflict and break the connection entirely — this ranks among the more common causes of a VPN that won’t connect.
The workaround that does work: install one VPN on your router and a different one on your device. Traffic passes through both, and because they’re at different layers they don’t fight. Our router guide covers the setup.
Is it worth it? Rarely. You get the same split-knowledge benefit as double VPN, but now you’re paying two subscriptions, managing two apps, and troubleshooting twice as many failure points.
How We Research
This guide draws on published technical analysis from named sources including CyberInsider, VPNMentor, AllThingsSecured and NymVPN, alongside provider documentation and our own full reviews of the providers we rank — cross-checked and verified at publication. Where sources disagreed on speed impact, we present the range rather than a single figure. Our full approach lives on the About Us page.
Double VPN FAQ
A double VPN routes your traffic through two servers belonging to the same provider, encrypting it twice. The first server sees your real IP but not your destination; the second sees your destination but not your IP. Neither holds the full picture, which is the privacy benefit. NordVPN calls it Double VPN, Surfshark calls it MultiHop, Proton calls it Secure Core.
A double VPN uses two servers run by one company. Onion over VPN sends your traffic through a VPN and then into the Tor network — at least three nodes operated by independent volunteers. Tor gives stronger anonymity because those nodes aren’t controlled by your provider, but it is dramatically slower and many websites block Tor exit nodes entirely.
Published estimates put the loss at up to 30%, though it used to be worse — the historic “multi-hop tax” ran to 50% or more. Providers now run WireGuard on both hops rather than older protocols, which cut the overhead considerably. Onion over VPN is far slower and no protocol change fixes that.
Most people don’t. A single connection from an audited no-logs provider already hides your IP, encrypts your traffic against your ISP, and leaves nothing meaningful to hand over. Double VPN is aimed at journalists protecting sources, activists under hostile governments, and people handling classified material — situations where one point of failure is unacceptable.
Two VPN clients on one device usually conflict and break the connection — it’s a common cause of VPNs that won’t connect at all. The workaround is running one on your router and a different one on your device, since they operate at different layers. It works, but you’re paying twice and troubleshooting twice for the same benefit double VPN provides.
Among the five we rank, only NordVPN and Surfshark. NordVPN offers Double VPN across 10 countries plus Onion Over VPN as a separate option; Surfshark’s MultiHop uses fixed server pairs rather than letting you choose both ends. ExpressVPN, CyberGhost and PureVPN do not offer multi-hop.
The Short Version
Double VPN splits knowledge between two servers of one provider. Costs up to 30% of your speed, less than it used to.
Onion over VPN adds three independent Tor nodes. Stronger anonymity, unusable speeds, and many sites block it.
Two separate VPNs mostly break each other, unless one runs on your router.
And for most people, none of these are necessary. A single connection from an audited provider covers the threats that actually apply to normal use. These features exist for people whose work makes a single point of failure unacceptable — which is a real category, and a small one.