Overview
Safing SPN is not a conventional VPN. Built into the open-source Portmaster firewall for Windows and Linux, it routes every individual connection through a separate multi-hop path, each with its own exit IP. The result is per-connection identity separation across all applications, not just your browser. Since its 2020 launch and subsequent acquisition by IVPN in late 2024, SPN has evolved into a specialized tool for users whose threat model demands more than a single-tunnel VPN can provide. As of 2026, Portmaster Pro with full SPN access costs €80/year or €8/month, down from previous pricing, with a mid-tier Plus plan at €40/year.
Privacy & KYC
SPN operates at KYC Tier L1, Anonymous. No email address, name, or identity verification is required to sign up or pay. The service is explicitly pseudonymous: you can fund an account with Bitcoin, Monero, Lightning, cash, or fiat (credit card/PayPal) without linking personal data. This makes SPN one of the few remaining privacy networks that genuinely accommodates users who refuse to surrender identity documents.
- No email required for account creation
- Crypto-first payments with XMR and BTC natively supported
- Open-source codebase available for public audit
- Per-app, per-connection IP rotation rather than a single tunnel identity
Unlike standard VPNs that replace your ISP identity with a single VPN-server identity, SPN fragments your traffic across dozens of exit points. Each application, and each connection within an application, can present a different IP address in a different jurisdiction.
Supported assets & payments
Safing accepts an unusually broad range of payment methods for a privacy service. Cryptocurrency users can pay via Bitcoin (on-chain and Lightning), Monero (XMR), or traditional rails including credit card, PayPal, and physical cash by mail. This flexibility aligns with the service's pseudonymous ethos: Monero users in particular gain strong transactional privacy, while cash payments eliminate financial trail entirely. All plans, Free, Plus, and Pro, can be funded through any of these channels.
Security & custody
SPN's architecture is heavily inspired by Tor but diverges in scope and usability. It employs layered onion encryption at each hop, with every connection independently routed through a dynamically calculated path. Crucially, SPN protects all system traffic, including UDP, which Tor does not reliably transport, not merely browser connections. The Portmaster firewall adds system-wide tracker blocking, DNS-over-TLS, and per-application rulesets. Because the entire stack is open source, users and researchers can inspect the routing logic, encryption implementation, and update mechanisms. IVPN's stewardship since late 2024 has brought additional operational maturity, though the project remains younger than Tor or established VPN incumbents.
Users retain local custody of traffic control: exceptions for specific apps, domains, or countries are configurable, and the SPN can be paused globally or per-connection without uninstalling the firewall.
Who it's for, verdict
SPN suits privacy advocates with an elevated threat model who find single-tunnel VPNs insufficient but lack the technical patience for full-system Tor deployment. Journalists, researchers, and crypto users seeking no-KYC network privacy will appreciate the pseudonymous signup and Monero support. However, the tool demands trade-offs: it is Windows and Linux only (macOS and mobile remain on the roadmap), and the connection-level routing introduces latency that streaming or gaming users may find unacceptable. Community sentiment remains polarized, some praise the precision of multi-identity routing, while others report connectivity instability. For those already using Portmaster's free firewall, the Pro upgrade is a natural step; for others, the €80/year price is reasonable only if per-connection IP separation is genuinely necessary. Score: 8/10, innovative and principled, but not yet universal.
