A stealth VPN that looks like ordinary HTTPS.
Firewalls block VPNs by recognising them. VPNBaron's stealth connections look like a visit to a website on port 443, so there is nothing to recognise. Tap Connect and Pathfinder finds the way through.
From €4.99/mo · Cancel anytime
How it gets through
Firewalls block what they recognise
Deep packet inspection looks at the shape of your traffic, not just where it goes. This is what it sees.
A typical VPN
Blocked- Port
- 1194, 51820 or similar
- Handshake
- OpenVPN or WireGuard signature
- Looks like
- A VPN
- What happens
- Slowed down, then cut off
VPNBaron stealth
Allowed- Port
- 443, like every website
- Handshake
- TLS 1.3, like any HTTPS site
- Looks like
- Someone browsing the web
- What happens
- It connects
Port 443, like every website
Blocking it would mean blocking banks, email and app stores along with it.
Answers probes like a website
Probe a VLESS · Reality server and you get a real website’s reply. Only your app, with your key, gets tunneled.
Keeps its speed on bad networks
Hysteria2 runs over QUIC and holds up on lossy hotel Wi-Fi and crowded mobile networks.
Baron Pathfinder
One tap. Pathfinder finds the way in.
You don't need to know which protocol a network lets through. Tap Connect in the VPNBaron app and Pathfinder works it out for you.
- 1Tests WireGuard, IKEv2, VLESS · Reality and Hysteria2 on the network you are on.
- 2Connects with the first one that gets through.
- 3Remembers it, so the next connection is instant.
Built into the apps for Windows, Mac, iPhone, iPad and Android. Prefer to choose? Pick VLESS · Reality or Hysteria2 yourself in Settings.
Two stealth protocols, both in every plan
A stealth VPN gets encrypted traffic through networks that block VPNs by imitating the most common traffic on the internet: HTTPS. We run two of the best at it.
VLESS · Reality
- TCP on port 443
- Borrows the TLS handshake of a real website
- Best for the strictest networks and countries
Hysteria2
- QUIC (UDP) on port 443
- Looks like HTTP/3 web traffic
- Best for slow, lossy or crowded networks
Not sure which? Pathfinder picks for you, or read Hysteria2 vs VLESS Reality. Looking for a Trojan proxy? Every plan still includes one for Clash apps, as a legacy option.
One plan. Stealth included.
Every protocol, every location, unlimited data, 7-day money-back. No add-ons, no extra tier.
1 Month Plan
Billed monthly· Most flexible
- 3 Simultaneous Devices
- Unlocks streaming
- Anti-DPI stealth + Pathfinder
- All protocols, WireGuard included
- Unlimited Bandwidth
- Priority Support
- Instant Setup
12 Months Plan
€59.99 billed once a year(Save 62%)
- 5 Simultaneous Devices
- Unlocks streaming
- Anti-DPI stealth + Pathfinder
- All protocols, WireGuard included
- Unlimited Bandwidth
- Priority Support
- Instant Setup
6 Months Plan
€44.99 billed every 6 months(Save 42%)
- 4 Simultaneous Devices
- Unlocks streaming
- Anti-DPI stealth + Pathfinder
- All protocols, WireGuard included
- Unlimited Bandwidth
- Priority Support
- Instant Setup
Pay by card or PayPal. Cancel anytime from your account.
Stealth on every location
Every location runs every protocol, stealth included, and every plan includes them all. Pick the closest one for speed, or one abroad for its streaming catalog. The app always shows the current list.
- North America
- South America
- Europe
- Asia
- Australia
Built for networks that say no
Countries that filter the internet
Where firewalls inspect traffic and shut VPNs out.
School and campus networks
Campus firewalls often block VPN protocols outright. Stealth looks like browsing.
Hotel, airport and café Wi-Fi
Guest networks that only let web traffic through, and drop packets when busy.
Mobile data that throttles VPNs
Carriers that slow down traffic they recognise as a VPN.
Stealth vs OpenVPN, WireGuard and Shadowsocks
Every protocol here encrypts well. The difference is what a hostile network can see.
| Capability | VPNBaron stealthHysteria2 · VLESS · Reality | OpenVPN | WireGuard | Shadowsocks |
|---|---|---|---|---|
| Looks like normal HTTPS | ||||
| Real TLS on port 443 | configurable | configurable | ||
| Survives deep packet inspection | partial | |||
| Resists active probing | ||||
| Tuned for lossy / throttled networks | partial | |||
| Fast modern encryption |
Use our app, or bring your own
Same account, same servers. The app does everything for you; your own client works too.
The VPNBaron app
RecommendedSign in, tap Connect, done. Nothing to import or configure.
- Stealth and Pathfinder built in
- Signs you in with a one-time email code if our sign-in page is blocked
- One account on every device
Your own client
Copy your personal stealth link from your account, or scan its QR code. Every stealth server loads at once, and the link keeps working without our website.
- V2BoxiPhone, iPad, Mac, Android
- HiddifyWindows, Mac, Android, Linux
- ShadowrocketiPhone, iPad
- v2rayNGAndroid
- Clash apps (Trojan)Windows, Mac, Android
Stealth VPN FAQ
What is a stealth VPN?
A stealth VPN disguises your encrypted tunnel as ordinary HTTPS web traffic. VPNBaron does this with two modern proxies — Hysteria2 and VLESS · Reality — both running on port 443 with real TLS, so to a firewall or deep packet inspection it is indistinguishable from a normal visit to a website. That is why it keeps working on networks where standard VPN protocols are blocked.
What are Hysteria2 and VLESS · Reality?
They are the two stealth protocols VPNBaron uses. Hysteria2 runs over QUIC (UDP/443) and is tuned for speed even on lossy networks. VLESS · Reality carries the VLESS protocol over TLS (TCP/443) and borrows the handshake of a real website, so it is extremely hard to fingerprint or probe. Every plan includes both, and Pathfinder in the VPNBaron app connects with whichever your network allows.
I was looking for a Trojan proxy — do you have one?
Yes, as a legacy option: every plan includes a Trojan profile for Clash apps (Clash Verge Rev, ClashX and others), on the Trojan page of your account. For networks that block VPNs, Hysteria2 and VLESS · Reality are the better choice — the same "looks like HTTPS" idea, but much harder for modern firewalls to spot.
Does it work on networks that block VPNs?
That is exactly what it is built for. Because the traffic looks like standard HTTPS on port 443, blocking it would mean blocking the entire encrypted web. It is the connection of choice on restrictive networks — strict firewalls, campuses, offices and countries that use deep packet inspection.
Which apps do I use?
The VPNBaron app for Windows, Mac, iPhone, iPad and Android has stealth built in: tap Connect and Pathfinder picks the protocol that works on your network. If you prefer your own client, import your personal subscription link (or scan its QR code) into V2Box, Hiddify, Shadowrocket or v2rayNG, and every stealth server loads automatically.
Where are the stealth servers?
Across North America, South America, Europe, Asia and Australia. Every location runs every protocol, stealth included, and every plan includes them all. The VPNBaron app always shows the current list.
Is stealth included, or is it an add-on?
Included with every VPNBaron plan, at no extra cost — alongside WireGuard, IKEv2 and OpenVPN. Switch freely depending on the network you are on.
Connect from networks that block VPNs.
Stealth, Pathfinder and a full VPN for every device, in one subscription.
See plans7-day money-back · From €4.99/mo