# URnetwork vs Sentinel

Sentinel decentralizes the coordinator, a public blockchain that matches you
to an independent node; URnetwork keeps one accountable operator and splits
every session so the exit never learns who you are and the operator cannot
read the sealed session.

**Choose Sentinel** if you want no company in the coordination loop, protocol
variety with V2Ray where censorship is the adversary, and the most active
development of the major dVPNs. **Choose URnetwork** if you want every
session split between two relay parties, one open stack under one policy
instead of per-app trust, and residential exits you can search by city. Both
hold that exits should be independent, consenting, and paid; they differ on
what to decentralize.

[Sentinel](https://sentinel.co) is not one VPN but a protocol with an app
ecosystem on top: a public Cosmos-SDK blockchain where independent node
operators sell bandwidth, and a family of independently branded consumer apps
that buy from that shared supply. The sentinel.co site and the first-party
Shield app are published by one UK company, Capybara Publishing Ltd; the
other apps belong to other companies. Nodes speak WireGuard, V2Ray, and
OpenVPN, and operators earn the network's token, renamed from DVPN to P2P in
2025.

URnetwork uses member-run exits. The provider does not receive your source IP
on the relayed path. Native apps seal traffic to the provider by default.
[How URnetwork works](/docs/overview) explains the full design. The
[threat model](/docs/threat-model) holds the complete record of what is stored
and enforced.

## Six differences that affect the choice

| | Sentinel | URnetwork |
|---|---|---|
| Coordinator | Public Cosmos-SDK chain; no company required in the loop | One accountable operator, BringYour, Inc. |
| Traffic path | Direct tunnel to one node, which sees your IP and your destinations together | Two relay parties; the exit never sees your IP, and the operator cannot read the sealed session |
| Protocols | WireGuard, V2Ray, OpenVPN | Own transport over TLS/QUIC |
| Apps and policies | Independently owned app brands; policies and payment handling vary per vendor | One first-party app set, one policy |
| Exits | Whatever machine an operator registers; no vetting, no residential requirement | Residential member devices; browse countries, search for a city |
| Development | Chain and node repos updated within days (August 2026); the fastest-moving of the major dVPNs | One open codebase, apps through server, actively shipped |

Caveats below the table:

- Post-quantum encryption is URnetwork-side here: the X25519MLKEM768
  client-to-provider session is default in the native apps, skipping any
  provider it cannot seal to rather than downgrading. Sentinel advertises no
  post-quantum feature. The browser extension has no sealed session; there,
  the operator's data path logs nothing, pinned by a test in the open code.
- Everyday controls are uniform on URnetwork: native apps on Android, iOS,
  macOS, Windows, and Linux plus a browser extension paired with the web app,
  each with an explicit kill switch. On Sentinel, those controls vary with
  the app you install.
- Sentinel pricing depends on the app, and the consumer apps take ordinary
  payment as well as crypto. URnetwork has a free daily allowance and Pro at
  $5/month or $40/year. Current numbers are at
  [ur.io/products](https://ur.io/products).

## The chain and the node economics

The chain is the marketplace. Node operators register on it, third-party apps
match their users to nodes, and payment settles on-chain; many storefronts
share one node supply, and the project is broadening toward a general
peer-to-peer bandwidth marketplace. Operators earn the network's token.
Registration is permissionless: the node-setup docs impose no vetting, no
KYC, no logging policy, and no check on where a node physically sits.
Sentinel's own node documentation also describes network revenue as
substantially subsidized by in-app advertising.

Once matched, your device opens a WireGuard, V2Ray, or OpenVPN tunnel
straight to the node. One hop keeps the path short, and it makes that node
the classic VPN endpoint: it sees your real IP on one side and your
destinations on the other for the length of the session, and the party in
that seat is a pseudonymous stranger paid per gigabyte. Sites' own HTTPS
still hides page contents; what is exposed is the metadata.

The counts around the network need their dates. Marketing on sentinel.co
counts operators and cities in the thousands with no methodology and no as-of
date attached. Sentinel's own statistics page showed roughly 1,500 nodes
online in August 2026, and community monitoring the same week placed about a
third of the fleet in the United States. On a permissionless network a node's
location is wherever its IP appears to be, and the docs describe no way to
check where a node physically sits.

URnetwork's coverage answer is structural: a location is a member's device
physically in it and online now, and the platform geolocates the connection
it observes rather than letting a provider declare a city. That is 2,000+
real cities by URnetwork's own count, with live counts in the app. An exit
that looks like a datacenter or a VPN is detected and demoted, not excluded,
and no outside party has measured URnetwork either. Every byte a provider
carries moves under a signed, metered contract, and an open-source filter at
the member's own exit drops file-sharing and attack traffic before it leaves
their line, recording no destination or contents. On Sentinel, what a node
carries and what protects its operator is up to each node and each app.

![Anonymity vs everyday usability — qualitative placement of single-hop VPNs, URnetwork's four legs, Tor, and mixnets](/docs-assets/infographic-anonymity-latency.svg)

*One direct hop is the shorter path; two relay parties are the fewest that
still split the knowledge.*

## Which app are you trusting?

sentinel.co lists separately owned consumer apps under one heading,
"Products," under one company's copyright, without saying they are other
companies. The relationship is not always at arm's length either: one listed
app is shipped by the company of the person sentinel.co presents as
Sentinel's CEO. The policies vary radically with the brand. At least one app
in the product list ships advertising networks, Google Analytics, and
Firebase behind a "no-logs" headline, while the first-party Shield policy
makes different promises. Whichever app you install is the party that sees
your account and payment details, and the public chain records payment flows
pseudonymously, forever.

The homepage sells "provable encryption" and never says provable how, or by
whom. No attestation, no reproducible-build check, and no audit is published
anywhere in the project. The flagship Shield app's store listing states both
halves of the problem: it "can prove that your browsing history and
information is not being stored," and, a few lines later, that it "doesn't
control and own the exit-servers." Whoever does not control the exit server
cannot prove what that server keeps. The open chain and node code is
readable, and that is real; readable code is not evidence that the node you
were matched to is running it. Shield's own releases date to November 2025,
its Android build is a direct download from Sentinel's site, and its Google
Play listing no longer resolves.

URnetwork's answer to the same question is one public codebase from the app
in your hand to the operator server and the provider engine, so both
endpoints of the sealed session live in code anyone can read. What that does
not cover, an audit of the protocol or the operator's server code, is stated
under Limits below.

![Who can see what — single-party VPN vs Apple Private Relay's closed two-party split vs URnetwork's split knowledge](/docs-assets/infographic-who-sees-what.svg)

*The trust-model question in one view: which designs hand one party both
halves.*

## Where Sentinel wins

- Coordination without a company: the chain-based marketplace removes the
  operator as a required trusted party, the strongest decentralization story
  in this comparison set.
- Genuine multi-protocol support: V2Ray where censorship is the adversary,
  plus WireGuard and OpenVPN.
- The most active development cadence of the major dVPNs as of August 2026,
  on an open Cosmos appchain anyone can inspect or build on.
- Fiat payment options in the consumer apps; no crypto required to start.
- A shorter path in principle: one direct hop, with no relay leg in the
  middle.

## Where URnetwork wins

- Split knowledge on every session: the exit never sees your IP, and the
  operator cannot read the sealed session. No single party holds identity and
  destinations together, versus a direct tunnel that hands one node both.
- One integrated, open stack under one privacy policy, versus per-app trust
  that varies by vendor.
- Storage limits enforced in code, recorded in the
  [threat model](/docs/threat-model), rather than per-app promises.
- Real presence: residential exits in 2,000+ real cities by URnetwork's own
  count, searchable by city, with live counts in the app.
- Protection for the member at the exit: file-sharing and attack traffic
  dropped before it leaves their line, with no destination or contents
  recorded.
- One price for one product, and no token to acquire. Providers participate
  in the [UR protocol](https://ur.xyz) by running the app.

## Limits and evidence

URnetwork's main limits:

- No independent audit covers the protocol, the connect engine, or the
  operator's server code. Two 2025 third-party assessments cover other
  surfaces: a penetration test of the web application and API (April–May
  2025), and the Leviathan MASA AL2 assessment of the Android app, which
  passed. Leviathan writes that its assessment "should not be read as a
  holistic security evaluation or comprehensive penetration test." Neither
  examined logging, retention, or the data path.
- The split assumes the operator and the providers in your window are
  independent. Nothing in the system attests that independence, the operator
  could itself run providers, and no outside party has measured the fleet.
  See the [threat model](/docs/threat-model), §6.1.
- Coverage counts are self-published on both sides. No outside party has
  measured Sentinel's node map or URnetwork's presence claims.
- URnetwork is the younger product set, and speed moves with the providers in
  your window; on Sentinel it moves with the node you were matched to.

Sentinel's limit is the seat at the end of the tunnel. Each session hands one
node your IP and your destinations together, the node took no vetting to
register, and the promises around that fact belong to whichever app you
installed, with no named audit behind any of them. Decentralizing the
coordinator is real, and it does not split the traffic.

Trying URnetwork costs nothing: the Instant Account takes one tap and no
email, so you can test the split path against your own sites before paying
for either product. More questions are answered in the [FAQ](/docs/faq).