URnetwork vs Obscura

Obscura is the closest design to URnetwork's on the market, and on one axis it is ahead: its entry hop cannot read user traffic under any configuration. URnetwork spreads the exit across thousands of members instead of one partner's fleet and ships post-quantum encryption by default.

Choose Obscura if you want operator blindness with zero exceptions, a published protocol audit, and Mullvad's court-tested fleet as the exit. Choose URnetwork if you want an exit side spread across members on residential addresses, post-quantum encryption on by default, and the whole stack published as open source. Both replace the no-logs promise with structure. They divide the same problem differently and fail in different directions.

Obscura launched in February 2025 from Sovereign Engineering Inc., a small New York company. It is a two-party relay: Obscura runs the entry hop your device dials, and Mullvad runs the exit. The client negotiates its WireGuard session directly with the exit's public key and tunnels the encrypted datagrams to Obscura's relay inside QUIC, so the company you pay forwards bytes it holds no key for. Mullvad announced the partnership on its own blog in February 2025, and every one of the 254 exits in Obscura's public API on 7 August 2026 matched a live, named, diskless Mullvad WireGuard relay, about 45% of Mullvad's fleet.

URnetwork uses member-run exits. The provider does not receive your source IP on the relayed path. Native apps seal traffic to the provider by default. How URnetwork works explains the full design. The threat model holds the complete record of what is stored and enforced.

Six differences that affect the choice

Caveats below the table:

• Obscura is $8.00/month flat, no multi-month discount, nonrefundable by default, three connection slots. URnetwork Pro is $5/month or $40/year with a free daily allowance, plus one-off data packs. Current numbers are at ur.io/products.
• Platforms: Obscura ships macOS, iOS and Android plus generic WireGuard configs; Windows and Linux are under active development. URnetwork ships all five plus a browser extension paired with its web app.
• Kill switch: Obscura lists an "On demand kill switch" under Experimental, and on Android relies on the OS always-on setting. URnetwork ships an explicit toggle on every platform; the extension's defaults on.

Operator blindness on each side

Obscura's entry hop cannot read user traffic for any user, on any platform, in either transport mode. The property comes from the key schedule rather than a setting: the client's WireGuard session is built against the exit's public key, the relay carries the resulting datagrams inside QUIC, and no code path terminates the tunnel at the relay.

URnetwork's counterpart is on by default and not unconditional. Post Quantum Encryption seals the client-to-provider session in every native app out of the box. Every current provider build answers it, and while the setting is on a provider that cannot be sealed to is skipped rather than used unsealed — so the cost is availability, not a silent downgrade the operator could read. Turn the setting off and traffic can take the standard path, where the operator could in principle observe which sites a session contacts. No app yet shows a per-connection sealed-or-not verdict, and the browser extension ships no sealed session at all; there, the operator's data path logs nothing, pinned by a test in the open code. On this axis Obscura is ahead.

One qualification travels with that concession. The exit public key is whatever Obscura's own API returns, and nothing in the client verifies it against Mullvad's published list. The exact claim is that Obscura cannot decrypt your traffic provided the key it hands you is genuinely Mullvad's. The check is real and manual: the app displays the exit key, Mullvad publishes the same keys, and a user can compare them. The app will not do it for you.

One exit partner, one landlord

All 254 of Obscura's exits are Mullvad's; its own FAQ says "a fully-independent exit hop (currently Mullvad)", and the exit provider is a data field in the client rather than a hardcoded dependency. Neither party publishes the commercial terms, so the observation is concentration, not anything about the contract. The partner is about the best available: diskless servers, a public list naming every host, and the April 2023 raid that produced nothing (URnetwork vs Mullvad). Obscura's users inherit that record at the exit, but not Mullvad's post-quantum tunnels or its DAITA traffic-analysis defense: the pre-shared-key slot is left empty, and DAITA is off on all 254 exits Obscura offers.

The infrastructure under the two parties is less separate than the corporate structure. Measured against Obscura's own relay API and RIPE registry data on 7 August 2026: 35 of its 38 entry relays announce from ASNs registered to Datacamp Limited, and for 29 of the 38 relay locations every preferred Mullvad exit is a DataPacket relay, Datacamp again; in San Jose both hops share one ASN. This breaks no cryptography, and ASN co-location is not physical co-location. It means that across roughly three quarters of the footprint one hosting company carries both legs, so a party with visibility into that company's network can watch both sides and attempt timing correlation. Cure53's conclusion names the boundary in its own words: the protocol "prioritizes low latency over maximum protection against global attackers."

Hosting concentration is industry-wide; it lands harder here because separating the hops is the product. Correlation is the attack both products are thin against: Cure53's OBS-01-006 found Obscura's QUIC data packets unpadded, with padding now a default-off option, and URnetwork ships no cover traffic at all, only the spread of a session across several providers, which raises the cost of watching one. The difference is the exit side. URnetwork's traffic leaves through many households on unrelated consumer ISPs rather than one company's address space, and a location exists only while a member's device is online in it, with live counts published without a login at api.bringyour.com/stats/last-90. The evidence is asymmetric, and stated as such: the Datacamp figures are outside measurements of Obscura, and nobody has measured URnetwork's fleet from outside.

The audit, and the licence

Cure53's OBS-01 engagement is the more relevant audit in this comparison. It examined the protocol design itself, along with the macOS app and its network extension, in May 2025, over 20 person-days with three senior testers. Six findings, one rated Medium, four with verified fixes. Obscura quotes it accurately: "no major security vulnerabilities within its defined threat model," with the two-party relay called "a significant architectural achievement". The full report is on Obscura's own site. Scope travels with the citation: the iOS app, the Android app, Windows, Linux, the relay servers and the API backend were outside it, so of the surfaces Obscura runs in production the audit covers one, and as of August 2026 it is the only one. URnetwork has no protocol audit at all; its two 2025 assessments cover other surfaces and are listed under Limits.

Licensing separates the two codebases more than the word "public" suggests. Obscura's client is on GitHub under the PolyForm Noncommercial License 1.0.0: source-available, not open source by the usual definition, with commercial use and competing services prohibited and external contributions refused for now. The relay daemon and API backend are unpublished, and reproducible builds remain a stated plan eighteen months after they were promised. Two corrections run in Obscura's favor: it never calls itself open source, its phrase is "public source code", and the "fully open source" claim in third-party reviews is those reviews' error; and source-available still supports verification, since the architecture claims above were checked against that source and held. URnetwork publishes clients, SDK and server under an open-source licence with contributions accepted.

Where Obscura wins

• Zero exceptions on operator blindness: the entry hop cannot read traffic for any user on any platform, with no fallback and no extension carve-out.
• The published protocol audit, full report on its own site. URnetwork has no equivalent for the layer its privacy claim rests on.
• The exit operator's record: Mullvad's diskless fleet and the 2023 raid that produced nothing.
• Two jurisdictions by design: a demand must reach a US company and a Swedish one at the same time, then still correlate traffic.
• Predictable performance from datacenter capacity, against member uplinks.
• Bitcoin Lightning and Monero payment, leaving less trace than USDC on a public ledger, and an account that is a random 19-digit number with proof-of-work instead of identity checks.
• Pricing and disclosure style: flat $8, no discount ladder, and exit and relay lists anyone can query without an account.

Where URnetwork wins

• No single partner owns the exit side: egress is thousands of members' own connections under signed contracts, against one company's fleet.
• The exit address: residential and mobile IPs where published datacenter ranges are blocked or challenged, the most common everyday failure of a datacenter exit.
• Reach and aim: 90+ countries and 2,000+ real cities by its own count, against 24 countries and 38 cities from Obscura's API; browse countries, search for a city.
• Post-quantum encryption on by default. Obscura has none and claims none.
• Plural exits: a window of several providers with per-site pinning, so no one exit carries a whole session.
• Whole-stack open source, including the half that assigns keys and providers; Obscura's equivalent half is unpublished.
• Breadth: five OS apps plus the extension and web app, an SDK, a free daily allowance, and a supply side in the UR protocol.

Limits and evidence

URnetwork's main limits:

• No independent audit covers the protocol, the connect engine, or the operator's server code. Two 2025 third-party assessments cover other surfaces: a penetration test of the web application and API (April–May 2025), and the Leviathan MASA AL2 assessment of the Android app, which passed. Leviathan writes that its assessment "should not be read as a holistic security evaluation or comprehensive penetration test." Neither examined logging, retention, or the data path.
• The sealed session is default, not unconditional: with it on, a provider it cannot seal to is skipped rather than used unsealed, so the cost is availability; turn it off and the standard path is available again. No app yet shows a per-connection sealed-or-not verdict, and the browser extension has no sealed session. Obscura's single code path carries none of these caveats.
• The split assumes the operator and the providers in your window are independent. Nothing in the system attests that independence, the operator could itself run providers, and no outside party has measured the fleet. See the threat model, §6.1.
• URnetwork retains more than Obscura claims to: a keyed hash of the address block and a resolved city per connection, against a stated policy of storing no IP at all. URnetwork's record is checkable in code; Obscura's rests on an unpublished backend.
• Neither company escapes US legal process: Obscura is a New York company and BringYour, Inc. a Delaware one, and neither publishes a warrant canary or transparency report.

Obscura's limits are concentration and publication. Both hops mostly ride one hosting company; the exit side belongs to one partner; the relay and API code is unpublished, and the API is the part that hands your client its exit key; and the one numeric coverage claim on its site, "33+ countries", does not match the 24 its own API returns. None of it is a scandal; the company is small, young, and shipping quickly, with releases about fortnightly.

Trying URnetwork costs nothing: the Instant Account takes one tap and no email, so you can test it against your own sites before paying for either product. More questions are answered in the FAQ.