Features
VPN features that protect your connection
Six protections that work together, each explained plainly, including what it can’t do. Every plan includes all of them.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
- Servers
- 6,000+
- Countries
- 65+
- Locations
- 80+
- Per server
- 20 Gbps
Figures for the network DarkMatter runs on. See server locations
How it fits together
How your connection is protected
Follow your traffic from your device to the website. Each number is a feature that covers that stretch of the journey.
- Encrypted VPN tunnel
- Normal internet connection
- Split tunnellingChoose what enters the tunnel (not on iPhone, iPad or Mac)
- Kill switchWindows app: designed to hold traffic if the tunnel drops
- DNS leak protectionKeeps lookups off the local network
- IPv6 leak protectionCloses the dual-stack gap
- AES-256 encryptionScrambles data in the tunnel
- WireGuardA modern way to build the tunnel
Read this diagram as text
One row, read left to right. 1 and 2: your device, where split tunnelling (not in the iPhone, iPad or Mac apps) chooses what enters the tunnel and the kill switch (in our Windows app) is designed to hold traffic back if the tunnel drops. 3 and 4: the local network, such as Wi-Fi or your internet provider, which sees only encrypted traffic heading to a VPN server; DNS and IPv6 leak protection are designed to stop lookups and IPv6 traffic going around the tunnel here. 5 and 6: the encrypted tunnel itself, scrambled with AES-256 or built with a protocol such as WireGuard. Then the VPN server decrypts the traffic and sends it on, and websites see the server’s IP address rather than yours.
One row, read left to right. 1 and 2: your device, where split tunnelling (not in the iPhone, iPad or Mac apps) chooses what enters the tunnel and the kill switch (in our Windows app) is designed to hold traffic back if the tunnel drops. 3 and 4: the local network, such as Wi-Fi or your internet provider, which sees only encrypted traffic heading to a VPN server; DNS and IPv6 leak protection are designed to stop lookups and IPv6 traffic going around the tunnel here. 5 and 6: the encrypted tunnel itself, scrambled with AES-256 or built with a protocol such as WireGuard. Then the VPN server decrypts the traffic and sends it on, and websites see the server’s IP address rather than yours.
Every protection
What each feature does
Encryption and protocols
Scramble your traffic so the networks in between can’t read it.
AES-256 encryption
Traffic in the VPN tunnel is protected with strong, standard encryption, including AES-256: a widely reviewed, industry-standard cipher.
Helps prevent: Networks between you and the VPN server reading the traffic that passes through them.
How it worksWireGuard VPN protocol
WireGuard is a modern VPN protocol with a small codebase and a fixed set of modern cryptography.
Helps prevent: Weak or mistaken cipher choices, because there aren’t any to pick.
How it works
Leak protection
Designed to close the gaps where traffic could slip outside the tunnel.
VPN kill switch
In our Windows app, the kill switch is designed to block traffic if the VPN tunnel drops, rather than letting your PC fall back to its normal, unprotected connection.
Helps prevent: Unencrypted traffic and your real IP address slipping out when the tunnel drops.
How it worksDNS leak protection
DNS leak protection is designed to keep your DNS lookups inside the encrypted tunnel, so they aren’t sent to your network provider’s resolver in the open.
Helps prevent: The names of sites you visit being looked up in the open, outside the tunnel.
How it worksIPv6 leak protection
On dual-stack networks, IPv6 traffic can bypass a tunnel that only carries IPv4. IPv6 leak protection is designed to prevent that by tunnelling or blocking IPv6 while you’re connected.
Helps prevent: IPv6 traffic taking its own route around the tunnel on dual-stack networks.
How it works
Control
Decide what goes through the VPN and what doesn’t.
No tiers, no add-ons
Every plan includes every feature
There’s nothing to upgrade to. Choose how long you want to commit for; the protection is the same.
- 6,000+ servers in 65+ countries
- Up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TVApps for Windows, macOS and iOS
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- AES-256 encryption
- WireGuard, OpenVPN, IKEv2 and IPSec protocols
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
Protocols
The VPN protocols our network supports
WireGuard, OpenVPN, IKEv2 and IPSec: how they differ, in general terms. No speed tests, no league tables.
| WireGuard | OpenVPN | IKEv2 | IPSec | |
|---|---|---|---|---|
| First released | Late 2010s | Early 2000s | 2005, as a standard | Mid 1990s |
| Size of the code | Very small | Large | Varies by implementation | Varies by implementation |
| Cryptography | A fixed, modern set | Chosen from options | Chosen from options | Chosen from options |
| Openness | Open source | Open source | Open standard | Open standard |
| Typical role | Modern, general-purpose VPN | Flexible, long-established VPN | Sets up keys, usually for IPSec | Encrypts traffic between devices and networks |
General properties of each protocol, not measurements of our service. Which protocols you can choose depends on your device and app. How WireGuard works
Check it yourself
Don’t take our word for it
Use these free tools with the VPN off, then on, and compare what you see.
Questions about our features
Which features does every DarkMatter plan include?
All of them: DNS and IPv6 leak protection, AES-256 encryption and the WireGuard, OpenVPN, IKEv2 and IPSec protocols, plus split tunnelling in every DarkMatter app except iPhone, iPad and Mac, and the kill switch in our Windows app. Plans differ only in how long you commit for. Compare plans.
Do the features work the same on all my devices?
Not entirely. The kill switch is only in our Windows app, and split tunnelling isn’t in the iPhone, iPad or Mac apps. DarkMatter has apps for Windows, macOS, iOS, Android and Fire TV, and other options, such as which protocols you can pick, depend on your device.
Not entirely. The kill switch is only in our Windows app, and split tunnelling isn’t in the iPhone, iPad or Mac apps. DarkMatter has apps for Windows, macOS and iOS, and other options, such as which protocols you can pick, depend on your device.
What doesn’t a VPN protect against?
A VPN encrypts your connection and replaces your IP address with a VPN server’s. It doesn’t stop malware or phishing, and websites you sign in to still know it’s you. Each feature page lists its own limits in plain English.
Which VPN protocol should I choose?
If you’re connecting without problems, there’s no need to change anything. If a network gives you trouble, try another protocol. Some networks block VPNs, and we can’t promise any protocol will connect. How WireGuard works.
How can I check the VPN is working?
Open What is my IP with the VPN off, then on. When it’s working, websites see a VPN server’s address instead of yours. The WebRTC leak test checks a separate browser leak.
What if DarkMatter isn’t right for me?
Your first purchase on our website is covered by our money-back guarantee (30 days, or 14 days on monthly plans). The refund policy has the details.
Every feature, on every plan
Protect up to 5 devices at once. Renewal prices are shown before you pay.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV