Who this guide is for
You work from cafés, co-working spaces or shared offices on networks someone else runs, and want your traffic encrypted across them.
Who it’s not for
DarkMatter isn’t a replacement for your employer’s VPN. To reach company file shares or intranet apps, the client your IT team gave you is the one that gets you in.
In short
- On café and co-working Wi-Fi, a VPN encrypts your traffic so the network sees one connection to a VPN server, not the services you use.
- DarkMatter is a privacy VPN, not a corporate access VPN. It can’t get you onto your employer’s internal network.
- Split tunnelling (not on iPhone, iPad or Mac) lets you keep local devices, such as the office printer, or a work VPN client outside the tunnel.
- Check your employer’s policy before running a personal VPN on a work device.
On this page
Remote work mostly means working on other people’s networks. The café that gives you an hour of Wi-Fi with a coffee. The co-working space where you have never met the person at the next desk. The shared office where the router was configured years ago by someone who has since left. You still open client files on those networks, sign in to billing systems, and send work that is not yours to leak. DarkMatter encrypts the traffic leaving your device, so the network you happen to be sitting on carries it without being able to read it.
Why people use a VPN for remote work
- You do not control the network. Guest Wi-Fi in a café, hotel or shared office runs on equipment you have never seen, managed by people you have never met. A VPN means you do not have to decide whether to trust it.
- Client data comes with obligations. Contracts, NDAs and data protection duties usually expect reasonable technical measures. Encrypting your connection when you work off-site is one of the simpler ones to put in place, though it is not a compliance programme on its own.
- Shared networks are genuinely shared. Other devices sit on the same connection. Anything not already encrypted can be visible to a misbehaving machine, and a hotspot with a convincing name is easy to set up.
- Your IP address follows you around. Every service you use sees an address that maps to roughly where you are and who provides your connection. Through a VPN it sees a VPN server’s address instead. Our What is my IP tool shows what you are currently handing out.
- Connections drop at the worst moment. Café Wi-Fi is fickle. A kill switch, in our Windows app, is designed to stop traffic if the tunnel drops, rather than letting an upload quietly continue over the open network.
How it helps
DarkMatter builds an encrypted tunnel between your device and a server on our network. What travels inside it — the sites you reach, the files you move, the credentials you send — is wrapped in AES-256 encryption. The network operator, and anyone else sitting on that network, sees one encrypted connection to one endpoint rather than the list of services you are actually using.
WireGuard is the default protocol, and OpenVPN, IKEv2 and IPSec are there as well, which helps when a particular network handles one protocol badly and another fine.
Encryption on its own is not enough if requests escape around the tunnel, so DNS leak protection and IPv6 leak protection are designed to keep name lookups and IPv6 traffic inside it. In our Windows app, the kill switch is designed to handle the other failure mode: a tunnel that fails quietly while you carry on working in the belief that you are protected.
Split tunnelling (not on iPhone, iPad or Mac) is the piece most remote workers end up caring about. Plenty of things you need are on the local network rather than the internet — the office printer, a NAS with the shared project archive, a test device on the same subnet. Split tunnelling lets you choose what goes through the tunnel and what stays on the local connection, so you can print a contract without disconnecting.
Behind all of it, our network covers 6,000+ servers across 65+ countries and 80+ locations, with 20 Gbps per server, and you can see what is available on the server locations page. One plan covers up to 5 devices at once, which in practice is the laptop, the phone and the tablet that follow you between desks.
| On a shared network | Without a VPN | With DarkMatter |
|---|---|---|
| What the network sees | The services you connect to | One encrypted connection |
| Your unencrypted traffic | Readable in transit | Encrypted inside the tunnel |
| DNS lookups | Handled by the network | Designed to resolve through the tunnel |
| What websites see | Your real IP address | The server you chose |
| If the connection drops | Traffic carries on in the clear | Kill switch (Windows app) designed to block it |
Every feature on every plan
Encrypt your connection on up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TV
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
The honest bit
An honest note on what a VPN cannot do
DarkMatter is a privacy VPN, not a corporate access VPN, and the difference matters. If your employer runs an internal network with file shares, intranet apps or systems that only answer to company machines, the client their IT team gave you is the one that gets you in. We cannot grant access to a private network we are not part of, and no consumer VPN can.
The two do different jobs and can sit side by side: DarkMatter protects the untrusted network between you and the internet, while your employer’s client protects the route into their systems. Running two tunnels at once can conflict, depending on how the corporate client is configured. If something misbehaves, disconnect DarkMatter, or use split tunnelling (not on iPhone, iPad or Mac) to keep the corporate client outside our tunnel. Check your employer’s acceptable use policy too — some organisations are specific about what may run on a managed device.
We also cannot promise that any particular third-party service will work while you are connected. Banks, corporate sign-on portals, payroll systems and some SaaS tools detect VPN addresses and respond in their own way, from an extra verification step to refusing the connection outright. That is their decision, not ours, and anyone who promises you otherwise is guessing on your behalf.
A VPN protects the connection, not the account and not the device. It does not stop phishing, it does not remove malware, and it does nothing for a laptop that is already compromised — strong unique passwords and two-factor authentication still do that work. What we can offer is an encrypted tunnel across our network, a choice of protocols and locations, and a money-back guarantee on your first purchase (30 days, or 14 days on monthly plans) if DarkMatter is not right for how you work.