№ 01 / A VPN for one job

A VPN that slips past
censorship, quietly.

Most VPNs are built to change your location. Samizdat is built to not be noticed. Three transports, auto-selected. Indistinguishable from a browser visiting a real website. No logs older than 24 hours.

Get access — $7/mo How it works

Transports: 3 · auto-select
Logs retained: 0 · after 24h
Platforms: macOS · Win · Linux · Android

№ 02 / Why this exists

The game changed. Most VPNs didn't.

OpenVPN doesn't work.

Russia's TSPU detects the TLS fingerprint and the opcode sequence within one round-trip. You're throttled before the tunnel is up.

Plain WireGuard doesn't either.

The first four bytes of every WireGuard handshake are a fixed magic. TSPU boxes match that pattern in hardware and drop the flow.

Generic proxies leak the fingerprint.

Shadowsocks-AEAD-2017 is pure-entropy from byte zero — statistical classifiers flag it before you get three packets through.

Samizdat doesn't hide traffic.

It hijacks the TLS handshake of a real, busy website. To the DPI box, you are a browser visiting Microsoft. Not similar. Identical.

№ 03 / Transports

Three rails. One button. The client picks.

01

VLESS + Reality + XTLS-Vision

Primary · TCP · port 443

The server performs a real TLS handshake to a real decoy site — Microsoft, Apple, iCloud — and hijacks the channel afterwards. Every byte on the wire up to session-key derivation comes from the decoy, not from us. There is nothing to classify.
02

Hysteria2

Fast · UDP · port-hopping 20000–40000

QUIC with salamander obfuscation and UDP port-hopping. Designed for mobile networks that drop 30% of packets on purpose. When Reality gets slow, the client silently moves here.
03

AmneziaWG

Fallback · UDP · junk-padded handshake

WireGuard with randomized junk packets before the handshake — defeats the fixed-prefix signature that killed vanilla WG in 2023. Used when UDP is throttled and Reality is under pressure.

Full technical brief: docs/protocols.md. Threat-model notes: russia-blocking-2026.md.

№ 04 / Clients

Every platform that matters. Nothing that doesn't.

macOS

Universal binary (Intel + Apple Silicon). Native tray. Launch at login.

Windows

Signed MSI. Works under Windows 10 and 11. WireGuard-NT-based TUN.

Linux

AppImage + deb + RPM. systemd user service. Works under Wayland and X.

Android

Kotlin + VpnService. Compose UI. Sideload APK or F-Droid. Not on Google Play.

№ 05 / Pricing

One plan. No tiers, no trickery.

$ 7 /mo

→ Unlimited bandwidth
→ 5 concurrent devices
→ 10+ server locations, growing
→ All three transports, all platforms
→ Cancel anytime. Annual saves 30%.

$7 · monthly $59 · annual

Pay with card (Stripe / ЮKassa) or BTC / USDT. 7-day refund.

№ 06 / Questions

Things you're about to ask.

Does this work from inside Russia?: Yes. That is the only network we explicitly design against. If TSPU starts targeting Samizdat nodes, we rotate SNI, shortIds, IPs, and (if needed) cryptographic keys. Incidents get a public post-mortem.
What do you log?: Bandwidth rollups per account, aggregated daily, for billing reconciliation. Nothing else survives past 24 hours. No source IPs, no destination IPs, no DNS query logs, no session timestamps, no per-connection records. Read docs/security.md.
Why not OpenVPN / WireGuard?: They don't work against the adversary we're designed for. Adding them would be a political statement ("look, we have lots of protocols") that actively harms users who would pick them and get blocked. We refuse on principle.
Are you on Google Play / the App Store?: Android: sideload APK, or F-Droid. iOS: not yet. Commercial stores routinely remove anti-censorship VPNs on government request. We will never depend on them as our only distribution channel.
Self-hosting?: The server stack is open. See server/ — one shell script to provision. The desktop client is proprietary while we stabilize; happy to license the core for self-hosted use, email us.
Will you be blocked?: Eventually, yes — any VPN will. The question is how fast we rotate when it happens. Our aim is hours, not weeks. Subscribe to status updates before you need them.

A VPN that slips past censorship, quietly.