VPN obfuscation

Updated 21 September 2026 · How we research

Obfuscation hides the fact that you are using a VPN. Encryption protects the contents of your traffic; obfuscation attacks the shape of it, so that deep packet inspection cannot classify the connection in the first place.

How VPN traffic gets identified

Common techniques

All obfuscation trades speed for resistance to detection.

TechniqueIdeaLimitation
Run on port 443Use the port every network must allowDefeats port blocking only; DPI still sees the handshake
TLS wrappingPut the tunnel inside a genuine TLS sessionAdds overhead and often forces TCP
Obfuscation layersScramble the handshake so it matches no known signatureVulnerable to active probing if the server answers unusually
Proprietary transportsVendor-specific designs such as ZoogVPN's Shadow and ZoogTLSNo public specification, so effectiveness cannot be independently assessed

Nothing here is guaranteed

Censorship systems are actively maintained and adapt. A transport that works today may be detected next month. Treat any provider's claim of guaranteed access to a specific restricted network as unverifiable — including claims made in vendor marketing.

ZoogVPN's options

ZoogVPN publishes two proprietary transports aimed at restricted networks: Shadow, listed for Windows, macOS, iOS and Android, and ZoogTLS, listed for Windows only. Both are described by the vendor as moderate speed, which is consistent with the overhead obfuscation normally carries.

Legal and personal risk

Rules on circumventing network restrictions differ sharply between countries and can carry serious consequences. Understand your own situation before relying on any of this. Nothing on this page is legal advice.