Tor-friendly no-KYC VPS that take Monero—curator shortlist (2026)

Threat model: What a VPS can and cannot hide

Before you pay a single piconero for a virtual private server (VPS), you must establish a clear threat model. Too many privacy newcomers believe that buying a “no-KYC offshore VPS with Monero” makes their online activities magically untouchable.

It does not.

A virtual private server operates on physical hardware owned, managed, and connected to the internet by a third-party datacenter. Regardless of what an advertising banner claims, a VPS host has ultimate technical visibility into your guest operating system:

• Hypervisor inspection: The host kernel can take memory snapshots of your running instance, exposing unencrypted RAM, ephemeral encryption keys, and active process tables.
• Network tap at the uplink: Upstream network providers log all incoming and outgoing IP packets, bandwidth surges, and connection timestamps.
• Physical seizure: Local law enforcement serving a valid domestic judicial warrant can physically unplug the server rack without notifying you in advance.

What an anonymous, XMR-paid VPS does accomplish:

1. Breaks the identity paper trail: When paying with Monero over Tor, your legal name, physical billing address, and credit card identity are never associated with the server’s public IP address.
2. Defends against automated mass surveillance: Scrapers, copyright trolls, and automated threat trackers only see a datacenter IP registered to an offshore hosting provider, not a residential connection linked to your home ISP.
3. Provides resilient ingress/egress infrastructure: Ideal for hosting high-availability Tor onion services (.onion), I2P eepsites, Matrix federation relays, or a remote Monero node (xmr.club/nodes) without doxxing your home network IP.

If your operational security assumes that the datacenter operator will wage a legal war on your behalf against a targeted domestic criminal subpoena, your threat model is broken. If your threat model requires severing the commercial paper trail and maintaining a resilient, censorship-resistant node, a properly shortlisted host is indispensable.

How xmr.club shortlists hosts

Mainstream hosting reviews evaluate servers on bandwidth benchmarks and affiliate payouts. At xmr.club, we evaluate providers against our public methodology and real-world operational testing:

• Signup data footprint: Does the provider demand a full name, billing address, and telephone number, or can you register using a pseudonym, a burner email, or a generated handle?
• Payment rail sovereignty: Does the checkout support native Monero (XMR) payments directly into the host’s wallet, or do they force you through third-party payment processors (like BitPay or CoinPayments) that run surveillance heuristics and demand identity checks?
• Tor Acceptable Use Policy (AUP): We explicitly distinguish between three very different levels of Tor support:
  1. Tor Hidden Services (.onion): Allowed by almost all privacy-centric hosts.
  2. Tor Middle/Bridge Relays: Tolerated by providers with generous bandwidth quotas.
  3. Tor Exit Nodes: Prohibited by 95% of VPS providers due to relentless automated abuse complaints and DMCA notices. Only specialized hosts with dedicated legal abuse desks tolerate exit nodes.
• Jurisdictional resilience: Where is the host incorporated, and where are their servers physically located? We favor hosts situated in jurisdictions with strong constitutional speech protections (such as Iceland, Switzerland, or Romania) that reject extraterritorial informal takedown demands.
• Editorial firewall: No hosting provider can purchase a Grade A rating on xmr.club. Sponsoring organizations can purchase prominent directory chips, but our grades are strictly earned and updated monthly.

Curator Shortlist (Draft-time live grades)

The following providers represent our top recommendations from the hosting catalog, verified through direct deposit tests and policy reviews.

1. Njalla VPS — The Gold Standard for Anonymous Signup

• Category & Grade: Hosting · Grade A (Editor’s Pick)
• Account Requirement: Anonymous handle. Zero personal information required.
• Payment: Monero (XMR), Bitcoin (BTC), Litecoin (LTC), Cash by mail.
• Curator Review: Founded by Peter Sunde (co-founder of The Pirate Bay), Njalla operates on a unique legal architecture: Njalla owns the server and domains legally on your behalf, serving as an operational proxy between you and the underlying datacenter. You register using an auto-generated account handle over their dedicated Tor onion mirror (http://njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion). You can even fund your balance by mailing physical banknotes to their Scandinavian office.
• Best For: Tor onion services, personal VPN nodes, private Matrix homeservers, and developers demanding complete signup anonymity.

2. 1984.is — Free-Speech Protection in Iceland

• Category & Grade: Hosting · Grade A
• Account Requirement: Pseudonymous email registration.
• Payment: Monero (XMR), Bitcoin (BTC), International bank wire.
• Curator Review: 1984 Hosting is a legendary Icelandic provider founded on civil liberties and free speech principles. Powered entirely by Iceland’s renewable geothermal energy grid, their operations fall strictly under Icelandic jurisdiction—renowned for legal resistance to foreign copyright and censorship takedowns. They accept Monero without KYC and boast an unblemished multi-decade operating tenure.
• Best For: Controversial political content, independent journalism, whistleblowing portals, and resilient public web services.

3. FlokiNET — Multi-Jurisdiction DDoS Protection

• Category & Grade: Hosting · Grade A
• Account Requirement: Pseudonymous account; onion registration portal.
• Payment: Monero (XMR), Bitcoin (BTC), Cash by mail.
• Curator Review: FlokiNET maintains physical datacenter presences across Iceland, the Netherlands, and Romania. They are one of the few hosting companies with in-house DDoS mitigation infrastructure that does not rely on Cloudflare or third-party US scrubbing centers. FlokiNET maintains a dedicated .onion mirror, accepts cash and Monero, and publishes explicit, clear rules governing privacy and abuse responses.
• Best For: High-traffic privacy platforms, federated communication nodes, and operators requiring robust DDoS resistance without commercial CDN surveillance.

4. BuyVM — The Veteran Budget Contender

• Category & Grade: Hosting · Grade A
• Account Requirement: Light email registration.
• Payment: Monero (XMR), Bitcoin, Credit cards.
• Curator Review: BuyVM (Frantech) is one of the oldest budget VPS providers in the crypto ecosystem. They are famous for offering unmetered bandwidth on gigabit uplinks, optional storage slabs (huge attachable disk volumes), and a remarkably practical, lenient Acceptable Use Policy. They were among the earliest hosts to adopt Monero natively.
• Best For: Full Monero blockchain nodes requiring 200GB+ storage, archiving, and high-bandwidth Tor middle relays.

5. IncogNET — Privacy-Focused Independent Operator

• Category & Grade: Hosting · Grade B
• Account Requirement: Anonymous registration; onion portal available.
• Payment: Monero (XMR), Bitcoin, Cash by mail.
• Curator Review: A boutique, independent provider operating servers in both the US and the EU. IncogNET explicitly caters to the privacy community, accepts cash in the mail, and offers dedicated customer support. Graded at B due to a smaller fleet and younger operating tenure compared to multi-decade giants, but highly rated by community members.
• Best For: Low-cost developer sandboxes and lightweight personal proxies.

Graded comparison matrix

Trust regressors: What to audit before renewing

Hosting companies are living entities. Mergers, executive changes, and regulatory enforcement frequently degrade a host’s operational posture over time.

Before paying an invoice on any VPS, check our incident ledger for the following trust regressors:

1. Quiet ownership acquisitions: When an independent, privacy-friendly host is acquired by a corporate holding conglomerate, compliance policies quietly change. Automated fraud scoring is quietly added to checkout pages.
2. Third-party KYC payment creep: A host may claim to accept cryptocurrency, but redirect checkout to an external processor that abruptly requests passport verification before marking an invoice as paid.
3. Abuse policy backtracking: Hosts facing carrier-level pressure may silently amend their AUP to ban all Tor traffic without notice, nullifying prepaid balances.
4. Jurisdiction migration: If a host shifts its corporate registration or core routing through Five-Eyes jurisdictions, their ability to shield user privacy against administrative subpoenas drops significantly.

Checkout & Hardening OPSEC checklist

Setting up an anonymous VPS requires disciplined tradecraft at checkout and initial boot:

At Checkout

• Access via Tor Browser: Connect to the provider’s website exclusively through the Tor Browser. If the host provides a .onion mirror, use it.
• Burner account credentials: Use a unique, pseudonymous email account generated specifically for this host (see our No-KYC Email Guide) or an auto-generated handle.
• Pay from a clean Monero subaddress: Never pay a hosting invoice directly from an exchange account. Send Monero from your self-custody wallet (Cake, Feather, or Monero GUI) using a freshly generated subaddress (8...).
• Wait for on-chain confirmations: Monero invoices typically require 10 network confirmations (~20 minutes) to clear. Do not close your browser tab until the invoice state transitions to “Paid.”

Server Hardening (First 15 Minutes)

# 1. Update system packages immediately
sudo apt update && sudo apt upgrade -y

# 2. Add a non-root administrative user
adduser operator
usermod -aG sudo operator

# 3. Configure SSH key-only authentication
mkdir -p /home/operator/.ssh
chmod 700 /home/operator/.ssh
touch /home/operator/.ssh/authorized_keys
chmod 600 /home/operator/.ssh/authorized_keys
chown -R operator:operator /home/operator/.ssh

# 4. Disable root login and password authentication in /etc/ssh/sshd_config
# PermitRootLogin no
# PasswordAuthentication no

# 5. Enable firewall (UFW)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

If your workload is a hidden service, you can even close port 22 to the public internet entirely and configure SSH over Tor via an authenticated onion service, rendering your server’s IP address completely invisible to port scanners.

Frequently Asked Questions

Can I run a Tor exit node on these VPS providers?

Generally, no. Running an exit node routes public, arbitrary internet traffic through your server’s public IP address, generating hundreds of automated abuse tickets, copyright infringement notices, and law enforcement inquiries daily. Mainstream VPS hosts will suspend your server within 48 hours to protect their IP subnets from blacklisting. If you intend to operate an exit node, you must coordinate with specialized non-profit operators (such as Noisebridge or Calyx Institute) and select dedicated providers with specialized legal abuse handlers.

Can a VPS host read my encrypted Monero wallet?

If you store an unencrypted wallet file or leave your wallet software running with the RPC interface exposed, yes. The host kernel has full read access to RAM and disk blocks. To protect your Monero on a VPS, run only a pruned view-only node or use an unprivileged node daemon (monerod) that does not hold private spend keys. Never leave your primary savings wallet unlocked on a remote VPS.

What is the difference between an anonymous VPS and an offshore VPS?

“Offshore” simply means the host is legally located outside your domestic jurisdiction. However, many offshore hosts enforce standard credit card KYC, record your real IP address, and readily comply with international police treaties. An “anonymous VPS” refers to the host’s intake practices: accepting zero-identification signups, providing onion mirrors, and accepting privacy-preserving payment methods like Monero.