Europa

Get started

Buy VPN access in five minutes.

You don't need an account on this site. You need a Bitcoin wallet, a WireGuard or OpenVPN client, and a few minutes. Pay an operator, get a config file, import it, connect.

1. A Bitcoin wallet

Operators take payment in Bitcoin. Two flavors are common — pick whichever you already use. The operator's listing says which they accept.

Bitcoin Lightning

The faster, more universal option. Any Lightning wallet works:

  • Phoenix (iOS, Android)
  • Zeus (iOS, Android — self-custody)
  • Mutiny (browser)
  • Strike, Alby, BlueWallet — any modern Lightning wallet.

Ecash

Ecash (technically Cashu) gives the operator no link between your payment and your identity. Slightly more setup; pick this if you already have a balance, or don't mind opening a wallet now.

Make sure your ecash is at the same issuer the operator accepts (the operator's listing names it). If it isn't, the wallet will swap you over before you pay.

2. A VPN client

Operators hand out standard WireGuard configs (most common) or OpenVPN files. Install the official client for your platform once. These are the same clients VPN companies tell you to install — open source, audited, free.

If an operator only sells OpenVPN access, install the official OpenVPN client instead — same idea.

3. Pick an operator

Open the directory (or the map) and filter on what matters: protocol, region, payment method, price per day or per gigabyte. Sort by newest, cheapest, or most recommended.

Weighting recommendations. The directory shows you who's vouched for which operator. If you're on the open Nostr network, paste in your handle (read-only) or sign in — the directory will then weight recommendations and complaints from accounts you already follow, not random strangers. If you're not on Nostr, the “most recommended” sort still works as a general signal, just without the personalization.

Bound your risk on new operators. A new operator with no track record isn't automatically bad — everyone was new once. But start small: buy the smallest time bundle (often one hour, a few cents) and only scale up after they actually deliver.

4. Pay and connect

One thing happens before payment, regardless of method: your WireGuard client needs a local keypair (a public key the operator will add to their server, plus a private key that never leaves your device). In the WireGuard client choose “Add empty tunnel” — it generates the keypair for you. Copy out the public key; you'll hand it to the operator at checkout.

The exact checkout depends on which payment method the operator accepts:

Pay with Lightning

  1. The operator's listing carries a Lightning checkout endpoint.
  2. Your wallet asks the operator's endpoint for an invoice, sending along your WireGuard public key and the bundle you're buying.
  3. The operator hands back a Lightning invoice plus an encrypted attachment — the WireGuard config, locked to the payment.
  4. Your wallet pays the invoice. Paying the invoice unlocks the attachment automatically — modern Lightning wallets (Phoenix, Zeus, Mutiny, Alby) show the decrypted config as the payment's success message.

The cryptography here is standardized (LNURL-pay “AES success-action”): only someone who actually paid the invoice can decrypt the config, so the operator can publish the encrypted bundle without giving access away.

Pay with ecash

  1. Top up (or swap) ecash into the operator's accepted issuer.
  2. Generate an ecash token addressed to the operator (your wallet does this).
  3. POST the token to the operator's checkout URL, along with a small signed message proving who's buying.
  4. The operator validates the token at the issuer and replies with the WireGuard config.

The ecash path is privacy-preserving but more hands-on today — most wallets don't have a one-click button for this yet, so expect a technical step or two. If you want the smoothest path, pay with Lightning.

Save the returned config to disk (europa-vpn.conf or similar). Open it in a text editor: in the [Interface] section the operator left PrivateKey = <PASTE …> for you to fill — paste in your private key from the empty tunnel you made earlier. In the WireGuard client, choose “Import tunnel from file” (or paste the file contents), activate the tunnel. You're on.

5. When the bundle ends

Operators enforce time and data limits on their end. When your hour, day, or gigabyte runs out, the tunnel goes quiet. To continue: buy another bundle from the same operator (some let you just send another payment; others want a fresh config) or pick a different operator from the directory.

There's no auto-renewal — that's the point. If you want set-it-and-forget-it, buy a longer bundle (week or month) up front instead of stacking hours.

Privacy in plain English

A VPN like this hides your traffic from your local network and from anyone between you and the operator — your ISP, your hotel, your coffee shop. The operator itself can still see your destination IP and the hostname you're visiting, exactly like any single-hop VPN. If your threat model needs more, you can run Tor over the VPN, or chain a second VPN.

Paying with ecash gives the operator no payment-side link to your identity. Lightning leaks less than a credit card but more than ecash. Pick accordingly.

We don't see your traffic. We're a directory — once you click “pay,” you're talking to the operator's server, not ours. (See Privacy for the full breakdown of what we touch and what we don't.)

When something goes wrong

  • Operator vanishes after payment. We can't refund you — we don't hold the money. File a report against the operator (the button is on every operator's page) so other users see your warning, and pick a different operator next time.
  • Config imports but tunnel won't come up. Check the [Interface] PrivateKey line — that needs to be your private key, not the operator's. Then check the endpoint host and port; on very restrictive networks, UDP traffic gets blocked and WireGuard can't connect.
  • WireGuard says “Active” but no sites load. The official WireGuard apps (macOS, iOS, Android, Windows) show Active the moment the tunnel daemon starts, even when the other end is dropping your handshakes. The real signal that traffic is flowing is the Latest handshake timestamp updating and the Data received counter ticking up. If those are frozen with only Data sent climbing slowly, your purchase has expired and the operator's server removed your peer at the agreed end time. Buy another bundle to continue.
  • No operators in your region. The map shows what's live now. The marketplace is young; new operators come online as the network grows. Or set one up yourself — see Run a node.
Browse the directory Why a marketplace