iCloud Private Relay is Apple’s dual-hop proxy for Safari traffic, and in August 2026 researchers Talal Haj Bakry and Tommy Mysk showed it can leak your real IP address the moment a website triggers a passkey sign-in. Apple confirmed it’s investigating and has a fix scheduled for fall 2026. The problem sits inside WebKit, so any site that requests a passkey, or pretends to, can pull the IP that Private Relay is supposed to hide. That’s the latest reason to look at these iCloud Private Relay alternatives, but not the only one. Private Relay still only covers Safari, still needs an iCloud+ subscription, and still has no Android client at all. Below are seven options that cover the whole device, not just the browser tab, with real apps on iOS and Android. Mullvad VPN anchors the list.
Quick comparison
| App | Best for | Free plan | Starting price | Standout |
|---|---|---|---|---|
| Mullvad VPN | Anonymous flat-rate VPN with multi-hop | 14-day money-back | 5 EUR/month | No email at signup, cash payment accepted |
| Proton VPN | Free unlimited-data VPN with audited no-logs | Yes, unlimited data | 2.99 USD/month (2-year) | Secure Core multi-hop on paid plans |
| NextDNS | Fine-grained encrypted DNS on every device | 300k queries/month | 1.99 USD/month | Per-device profiles and detailed logs |
| IVPN | Open-source multi-hop from Gibraltar | 7-day free trial | 6 USD/month | Pro plan adds multi-hop and port forwarding |
| Cloudflare WARP | One-tap encrypted DNS with a real app | Yes, unlimited | Free (WARP+ optional) | MASQUE tunnel, fastest install path |
| Tor Browser | Full three-hop anonymity | Yes | Free | Rotates circuits per site, blocks fingerprinting |
| ControlD | Custom DNS profiles with strong ad blocking | Free resolvers | 2 USD/month | DNS-over-QUIC and per-service routing |
Why people leave iCloud Private Relay
It only protects Safari. Private Relay routes Safari page loads and unencrypted app traffic. Everything else, from your Chrome tabs to third-party mail apps to background sync, bypasses the tunnel entirely. Users on Reddit describe seeing their real IP the moment they open a link in any app that isn’t Safari.
The passkey IP leak. In August 2026, researchers demonstrated that WebAuthn passkey requests are handled outside the browser’s normal traffic path, so any site that offers passkey sign-in can read your real IP even when Private Relay is on. Apple is investigating with a patch planned for fall 2026, but two related WebKit issues in DNS prefetching and WebTransport were flagged in the same report.
It’s tied to iCloud+. Private Relay ships only inside the paid iCloud+ subscription, and there is no Android client. Families running mixed devices lose coverage the second someone picks up a Pixel or an old iPad without iCloud+.
No country choice. Private Relay picks the exit node for you, from a short country list. Users who want a specific exit for a foreign store, a game server, or a bank check don’t get one.
Which app should you pick?
- If you want a full-device VPN that treats you like an anonymous account number, pick Mullvad VPN.
- If price is the top constraint and you still want audited no-logs, pick Proton VPN.
- If you want privacy without the VPN battery hit, pick NextDNS.
- If multi-hop and open-source apps are non-negotiable, pick IVPN.
- If you want the simplest replacement for Private Relay’s “just turn it on” feel, pick Cloudflare WARP.
- If you need real anonymity, not just IP hiding, pick Tor Browser or Onion Browser on iOS.
- If you want the same idea as Private Relay but with per-service filtering, pick ControlD.
1. Mullvad VPN, best for anonymous flat-rate privacy
Mullvad VPN is a Sweden-based VPN with a flat 5 EUR per month price that never changes, no annual discounts, and no tiers. Signup produces a 16-digit account number, no email required, and you can pay in cash by post if you want to keep the account fully detached. The iOS and Android apps are open-source, the WireGuard tunnel is fast, and multi-hop routing is available on both platforms since the September 2024 iOS release.
Where it falls short: no free tier, and Sweden sits inside the 14 Eyes intelligence-sharing group. Mullvad’s no-logs stance and multiple independent audits (2021, 2022, 2024) push back on the jurisdiction concern, but readers who weight it heavily should compare against IVPN’s Gibraltar base.
Pricing:
- Free: 14-day money-back on any subscription
- Paid: 5 EUR per month, flat
- vs iCloud Private Relay: pricier than the entry-level iCloud+ tier by itself, but covers every app and every device, not just Safari
Migrating from Private Relay: disable Private Relay in Settings, iCloud, Private Relay. Install Mullvad, paste your account number, tap Connect. The tunnel now covers all apps, not just Safari, with a real exit IP you can pick by country.
Download: App Store | Google Play
Bottom line: the right pick when anonymous signup and predictable pricing matter more than a free tier.
2. Proton VPN, best for a free VPN with credible no-logs
Proton VPN is the only mainstream VPN with a truly unlimited free tier, no ads and no bandwidth cap, backed by the same Swiss no-logs policy audited across the Proton stack. The paid Plus plan (from 2.99 USD per month on a 2-year commitment, 9.99 USD monthly) unlocks Secure Core multi-hop, which routes traffic through Proton’s hardened Swiss, Icelandic, and Swedish nodes before exit. The iOS and Android apps are open-source and support WireGuard, OpenVPN, and Proton’s Stealth protocol.
Where it falls short: the free tier limits you to a short list of countries, one device at a time, and no P2P or streaming servers. Secure Core, the closest match to Private Relay’s dual-hop model, is paid-only.
Pricing:
- Free: unlimited data, limited country selection, one device
- Paid: 2.99 USD/month (2-year), 3.99 USD/month (1-year), 9.99 USD/month billed monthly. Proton Unlimited bundles VPN with Mail, Drive, Calendar, and Pass at 9.99 USD/month.
- vs iCloud Private Relay: the free tier is a genuine alternative at zero cost, and paid Secure Core beats Private Relay’s fixed dual-hop by letting you choose entry and exit countries.
Migrating from Private Relay: create a Proton account, install Proton VPN on iOS and Android, sign in, tap Quick Connect. Switch on Secure Core in Settings if you’re on the paid plan to get the closest match to Private Relay’s two-hop model.
Download: App Store | Google Play
Bottom line: the right call when you want a free VPN with real audits and an upgrade path to multi-hop.
3. NextDNS, best for encrypted DNS on every device
NextDNS runs configurable DNS profiles in the cloud with encrypted DoH, DoT, and DoQ transports. The web dashboard controls block lists, allowlists, parental filters, log retention, and per-device profiles that you can attach to iOS via a signed configuration profile or the NextDNS iOS app, and to Android through the built-in Private DNS setting or the Android app.
Where it falls short: it’s DNS, not a VPN, so it doesn’t hide your IP from the sites you visit. If Private Relay’s IP-shielding is what you want back, use NextDNS with a VPN, not on its own.
Pricing:
- Free: 300,000 queries per month, all features unlocked
- Paid: 1.99 USD/month or 19.90 USD/year for unlimited queries, business plans per seat
- vs iCloud Private Relay: cheaper than iCloud+ if you only want the DNS and filtering half, and covers every device including Windows and Linux.
Migrating from Private Relay: disable Private Relay. Sign up at nextdns.io, copy your configuration ID, install the NextDNS profile on iOS from the dashboard, and set Android Private DNS to your NextDNS hostname. Traffic keeps flowing but resolution runs encrypted through NextDNS with your rules.
Download: App Store | Google Play
Bottom line: the right pick when you want privacy at the DNS layer without a full VPN tunnel.
4. IVPN, best for open-source multi-hop from Gibraltar
IVPN is a Gibraltar-based VPN that sits outside every Eyes intelligence-sharing group and publishes its iOS, Android, macOS, Linux, and Windows apps as open source on GitHub. The Standard plan starts at 6 USD per month; the Pro plan at 10 USD per month adds multi-hop routing between two servers in different countries and port forwarding. IVPN has published warrant canaries and independent security audits for years.
Where it falls short: it’s the pricier pick in this list, and there is no permanent free tier, only a 7-day free trial without a card on file for new accounts.
Pricing:
- Free: 7-day trial, no card
- Paid: Standard 6 USD/month, Pro 10 USD/month (with multi-hop). Cheapest Pro billing lands at 6.10 USD/month on a 3-year term.
- vs iCloud Private Relay: pricier per month but delivers full-device coverage, chosen exit countries, and jurisdiction outside 14 Eyes.
Migrating from Private Relay: disable Private Relay. Start the IVPN trial, download the app on iOS and Android, sign in with your account ID, and enable Multi-Hop under Settings to match Private Relay’s two-hop routing.
Download: App Store | Google Play
Bottom line: the right call when jurisdiction and open-source apps outweigh the higher monthly cost.
5. Cloudflare WARP, best for a free one-tap replacement
Cloudflare WARP wraps the 1.1.1.1 resolver in an encrypted device-wide tunnel and gives it away for free on iOS and Android. Traffic is encrypted with WireGuard or MASQUE (MASQUE became the default for new consumer profiles in late 2025), the app registers your device with a hardware-backed key on recent iOS builds, and there’s a captive-portal helper for public Wi-Fi.
Where it falls short: it’s a single-hop tunnel to Cloudflare’s edge, not a country-shifting VPN, so it doesn’t give you a foreign exit IP. All traffic still terminates at Cloudflare, which is one big trust anchor if you prefer to spread risk.
Pricing:
- Free: unlimited use, all core privacy features
- Paid: WARP+ is an optional consumer upgrade for faster Argo routing; the pricing page lists monthly and yearly options.
- vs iCloud Private Relay: free instead of paid, works in every app instead of Safari only, and runs on Android as well.
Migrating from Private Relay: disable Private Relay. Install 1.1.1.1: Faster Internet on iOS and Android, tap the toggle, and the WARP tunnel takes over immediately. You can pin WARP to specific Wi-Fi networks in Settings.
Download: App Store | Google Play
Bottom line: the right pick for the simplest, free, always-on alternative that reads like Private Relay but covers the whole phone.
6. Tor Browser, best for real anonymity, not just IP hiding
Tor Browser routes traffic through three volunteer relays with layered encryption, so no single hop can link you to the sites you visit. Each site gets its own circuit, cookies and cache clear between sessions, and browser fingerprinting defenses are turned on by default. On Android, the official app comes from the Tor Project. On iOS, Apple’s WebKit rule blocks a direct port, so the Tor Project points users to Onion Browser instead.
Where it falls short: it’s slower than any VPN, and many sites (especially banks and streaming) block Tor exit nodes outright. It’s the wrong tool for daily browsing and the right tool when you actually need anonymity.
Pricing:
- Free: fully free, open-source, community-run
- Paid: none
- vs iCloud Private Relay: stronger anonymity model (three hops with distinct operators vs Apple’s two hops), at the cost of speed and site compatibility.
Migrating from Private Relay: install Tor Browser on Android or Onion Browser on iOS, open sensitive tabs there. Keep Safari or your default browser for everyday sites; use Tor only when you need real unlinkability.
Download: App Store (Onion Browser) | Google Play (Tor Browser)
Bottom line: the right pick when you need a browser session that even your VPN provider can’t map to a site.
7. ControlD, best for custom DNS with per-service routing
ControlD is a Toronto-based DNS provider that runs encrypted resolvers (DoH, DoT, DoH3, and DoQ) with per-service routing, so you can send Netflix through a US exit while banking stays on your normal DNS. The free resolvers block ads, trackers, and malware; the paid Personal plan (from 2 USD per month) unlocks custom profiles with granular filters, per-device stats, and analytics.
Where it falls short: like NextDNS, it doesn’t hide your IP from the sites themselves, only from your ISP’s DNS logs. Combine with a VPN if you want both.
Pricing:
- Free: free DNS resolvers with ad, tracker, and malware blocking
- Paid: Personal from 2 USD/month, SMB from 2 USD per endpoint per month, 14-day trial with no card
- vs iCloud Private Relay: cheaper than iCloud+ if you only need the DNS half, plus per-service routing that Private Relay doesn’t offer.
Migrating from Private Relay: disable Private Relay. Create a ControlD profile in the dashboard, install the iOS configuration profile or use the Control D app, and set Android Private DNS to your ControlD hostname. Add rules for the services you want routed differently.
Download: App Store | Google Play
Bottom line: the right call for a DNS-first privacy setup where you want to shape per-app routing without a full VPN.
How to choose
Pick Mullvad VPN when you want a full-device VPN that treats you like an anonymous account number and charges the same price every month forever. Pick Proton VPN when the free tier matters or when you want Secure Core multi-hop as an upgrade path. Pick NextDNS when the goal is encrypted DNS with fine-grained filtering, not a tunnel.
Pick IVPN when jurisdiction outside every Eyes group is a hard requirement and you’re happy to pay for open-source apps. Pick Cloudflare WARP when you want the closest one-tap analog to Private Relay’s simplicity, at no cost, across both mobile platforms. Pick Tor Browser or Onion Browser when you need real anonymity, not just IP hiding, and accept the speed and compatibility cost. Pick ControlD when per-service DNS routing is more valuable than a single VPN exit.
Stay on iCloud Private Relay if you use only Safari, live entirely inside Apple’s ecosystem, already pay for iCloud+ for storage, and are comfortable waiting for the fall 2026 WebKit patch that closes the passkey leak. Private Relay is still the frictionless option inside Safari; it just isn’t the whole answer for anyone with mixed devices, non-Safari browsers, or a threat model that goes beyond IP hiding from ad networks.
FAQ
Is iCloud Private Relay a VPN? No. It’s a dual-hop proxy that only covers Safari page loads and unencrypted app traffic. A VPN like Mullvad, Proton, or IVPN encrypts and reroutes every app on the device, and lets you pick the exit country.
Does the 2026 passkey leak affect all iCloud Private Relay users? Yes. Researchers Talal Haj Bakry and Tommy Mysk showed that any site offering passkey sign-in, or one that pretends to, can read your real IP because WebAuthn requests are handled outside the browser’s normal traffic path. Apple confirmed it’s investigating and a patch is scheduled for fall 2026.
What’s the closest free alternative to iCloud Private Relay on Android? Cloudflare WARP through the 1.1.1.1 app is the closest one-tap free replacement, since Private Relay has no Android client at all. Proton VPN’s free tier is the closest match if you want a real VPN with a chosen exit country.
Can I run one of these alongside iCloud Private Relay? On iOS, only one VPN or proxy configuration is active at a time. Turning on a VPN like Mullvad, Proton, or IVPN automatically overrides Private Relay for the duration of the tunnel. A DNS-only tool like NextDNS or ControlD can coexist, since it configures Private DNS rather than a VPN.
Which of these has multi-hop routing like Private Relay’s two hops? Mullvad VPN, Proton VPN Secure Core (paid), IVPN Pro, and Tor Browser all offer multi-hop. Tor is the strongest at three hops with different operators, and the slowest.
Is iCloud Private Relay going away? No. Apple is patching the WebKit bugs behind the passkey leak in fall 2026 and continues to ship Private Relay with iCloud+. The alternatives above address the gaps (Safari-only scope, no Android app, no country choice) rather than a discontinuation.
