How to buy a VPS anonymously (and legally), step by step

To buy a VPS anonymously, choose a host that asks for no identity, sign up with an email address you use nowhere else, pay from a wallet you control, ideally in Monero, and connect through a VPN or Tor. The host still sees an email, a payment and a server, so the result is pseudonymous, not invisible.

Every step below is legal in most countries and works with our anonymous VPS. It is written for lawful privacy: keeping your name out of one more database, protecting a publication, or separating a project from your identity.

What "anonymous" can and cannot mean

No host can make you invisible. Any host sees an account, a payment and the servers you run, and many also log the IP address you sign in from. What you can control is whether any of that points back to you. That is pseudonymity: the account has an identity, just not yours.

How far to go depends on what you protect and from whom. The EFF's Surveillance Self-Defense guide starts with questions such as "What do I want to protect?" and "Who do I want to protect it from?". Keeping your name out of a hosting company's records takes a few minutes. Staying unlinkable from a well-funded adversary takes discipline at every step, and one slip can undo it.

Step 1: Choose a host that lets you buy a VPS anonymously

Start with a host that sells a VPS without verification of any kind: its sign-up asks for nothing that identifies you. Before you pay, check for:

• No name, phone number, postal address or ID document, at sign-up or later.
• Crypto payments, including Monero, through a gateway that never receives your email.
• A privacy policy that says what is stored, including whether sign-in IP addresses are kept.
• A published list of what is not allowed. A host that tolerates abuse attracts raids that take every customer offline.

OffshoreServ was built around this list, so you can buy a VPS without ID: an account is an email address and a password, and our no-KYC VPS page compares what a typical host asks for with what we ask. Our explainer on no-KYC hosting covers why that is legal and what it does not change.

Step 2: Use a separate email address

The email address is the only personal detail on your account, so make it one that says nothing about you: a new address or an alias at a privacy-focused provider, used for this account only. Avoid your name, your usual username and any address you have used elsewhere, which can be searched and linked to you.

We never send email to it, so it never needs to receive anything from us: notices appear in your client area. Write the address down, because it is your username. Choose a password you use nowhere else, then create your account, or sign up directly in the deploy form of the server you want.

Step 3: Pay from a wallet you control

The payment is the strongest link between you and the server, so where the coins come from matters.

Do not pay straight from an exchange. An exchange that verified your identity knows which address it paid and when. In the EU, the DAC8 directive has, since 1 January 2026, required crypto-asset service providers to report their EU-resident users' identities and yearly transaction totals to tax authorities, including transfers to outside wallet addresses.

Choose the coin with the ledger in mind. According to the Monero project, the sender, receiver and amount of every transaction are hidden. Bitcoin works the other way: in the words of bitcoin.org, "All Bitcoin transactions are public, traceable, and permanently stored". Ethereum, USDT and Solana are public ledgers too.

This is why the source of the coins matters more with Bitcoin: an extra hop through your own wallet does not hide where they came from, because the ledger shows every hop. With Monero, withdraw from the exchange to your own wallet, then pay from it. Two more habits help: point your wallet at your own node, or at a remote node through Tor, because a remote node sees your IP address; and top up once for several months, so there are fewer transactions to link. Our Monero VPS page and our guide to paying for a VPS with Monero cover wallets and confirmations.

Step 4: Secure the account

An anonymous account has no identity to fall back on, so the usual recovery routes do not exist:

• Keep your password in a password manager. There is no email-based reset, and we cannot verify you any other way: a lost password cannot be recovered.
• Turn on two-factor authentication with an authenticator app, so every sign-in needs a 6-digit code as well as the password.
• Check the security log now and then. It lists sessions and security events with the browser and the country, never an IP address.

Step 5: Order and connect privately

Order from the server's deploy page: a VPS is paid instantly from your balance and is live about 60 seconds later. Its IP address, username and password appear on its page in the client area; they are not sent by email. The deploy form also takes an SSH public key: paste a new key made for this server only.

Then decide where you connect from. A typical Linux server records each login with the address it came from, so if your home IP address must not appear there, connect through a VPN or Tor:

• Tor as a client. torsocks sends a program's connections through the Tor network: torsocks ssh alice@SERVER_IP.
• SSH as an onion service. Install Tor on the server and publish SSH through it; the Tor Project's onion service guide includes port 22 in its example. You then connect to a .onion address and can close port 22 to the internet.

Keep your current session open until the new route works; if you lock yourself out, the console in the client area gets you back in. Then work through our hardening guide. Use the VPN or Tor for the client area too: we store no IP address, but any website sees it while you browse.

What the host still knows when you buy a VPS anonymously

Here is everything an OffshoreServ account holds, as listed in our privacy policy:

Your name is not on the list, and neither is your server's traffic: we do not log or inspect it. Closing the account from Security, once nothing is running, removes the email and login data; accounting records are kept without the email. What any host can technically see inside a server, and how encryption limits it, is covered in what your VPS provider can see.

Mistakes that undo your privacy

• Reusing an email address or username. One search can connect a name you used elsewhere to this account or this server.
• Paying straight from an exchange. The exchange knows who you are and which address it paid. On a public ledger, one known address leads to the rest.
• Registering the domain in your name. In the EU, under the NIS2 Directive, registries and registrars must collect the registrant's name, email address and phone number, verify them, and answer lawful, substantiated access requests within 72 hours. A domain can undo the anonymity of the server it points to.
• Reusing SSH keys or usernames. A public key is a stable identifier: GitHub lists each user's public SSH keys and says the list "is accessible by anyone". Your SSH client also offers every key in your agent to each server it connects to, unless you set IdentitiesOnly. Use a new key and a new login name for this server.
• Forgetting your own logs. We do not log your server's traffic, but your server keeps its own logs: web server, SSH and application logs record addresses until you configure them otherwise.
• Signing up through a referral link. The account then stores the referrer's code, which links it to whoever shared the link.

Where anonymity ends

Anonymity protects lawful privacy. It does not protect abuse, and it does not place you outside the law:

• The acceptable use policy. Child sexual abuse material (reported to the competent authorities), malware and botnet infrastructure, spam and phishing, attacks from our network and fraud against real people are acted on immediately, whoever the customer is. The rest is in our acceptable use policy.
• Local law. What you host must be legal where the server runs, and your own country's laws still apply to you.
• Court orders. A valid order from a court competent where the server runs can require us to act and to hand over what we hold, as listed above. We tell you in the client area unless the law forbids it. In our EU locations, Digital Services Act notices apply too. Our law-enforcement guidelines describe the process.

Frequently asked questions

Can I buy a VPS anonymously?

Yes, in the sense that matters: you can rent a VPS without giving your name. At OffshoreServ an account is an email address and a password, and you pay in crypto. The host still sees the email, the payment and the server, so use a separate address, pay from your own wallet in Monero and connect through a VPN or Tor.

Is an anonymous VPS legal?

Yes, in most countries. Renting a server without giving your name is legal, and so is paying in cryptocurrency, although some countries restrict crypto payments. What you run must be legal where the server is and follow the host's acceptable use policy, and your own country's laws still apply to you. Check the rules where you live.

Which cryptocurrency is best for anonymous payments?

Monero. It hides the sender, the receiver and the amount of every transaction by default, using stealth addresses, ring signatures and RingCT. Bitcoin, Ethereum, USDT and Solana record every transfer on a public ledger, where one known address can reveal the rest. At OffshoreServ, a Monero payment is credited after 10 confirmations, about 20 to 30 minutes.

Does the host know my IP address?

Not in our records: sessions and the security log keep only the browser and the country, web logs are kept without IP addresses, and form rate limits use a salted hash kept for at most an hour. But any website sees your address while you browse, and your own server records who logs in. If that matters, use a VPN or Tor for both.

Can I use Tor to manage my VPS?

Yes. Tor is welcome on our network, and SSH works over it: run torsocks ssh from your computer, or publish SSH as an onion service on the server and connect to its .onion address. Keep a session open while you set it up, and remember the console in the client area if a change locks you out.