Beyond Tor: I2P vs Freenet (Hyphanet) in 2027

I2P vs Freenet sounds like a fair fight, but one of the names has changed hands. The Freenet that pioneered anonymous publishing is now called Hyphanet, and today's Freenet says it is not an anonymity tool. So I compared Tor, I2P and Hyphanet on what each hides, what each leaks, and what changed in 2026.

Which Freenet is this comparison about?

It is about Hyphanet, the original Freenet, which took its new name in 2023 after the Freenet Project's board gave "Freenet" to Ian Clarke's redesign, Locutus. Hyphanet's developers announced the rename on 26 June 2023, and the new project's FAQ notes that they did not agree with the decision.

The two projects now share a history and little else. Hyphanet is written in Java, dates back to 1999 and ships as "0.7.5 build 1507", released in September. The new Freenet is written in Rust, is built around WebAssembly programs called contracts, and runs apps such as River, a group chat. Its FAQ is blunt: Freenet "does not claim to be an anonymity system and should not be relied on as one".

Its install page adds three warnings. Freenet is alpha software. Each peer reports diagnostic data such as peer activity and your operating system. And the page says: "Do not use alpha builds for anything sensitive yet". So any honest I2P vs Freenet comparison today is really I2P against Hyphanet, and the new Freenet appears below only to show why it is out of the comparison.

How do Tor, I2P and Hyphanet hide you?

Tor relays your traffic through three volunteer servers on its way to the open web, I2P builds one-way tunnels inside its own network, and Hyphanet scatters encrypted pieces of files across its users' disks. Each design hides a different part of what you do.

Tor picks a guard, a middle and an exit relay for each circuit, from a list that nine directory authorities agree on every hour. Exit relays reach ordinary websites, and .onion services let both sides stay hidden. Tor Browser, now at version 16.0.1, adds protection against fingerprinting on top.

I2P uses garlic routing. It bundles several encrypted messages together and sends them through separate inbound and outbound tunnels, so a request and its reply travel different paths. Every I2P router relays for others but never exits to the web, and the map of the network lives in a shared database kept by "floodfill" routers, not by central authorities.

Two routers do the work. The Java router from i2p.net reached 2.14.1 on 4 November and has needed Java 17 since February. A separate C++ router, i2pd, reached 3.0.0 on 20 October. Both now turn on post-quantum key exchange by default where they can. The Java router has done it at its end-to-end layer since 2.11.0; i2pd uses ML-KEM-768 when built against OpenSSL 3.5 or newer. Other software can use I2P too: Bitcoin Core has supported it since version 22.0, through I2P's SAM interface, and qBittorrent since version 4.6.

Hyphanet is a distributed, encrypted data store. Each node gives up bandwidth and a slice of disk to hold encrypted blocks for others, and little-requested blocks are dropped to make room. Freesites (static websites), forums and mail are built on top. Its key setting is who you connect to: strangers on the "opennet", or only friends on the "darknet", which Hyphanet says is very difficult to detect.

I2P vs Freenet at a glance

The table compares the three networks that try to hide you, with the new Freenet for reference. Versions are the latest on 13 November 2026.

Speed follows the design. I2P's own comparison table puts Tor's round trips at 200 to 500 milliseconds, I2P's at one to three seconds and Hyphanet's latency at minutes. Read that as one project's estimate, but the order matches each design.

Why none of them gives true anonymity

Each one leaves a door open, and its designers say so. The doors are an observer who watches both ends of a connection, a public list of who runs a node, and neighbours who see your IP address.

Tor's founding paper says it plainly: "like all practical low-latency systems, Tor does not protect against" a global passive adversary, one who can watch traffic everywhere. An attacker who sees traffic enter and leave can match its timing. I2P's threat model makes the same admission. If an attacker controls both ends of your tunnel, "I2P does not have a full defense to this for low latency communication".

I2P adds a cost of its own. Unless it runs in hidden mode, every router publishes its contact details to the shared database, so anyone can compile a list of I2P users. I2P says it "is not designed with effective defenses against this attack". A 2018 study presented at IMC counted about 32,000 active I2P peers a day. It showed that a censor running just 10 routers could learn, and block, more than 95% of the addresses a stable client knows.

Hyphanet's weak spot is the opennet. Opennet mode shows your IP address to strangers, and the seed nodes you contact first get it too. Hyphanet's developers have said for years that "the only way to defend against serious attacks is to use Freenet in Friend-to-Friend mode".

Two recent fixes show why. Build 1502, in June 2025, closed a flaw that let a directly connected node tell an uploader from a node that was only forwarding. Its release notes warn that someone who recorded traffic before the fix can still run the passive version, though not against a friends-only node with trustworthy friends. Build 1507 then added location noise that was "simply missing" from probe requests.

Even mixnets, which delay and pad traffic to beat global observers, are not a finished answer. A 2026 paper at PoPETs was co-written by researchers at Nym. It found that the Nym mixnet, in its default settings, "offers protection only marginally better than that of Tor" against website fingerprinting.

How police have identified users on Tor and Hyphanet

In the two best-documented cases, investigators didn't break the encryption. German police traced a Tor user who ran an outdated chat app, and US agents ran a modified Freenet node in opennet mode.

In 2024, the German programmes Panorama and STRG_F reported that police had used timing analysis to identify the operator of a child-abuse site on Tor, convicted in 2022. According to The Register, the suspect used an old version of the Ricochet chat app. The carrier Telefónica supplied data on its O2 customers who connected to a known Tor node. The Tor Project blamed a guard discovery attack on that outdated app. Its write-up says the protection "exists in Ricochet-Refresh … since version 3.0.12 released in June of 2022".

In the US, police use Freenet Roundup, a modified node built by University of Massachusetts professor Brian Levine and available only to law enforcement. It joins the opennet like any peer and logs requests that arrive with at least 16 of a possible 18 "hops to live" remaining. It checks them against known child-abuse files, then applies a formula to decide whether the sender asked for the file or only relayed it. Levine testified to a false-positive rate of no more than 2.3%.

On 7 July 2026, the US Court of Appeals for the First Circuit rejected a defendant's challenge to evidence gathered this way. It held that a user who chose low-security opennet mode had no reasonable expectation of privacy. Freenet had warned him that "an attacker with moderate resources may be able to trace" his activity.

Hyphanet's developers dispute the statistics behind such cases. In a post titled "The discredited Levine 2017 approach is still used", they argue that the method misreads how Freenet routes requests. Both sides agree on one point: the opennet is the exposed part.

I didn't find a court case that describes a comparable technique against I2P users. Its documented risks are the ones above, plus the attacks on the network itself in 2026.

What changed in 2026?

Tor, I2P and Hyphanet all shipped security fixes this year. Two events tested them: a botnet flooding I2P in February and a US appeals ruling on Freenet opennet users in July.

• 2 February, Tor: Arti 2.0.0, the Rust rewrite, starts relay and directory-authority work.

• 3 February, I2P: The Kimwolf botnet tries to add 700,000 bots as routers.

• 8 February, Hyphanet: Build 1505 fixes a critical script-injection flaw.

• 9 February, I2P: 2.11.0 needs Java 17 and turns on post-quantum encryption.

• 12 February, Tor: 0.4.9.5 adds Counter Galois Onion encryption.

• 25 April, i2pd: 2.60.0 makes ML-KEM-768 the default with OpenSSL 3.5.

• 7 July, Hyphanet: A US appeals court rejects a challenge to Freenet Roundup.

• 20 July, I2P: 2.13.0 brings post-quantum protection to its main transport.

• 13 September, Hyphanet: Build 1507 fixes probe privacy and is the last for Java 8.

• 28 October, Tor: 0.4.9.15 cuts off Tor 0.4.8 and older; Tor Browser 16.0.

• 4 November, Tor, I2P: Fixes for crashing old Tor clients and failing I2P connections.

The I2P flood was a Sybil attack. Krebs on Security reported that the operators of Kimwolf, a botnet of hijacked TV boxes, picture frames and routers, had disrupted I2P. They said it happened by accident while they added 700,000 bots as nodes. A researcher who tracks the botnet said its operators wanted a backup control network that is hard to take down. I2P ran at about half its normal capacity, and I2P 2.11.0 shipped the first mitigations days later.

Tor's notes are the most detailed. Between March and October, its release announcements list 39 security bugs by tracking number. They run from TROVE-2026-003, a malicious handshake reply that could crash Tor remotely, to TROVE-2026-067, which let clients put "MiddleOnly" relays in the wrong positions of onion-service circuits.

Tor's 28 October release is the one to act on. Its notes say "Tor versions 0.4.8 and earlier will no longer work on the network", because the network is dropping the old TAP keys those versions rely on. Relays must also support Counter Galois Onion encryption now. Release 0.4.9.5 introduced that encryption to improve "resistance to several kinds of tagging attacks". A 4 November emergency release kept older clients from crashing, but 0.4.8 is no longer supported.

The new Freenet shipped 268 releases in 2026 alone, from 0.1.74 on 1 January to 0.2.156 on 9 November. That fits its own description as alpha software that updates itself.

How many people use I2P and Hyphanet?

Nobody can count them precisely: published estimates for I2P range from 15,000 to 55,000 routers, and Hyphanet's are vaguer still.

I2P's comparison table claims about 55,000 active routers. In February, I2P's original founder, Lance James, told Krebs the network had 15,000 to 20,000 devices on any given day. The 2018 IMC study counted about 32,000 daily peers, 14,000 of them behind NAT or firewalls. For Hyphanet, Levine's 2020 paper says only that it "has been consistently used by thousands of users a day for decades". Tor, for comparison, counts its users in millions.

In an I2P vs Freenet decision, size matters because it is the crowd you hide in. I2P's threat model says some attacks "will become much harder" as the network grows.

I also measured each download, using the official release files on 13 November.

Freenet's FAQ describes its core as "small (<10MB)". The 0.2.156 Linux binary I unpacked, without running it, is 67 MB, or 54 MB with its debug symbols stripped.

How to choose between Tor, I2P and Hyphanet

Choose by the job: Tor Browser for the normal web, I2P for services and peer-to-peer apps inside one network, and Hyphanet in friends-only mode for files that must outlive takedowns.

For most readers, the I2P vs Freenet choice is not either-or, because the two do different jobs. I2P's FAQ explains the outproxy row. Its default outproxy is run by StormyCloud, and "the outproxys themselves can see your traffic come and go" except for HTTPS content. If you came from part one of this series, on using Tor without assuming anonymity, the same rule carries over. The network hides where you connect from, not what your accounts give away.

How to set up I2P safely

Install the Java router from i2p.net or the lighter i2pd. Point one dedicated browser profile at the HTTP proxy on 127.0.0.1:4444, and keep every console and proxy on localhost.

The Java router needs Java 17 or newer, or one of the easy installers that bundle Java, and its console opens at 127.0.0.1:7657. I2P's browser guide suggests a separate Firefox profile (type about:profiles in the address bar) with a manual HTTP proxy of 127.0.0.1, port 4444. That keeps I2P browsing apart from your normal sessions.

On i2pd, the same rules go in i2pd.conf. This sets the 256 KB/s bandwidth class, lets half of it carry other people's tunnels, and pins the web console and the proxy to localhost.

bandwidth = O
share = 50

[http]
address = 127.0.0.1
port = 7070

[httpproxy]
address = 127.0.0.1
port = 4444

Check what is actually listening before you trust it. Every line should show 127.0.0.1, never 0.0.0.0 or your network address:

ss -ltn | grep -E ':(4444|4445|7070|7654|7656|7657)\b'

Why the router console must stay on localhost

Whoever reaches the console can change how the router behaves. i2pd's web console has no password by default (http.auth is false), and I2P's FAQ says never to expose port 7654, its client protocol, to an external network. For remote access, turn on http.auth or use an SSH tunnel.

Your router will relay other people's encrypted tunnels; that is how I2P works. The FAQ says it won't store their content, and its traffic never passes to the open internet. It also advises end users not to run an outproxy unless they are "skilled in system and network administration".

How to set up Hyphanet without exposing your IP

Pick High or Maximum network security and connect only to friends you know. Low or Normal joins the opennet, which gives your IP address to seed nodes and strangers.

Hyphanet's own guide is direct about the trade-off. Low or Normal "should 'just work', connecting in a few minutes". High or Maximum needs friends first, and "these must be people you personally know". You swap node references with each friend on the Friends page of the web interface, at 127.0.0.1:8888/friends/.

The hardware needs some planning too. Hyphanet suggests a 1 GHz processor, 1 GB of RAM and a data store of at least 1 GB. Memory use is about 256 MB, plus 400 kB for every 2 GB of store. Install Java 17 or newer now: build 1507 is the last for older Java, and nodes left on it won't receive later updates.

Think about what you will carry before you run a node. Your disk will hold encrypted blocks of other people's files that you can't read. In Levine's 2020 measurements, nearly a third of the requests his team observed on Freenet were for known child-abuse material. And in July's ruling, the court held that an opennet user had no reasonable expectation of privacy in that activity. Friends-only mode limits what strangers learn about you; it doesn't change what passes through your node.

What to expect from these networks in 2027

Expect old versions to stop working: Tor now requires relays to support its new encryption, Hyphanet's next builds need Java 17, and I2P's post-quantum switch is landing release by release.

Tor's Rust rewrite, Arti, has shipped roughly monthly since 2.0 and reached 2.8.0 on 4 November. C Tor has offered post-quantum ML-KEM-768 key agreement since 0.4.8.17, when built with OpenSSL 3.5 or later. I2P has moved further: post-quantum encryption is on by default at its end-to-end layer and available on its main transport. Two new I2P routers, emissary in Rust and go-i2p in Go, are in development. The new Freenet warns that older versions "stop working over time" as its network changes.

None of that changes the basic choice. In 2027, as now, anonymity comes from matching the network to the job and keeping the software current. The habits no network fixes, from account hygiene to device security, are in our guide to online privacy and data protection.