NYKTO
Cheapest VPS providers for Nykto BYOS
Updated: April 23, 2026 · Prices may have changed — verify at each provider before purchase.
Nykto BYOS works on any Ubuntu 22.04 or 24.04 VPS. The best provider depends on what you value: lowest price, best specs-per-dollar, easiest provisioning, or a specific region. This page is our honest shortlist, maintained by us, not sponsored.
Quick recommendation
- Cheapest overall: Oracle Cloud Always Free (if you can get approved). 4 ARM cores, 24 GB RAM, $0/mo forever.
- Best value from a reliable vendor: Hetzner CAX11 (~$4.30/mo). 2 ARM cores, 4 GB RAM, 20 TB traffic.
- Easiest for non-technical users: DigitalOcean 1-Click (soon — see below).
- Best specs for the money: Contabo VPS 10 SSD (~$4.90/mo). 3 cores, 8 GB RAM, 50 GB NVMe, 32 TB traffic.
Detailed comparison
Every plan below runs Ubuntu 24.04 ARM or x86_64. The price column is what you actually pay per month (in USD, converted from the provider's listed currency where needed). "Traffic" is the included bandwidth — VPN use can eat this fast, pay attention.
| Provider | Plan | Specs | Traffic | Price/mo | Default firewall | Notes |
|---|---|---|---|---|---|---|
| Oracle Cloud | Always Free (Ampere A1) | 4 ARM cores, 24 GB | 10 TB | $0 | Allow (security list) | Best deal on the internet if the account approval goes through. Some users are rejected without reason. No credit card charges unless you upgrade. |
| Hetzner Cloud | CAX11 (ARM) | 2 ARM cores, 4 GB | 20 TB | ~$4.30 | Allow (opt-in firewall) | European, very fast provisioning, solid network. Our top pick for reliability + price. |
| Hetzner Cloud | CPX11 (AMD x86) | 2 AMD cores, 2 GB | 20 TB | ~$4.65 | Allow (opt-in firewall) | Same Hetzner quality, x86_64 if you need it. |
| Netcup | VPS 200 G11 | 2 cores, 2 GB, 40 GB SSD | 2 TB | ~$3.60 | Allow | German, occasional setup promo fees. Lower traffic allowance than Hetzner; watch your bandwidth if you share the relay with family. |
| Contabo | VPS 10 SSD | 3 cores, 8 GB, 50 GB NVMe | 32 TB | ~$4.90 | Allow | Absurd specs for the price. Provisioning sometimes takes several hours (not minutes). Solid once it's up. |
| Scaleway | Stardust | shared vCPU, 1 GB, 10 GB | 200 GB | ~$2.00 | Allow | Cheapest in EU, hourly billing (~€0.0025/hr). Very limited specs — fine for a single user, not for family sharing. |
| Linode (Akamai) | Nanode 1 GB | 1 core, 1 GB, 25 GB | 1 TB | $5.00 | Allow | Akamai-backed since the acquisition. Solid network, good global footprint. Reasonable pick if you want a US-based vendor. |
| Vultr | Cloud Compute Regular | 1 core, 1 GB, 25 GB | 1 TB | $6.00 | Allow (opt-in firewall) | Wide region coverage including some Nykto can't reach. High-Frequency variant at same price gives better single-core performance. |
| DigitalOcean | Basic Droplet | 1 core, 1 GB, 25 GB | 1 TB | $6.00 | Allow (opt-in Cloud Firewall) | 1-Click Marketplace integration coming — will let you deploy a pre-configured relay with no paste step. See marketplace. |
| AWS Lightsail | 512 MB | 1 core, 512 MB, 20 GB | 1 TB | $3.50 | Allow (Lightsail default) | Cheap but 0.5 GB RAM is tight — nykto-relay plus WireGuard, Unbound, nginx, wstunnel all at once leaves little headroom. Pick the 1 GB tier (~$5) if you can. |
What to watch out for
Bandwidth caps
VPN traffic counts against your VPS's included transfer. Streaming 4K video through Nykto at ~25 Mbps uses ~11 GB/hour. A 1 TB monthly allowance is ~3 hours/day of 4K for a month before you hit the cap and either get throttled or pay overage. Multi-user households should prefer the 20 TB+ plans (Hetzner, Contabo).
Default-deny firewalls (AWS + GCP)
AWS EC2 and GCP Compute Engine block all inbound traffic by default. If you use these, you must manually open these ports in your Security Group / VPC firewall or the tunnel cannot connect:
TCP 22— SSH (restrict to your IP)TCP 443— Nykto Stealth Mode (source:0.0.0.0/0)UDP 51820— WireGuard (source:0.0.0.0/0)
AWS Lightsail uses a simpler firewall UI that's default-allow — this caveat doesn't apply to Lightsail, only full EC2.
Provider ToS
Some low-cost plans prohibit VPN workloads (often hidden in the fine print). As of this writing, the providers above all permit VPN use, but read the ToS before you install. Nykto's own Terms of Service §3 makes cloud-provider ToS compliance your responsibility.
Region and privacy jurisdiction
Your VPS's location is where your exit IP is. If your goal is to appear in Germany, pick a German VPS region. If your goal is jurisdictional separation from your home country, pick a region with strong privacy law (Iceland, Switzerland, Netherlands). If you just want speed, pick the region closest to you.
Providers we don't recommend (yet)
- AWS EC2 (non-Lightsail): t4g.small is free for 12 months, then $15/mo. Not competitive post-trial for BYOS.
- GCP Compute Engine: e2-small is $13/mo. Better options exist.
- Azure: B1s is $8/mo after 1-year free. Same story as GCP.
- Low-end-talk providers (RackNerd, BuyVM, HostHatch, etc.): $1–3/mo annual specials, but inconsistent reliability, variable network quality, and sometimes poor abuse response. Your VPS IP might end up on blocklists. Consider these only if you can tolerate relay failures.
How to deploy on any of these
One command does it on every provider that supports cloud-init (all of the above). See the cloud-init template, or just paste this into the user-data field when creating the VM:
#cloud-config
packages: [curl, gnupg, ca-certificates]
runcmd:
- NYKTO_TOKEN=<paste-token-from-app> bash -c 'curl -fsSL https://install.vpn.nykto.app/setup | NYKTO_TOKEN="$NYKTO_TOKEN" bash'
power_state: {mode: reboot, timeout: 30, condition: True}The token comes from the Nykto app: open the server picker and tap "Add Your Own Server." The token is valid for 24 hours; regenerate if you don't get to the install within that window.