VPN server in Brazil: the São Paulo exit server

Four groups of readers have a reason to choose this exit.

One calculation underlies every latency figure on this page. Light in optical fibre covers about 200 km in a millisecond. A request travels to the exit and the answer travels back, so every 100 km between you and the exit adds at least 1 ms to the round trip.

The results are floors. Real cables follow roads, railways and coastlines, each router on the way adds delay, and a measured figure is always higher.

Rio de Janeiro, Porto Alegre and Brasília are all within 870 km of the exit. The north-east and the Amazon are not: from Recife, Fortaleza or Manaus, the round trip to São Paulo alone has a floor above 20 ms.

Whether that matters depends on the destination. When the site you are opening is hosted in São Paulo, the exit lies on the path your traffic would take anyway, so it adds little. When the destination is abroad, the exit can add a long detour. From Fortaleza, a route to North America or Europe through the São Paulo exit first carries the traffic 2,350 km south.

From the north-east, compare São Paulo with Cedar Knolls in the server list if most of what you use is hosted in North America.

To the south and south-west, São Paulo is far nearer than the exits in North America and Europe. Montevideo is 1,550 km away and Buenos Aires 1,650 km, floors of 15.6 and 16.7 ms; Buenos Aires is 10,050 km from Madrid by comparison. Santiago, on the far side of the Andes, is 2,600 km from São Paulo (25.9 ms).

Peru also falls on the São Paulo side. Lima is 3,450 km from São Paulo and 5,900 km from Cedar Knolls, so the São Paulo floor is lower by more than 20 ms (34.5 against 58.8 ms).

Colombia sits close to the dividing line. Bogotá is 4,000 km from Cedar Knolls and 4,350 km from São Paulo, so on a great circle the New Jersey exit is nearer by about 3 ms (40.2 against 43.3 ms). Cable routes can reverse a margin that small, so read both figures in the server list on your own connection before choosing.

Mexico is not a close call. Mexico City is 3,350 km from Cedar Knolls and 7,450 km from São Paulo, and the floor through São Paulo is more than twice as high (74.3 against 33.4 ms). From Mexico, São Paulo makes sense only when you need a Brazilian address or the services you use are hosted in Brazil.

Every route from São Paulo to North America or Europe is long. Miami is 6,550 km away, Cedar Knolls 7,700 km, Lisbon 7,950 km and Madrid 8,400 km, so the floors run from about 66 to 84 ms.

Whether a distant exit costs anything depends on where the service is. An exit that lies on the path between you and the service adds little, because the traffic had to cover that distance anyway. An exit off the path adds the whole detour.

For a Brazilian living in Lisbon or Madrid, a Brazilian service reached through São Paulo is on the path: the traffic crosses the Atlantic either way. A European site reached through São Paulo is not. The path then crosses the Atlantic twice in each direction, a floor of roughly 160 ms from Lisbon, which is noticeable in anything interactive, such as a call or a remote desktop. Connect to São Paulo for the sessions that need a Brazilian address, and to a nearby server location for the rest.

From São Paulo, the same logic runs the other way. A service hosted near New York is about 7,700 km away whichever exit you choose: through Cedar Knolls the distance is covered inside the tunnel, and through São Paulo it is covered after the traffic leaves it. Madrid, for the same service, adds the detour to Spain on top. Between São Paulo and Cedar Knolls the distance is similar, and the deciding question is which country's address the service should see.

Websites treat an IP address as a location, and a Brazilian one changes what many of them show. Expect pages in Brazilian Portuguese, prices in reais with the R$ sign and a decimal comma, dates written day first, and search results that favour Brazilian sites.

For a visitor who does not read Portuguese, this is the main cost of the Brazilian server location. Many sites offer a language control and remember the choice in a cookie, and a search engine's own settings can fix the language of its results whatever the address.

Downloads change too. Content delivery networks and software mirrors generally answer from a copy close to the address that asks, so an app update fetched through São Paulo tends to come from a cache in South America. That copy is close to a reader in Brazil. For a reader connecting from Europe, the data still makes a journey of about 8,000 km after it leaves the cache.

Your App Store or Google Play country does not change when you connect through São Paulo. It is a setting of the store account, not of the connection.

Airports, long-distance bus stations, shopping centres, hotels and pousadas (guesthouses) commonly offer free Wi-Fi. Many of these networks open with a sign-in page that asks for an email address, a phone number or a social media account before any other traffic is allowed through.

Complete that page before you connect WrapVPN. The network shows it by intercepting an ordinary web request, and once the tunnel is running every request is encrypted before the network sees it, so the network cannot redirect it to the page. Until the sign-in is accepted, the network also holds back the tunnel's own traffic to São Paulo.

When a sign-in expires during a long stay, pages stop loading even though the tunnel is still switched on. Disconnect, complete the page again, and reconnect. On iPhone and iPad with Auto-Connect on, pause instead of disconnecting by pressing and holding the switch, because the Auto-Connect rule stays in place after a manual disconnect and can start the tunnel again on Wi-Fi.

Mobile data depends on the SIM. Roaming traffic on a SIM from home often leaves through the home operator, while a Brazilian SIM's traffic leaves in Brazil; the mobile data page explains what each means for a VPN.

Between your device and São Paulo, traffic travels inside an encrypted tunnel. The Wi-Fi operator or mobile network you are using sees encrypted packets going to one address in São Paulo, with their size and timing, and not the sites they are for.

In São Paulo the tunnel ends, and the exit server sends your traffic on from its own address. It therefore knows the address of every service you reach through it. It cannot read connections protected by HTTPS, which carry most of what browsers and apps send; traffic without that protection could be read there.

Every user of the São Paulo exit shares its IPv4 address, so a website sees the same address for everyone connected through it.

Name lookups travel through the tunnel as well. With Clean Web on, a resolver on the São Paulo exit server answers them and blocks domains on its blocklist. It works on domain names only, and a browser or app that uses its own encrypted DNS bypasses it. With Clean Web off, lookups go through the tunnel to a public resolver. Clean Web is on by default on Android and off on iPhone, iPad and Mac; on Windows, check the switch.

What WrapVPN keeps is set out in the privacy policy. Two records relate to the exit server: