FAQs

PuriFi™ is a small device that plugs into your router and protects every device on your network — phones, laptops, smart TVs, speakers, cameras, and everything else connected to your internet. It blocks ads, trackers, threats, and prevents your devices from sending your personal data to outside companies.

Browser ad blockers only work inside your browser — your smart TV, game console, speakers, and IoT devices stay unprotected. Pi-hole is great software, but it requires Linux setup, ongoing maintenance, and gives you zero protection when you leave home. Cloud DNS services like NextDNS or AdGuard DNS route every query through their servers — they see everything, and you pay them monthly forever. PuriFi™ is the turnkey version: hardware you own, filtering stays in your home, mobile apps for iOS and Android, and Private VPN routes through your own device — not ours. One setup covers every device on your network, home and away, no subscription for core protection.

No. Ad blocking, threat protection, content controls, protection presets, and household sharing all work out of the box with no subscription — forever. The only paid feature is Private VPN ($4.99/month or $49.99/year), which lets you stay protected when you leave home. Founding Backers get Private VPN free for life.

No. PuriFi™ runs PuriFi DNS — our own filtering engine, built in-house from scratch. It shares no code with Pi-hole. Pi-hole is an excellent open-source project and still the best DIY option if you enjoy running your own setup — it just isn’t what’s inside a PuriFi device. Building our own engine is what lets us ship things a stock install doesn’t have: curated blocklists preloaded and self-updating, machine learning that catches new threats before a blocklist names them, a live blocking visualization, Bluetooth pairing from the mobile app, and an always-home VPN.

PuriFi™ doesn’t run Pi-hole — we built our own engine, PuriFi DNS — but the comparison is a fair one, because Pi-hole is the DIY answer to the same problem. Going that route means sourcing the right hardware yourself (Raspberry Pi, SD card, power supply, case, network cable), flashing Linux, configuring DNS, setting up blocklists, maintaining updates, and accepting that you’re unprotected the moment you leave the house. PuriFi is the plug-and-play version: dedicated hardware that arrives ready in one box, curated blocklists preloaded out of the box, pairing over Bluetooth through our mobile app, and native iOS/Android apps so you manage protection from your phone instead of SSH. PuriFi DNS also adds capabilities a stock Pi-hole install doesn’t have — an always-home VPN that keeps you protected when you travel (your device is your endpoint, not a third party), machine learning that catches new threats static blocklists miss, and a live blocking visualization so you can actually watch threats getting caught in real time. If you love tinkering with Pi-hole on a spare Raspberry Pi, keep doing that. PuriFi is for everyone else.

In most ways, yes — the device is hardened well beyond a bare Linux box, it updates itself, and you don’t have to remember to patch it. But we’ll be straight with you about the trade: because PuriFi™ is cloud-managed, our orchestration layer is attack surface that a box sitting entirely on your own network wouldn’t have. We think the exchange is worth it — automatic updates and remote repair prevent far more real-world problems than they create — but if you have the skills and the time to run and maintain your own, that’s a legitimate choice and we’re not going to pretend otherwise.

We don’t plan on going anywhere. PuriFi™ was built and bootstrapped by its founder, carries no debt, and runs on a very efficient model — we don’t need to become a $50 million business to survive, which is the trap that caught some of the hardware companies people remember. But it’s a fair question, so here’s the commitment: we will not leave customers with bricked devices. If we ever had to wind down, a final update would let every device keep running on its own. You’d keep local filtering and protection. You’d lose the conveniences that depend on us — remote diagnostics, and the relay that helps your VPN connect, which would fall back to direct peer-to-peer only.

It’s PuriFi™ — “pure” + “Fi” as in Wi-Fi, pronounced “pure-eye-fye.” People find us searching for puri fi, purefi, purify, pirifi, and puryfi, and that’s fine: whichever way you spell it, you’re in the right place. PuriFi is the plug-in device that blocks ads, trackers, and threats on every device in your home, with no subscription.

No. Plug it in, open the app, pair via Bluetooth, and you’re done. The entire setup takes under two minutes.

You don’t. PuriFi™ goes inline — one cable from your modem to PuriFi, one from PuriFi to your router — so every request on your network already passes through it. There’s no DNS field to edit, no DHCP setting to change, and nothing to configure on the router at all. That’s the whole reason the setup video is fifteen seconds long.

No — neither. PuriFi™ does not spoof ARP, does not modify your router’s DNS or DHCP configuration, and uses no layer-2 tricks of any kind. It doesn’t need to: it sits physically inline between your modem and your router, so traffic reaches it by wiring rather than by interception. That also means it won’t trip the security alerts that ARP-based tools sometimes set off.

Both, and we can see why it reads oddly. What you don’t have to do is install anything on the devices you’re protecting — no app on the TV, the console, the tablet, or each family member’s phone. Protection happens on the PuriFi™ device itself, so everything on your network is covered the moment it’s plugged in. The companion app is just how you manage your PuriFi: see what’s being blocked, change settings, turn Private VPN on. One app on your phone, not one per device.

Yes. The app is how you manage your device, and the account is what securely links the two — it’s also what lets us help you if something goes wrong, and what carries your settings if you replace a device. Your filtering itself doesn’t depend on it: protection runs on the hardware in your home whether or not you’re signed in.

A black-screen mode is on the way. The backlight stays powered, but the display goes dark, which is enough for most people who don’t want a lit screen in a bedroom or living room. The device keeps running exactly as it does with the screen on.

For almost everyone, it does the opposite. PuriFi™ handles a full gigabit, which is more than most home connections actually deliver. Every ad, tracker, and other piece of junk PuriFi blocks is a request your devices never make, so pages have less to fetch and your bandwidth goes to what you actually opened. PuriFi also caches the lookups it has already made, so the second time anything on your network asks for a domain, the answer comes straight back from your own device in about a millisecond instead of travelling out to a resolver and back. Less to load and fewer round trips — most people find pages come up faster, not slower. Two honest caveats: your ping doesn’t change, and PuriFi can’t raise the ceiling your ISP sells you. If your plan is faster than a gigabit, see the next question.

Inline, yes — the device handles up to 1 Gbps, so if you’re paying for 2 Gbps or faster you’d be leaving speed on the table. The fix is simple: instead of putting PuriFi™ inline, connect it to your network and point your router at it as your DNS server. That takes a few minutes of router configuration, and you keep the filtering, the blocklists, and the stats. Private VPN tops out at 1 Gbps either way, which is far beyond what any remote connection you’re tunnelling from is likely to deliver.

It can, and this is the one genuine trade-off of the inline setup. Because PuriFi™ sits between your modem and your router, your router ends up behind it, which creates a second layer of NAT. Most things never notice. What can notice are services that need to reach into your network from outside: Plex, remote-play devices like PS Portal, port forwarding, and self-hosted game servers such as Minecraft. There are two clean fixes. Put your router into bridge mode, which removes the second NAT layer entirely and is what we’d recommend if you run any of the above. Or connect PuriFi to your LAN and use it as your DNS server instead of inline, which leaves your network topology exactly as it is today.

No. IPTV services work normally through PuriFi™.

Your ping won’t change, and your speed-test number won’t go up — that ceiling is set by your ISP, and no device on your network can raise it. What does improve is how quickly pages actually finish loading, because there’s far less to fetch and because domain lookups your network has already made come back from your own device rather than from a resolver across the internet. It tends to feel faster in everyday use even though the benchmark reads the same.

No. PuriFi™ does not block promoted or sponsored content like YouTube ads or social media ads — that content is served by the platforms themselves. PuriFi blocks ads that are served by third parties and can be blocked on the network level.

No, and no network-level blocker can. YouTube serves its ads from the same domains as the videos themselves, so there’s no separate address to block — blocking it would mean blocking YouTube. The same is true of ads inside most other big platforms. What PuriFi™ does block on a Roku is everything else it’s doing in the background: the tracking, telemetry, and analytics calls your TV makes constantly, which on a typical smart TV is a great deal more traffic than the ads.

They work normally, and no. Because the ads those platforms serve come from their own domains, PuriFi™ leaves them untouched — from the platform’s point of view nothing about your connection looks unusual, so there’s nothing to detect and nothing to act on.

It’s much less likely to. Browser blockers work by rewriting the page — hiding elements and stripping scripts as it loads — which is what causes layouts to collapse or a site to refuse to work until you disable it. PuriFi™ works one level down, at DNS: it simply doesn’t resolve known ad and tracker domains, and never touches the page itself. Sites load as their designers built them, minus the parts that were only ever calling out to advertisers. If something ever does misbehave, you can allow a domain from the app in a couple of taps.

No. Encrypted DNS is the usual way a device or browser quietly sidesteps network-level filtering — it tunnels its lookups inside ordinary-looking HTTPS traffic so a normal DNS server never sees them. PuriFi™ blocks DNS-over-HTTPS and DNS-over-TLS at the network level, so devices on your network can’t use them to route around your protection. This is one of the things a plain DNS server can’t do for you.

You can block specific sites and whole categories today, using protection presets and content controls in the app — social media, adult content, gambling, and more, on or off in a tap. Scheduling — blocking certain sites only during homework hours or overnight, for instance — is not in the first release. It’s the most requested addition we have and it’s in the next phase of work.

When you leave your home, your devices lose PuriFi™’s protection. Private VPN creates a secure, encrypted tunnel from your phone or laptop back to your own PuriFi device, so you get the same ad, tracker, and threat blocking at a coffee shop, airport, or hotel as you do at home. Unlike a commercial VPN, it routes through YOUR device — not a third-party server that sees your traffic. It’s like you’re always sitting in your living room. Using your own wifi.

No — and this is worth understanding before you need it. Private VPN works by tunnelling back to the PuriFi™ device in your house, so if that house has no internet, there’s nothing to tunnel to. Because the VPN stays connected by default, the practical effect is that your phone will act as though it’s on your home wifi during an outage: it won’t have working internet until you turn the VPN off. You’ll get an SMS when your PuriFi loses its connection and again when it comes back, so you’ll know what’s happening even without internet of your own.

Not automatically — you re-enable it yourself once your home connection is back. The SMS alert tells you when that is. Under normal conditions the VPN stays connected on its own and drops out automatically whenever you’re on your home network, so this only comes up during an actual outage.

It’s limited by your home internet’s upload speed, since everything you do on the VPN has to be sent out from your house. Across our current fleet that lands anywhere from about 50 Mbps to 400 Mbps depending on the connection behind it. Even at the lower end there’s plenty of headroom — five devices all pulling at once still leaves each of them with enough for streaming and everything short of very heavy downloads. The device itself tops out at 1 Gbps.

Not today. Private VPN is built specifically around routing back to your own device, which is what lets us promise your traffic isn’t passing through anyone else’s servers. Chaining a third-party provider on top of it is an interesting idea and it’s on our list to look into.