I want a domain that can't be traced back to me — is that even a thing in 2025?

Sorry if this is the wrong section, I read the pinned post and I think it's right but tell me if not.

Background: I've been building a small site for about four months, it's nothing dramatic, but I don't want it connected to my name. Not because of anything illegal — I have a normal job and I'd rather my employer not find it if they went looking, and I'd rather the people who might not like the site not be able to find my address.

I've read that WHOIS privacy is free at most registrars now so I assumed that solved it. Then I read that it doesn't. Then I read about proxy registrants and got confused about what the difference actually is.

So my question is basically: is "a domain nobody can trace to me" a real thing I can buy, or is it a thing people say? Thanks in advance to anyone who answers, I know this is basic.

Traced by whom. That is not a pedantic question, it is the only question, and the answer changes everything below it.

Your employer typing your name into Google: solved by almost anything, including the free privacy toggle. They are not going to file a request with a registrar.

A motivated individual with time and no legal standing: solved by a proxy registrant and by never once making a mistake with the surrounding infrastructure. Difficult but achievable.

A civil litigant with a subpoena: not solved by any registrar on earth. Every one of them will produce what they hold when properly ordered, and Njalla holding it instead of you means Njalla produces it instead of you.

Law enforcement: no.

You have described the first case and possibly the second. Stop reading threads written for the fourth one, because the advice in them is expensive and will not make you safer against the thing you actually named.

That's genuinely the clearest way anyone has put it, thank you. It's the first one and maybe a bit of the second.

Then here's the practical version, and it's cheaper than you're expecting.

WHOIS privacy — the registrar puts its own proxy details in the public record instead of yours. You are still the registrant, they still hold your details, and it takes about four seconds to enable. This defeats casual lookups completely, which is your first case.

Proxy registrant — Njalla's model. Njalla is the legal registrant and you are a user in their system. The public record doesn't just hide you, it genuinely isn't you. Stronger, €15 a year, and there's a real cost: transferring the name out later is awkward by design, because you don't own it in the ordinary sense.

Conventional registrar in a privacy-friendly jurisdiction — 1984 or OrangeWebsite in Iceland. You own the name normally, privacy on the record, and the company is somewhere that doesn't hand things over casually. About €15 a year. This is the middle option and for what you've described it's probably the right one.

Any of the three beats what you have. Start there, and don't buy the €15 option to defend against a threat that the free toggle already handles.

One correction to the middle option, because it's the one people pick and then misunderstand.

You own the name normally means the registry record shows a registrar, and the registrar's file shows you. There is a file. There is always a file. The Icelandic company is not going to email it to a stranger, but it exists and it is one court away.

Njalla's model is different in kind, not degree — there is no file with your name in it, because the contract is between Njalla and the world and between you and Njalla. What you have instead is a company that can lose interest in you, and no legal mechanism to make it give the name back. People trade one risk for another here and mostly don't notice they've done it.

No argument. I'd just say for a hobby site with an employer as the threat, "the company could lose interest" is a bigger practical risk than "there is a file in Iceland".

There's a thread from a couple of months back that does the WHOIS-privacy-versus-proxy question in more depth than this one will. Worth a search before this thread reinvents it.

The thing neither thread will tell you, because nobody likes hearing it: the domain is almost never how people get found. It's the analytics account shared with a site that has your name on it, the same profile photo, the writing style, or a footer copied from an old project. I've deanonymised more people from a reused Google Analytics ID than anyone ever has from a WHOIS record.

True. Also the favicon. People forget favicon is copy from old site and is same file.

IME the checklist that actually matters is boring and none of it is the registrar:

• Separate browser profile, always, no exceptions, from the first order onwards
• Separate email that has never touched anything else
• Never log into the new thing and the old thing from the same session
• No shared analytics, ad, or search-console property
• Check the images for EXIF before uploading
• Don't reuse the theme, the footer text or the favicon

You can do all of that for free and it's worth more than any registrar upgrade. Buy the €15 registrar too if you like, but buy it after the list, not instead of it.

Copying this list into my notes. I have absolutely reused the favicon.

Also worth asking yourself honestly whether you've already told anyone about the site. In practice that's how most of these end, and no registrar covers it.

Coming back nearly two months later because people here were kind about a basic question.

Went with the Iceland option in the end, separate browser profile, new email, and I redid the favicon and the footer. Found two images with location EXIF in them which I would never have checked otherwise.

The employer thing was the real worry and I think it's handled. Nobody has found it, though nobody has looked either, so I appreciate that isn't evidence.