Features
With a status on every card, so you know what you are getting before you install.
The app creates a virtual network adapter and routes your traffic through it. Each packet is encrypted with ChaCha20-Poly1305 under keys agreed in a one-round-trip Noise IK handshake, so a new tunnel is up in a single exchange. Keys are replaced every two minutes without dropping the connection.
When you connect, the app presents a signed credential. It contains a validity window, a tier, and a signature. There is no account number, no email, no name — not hidden, absent. The server verifies it on its own and never asks who is connecting, because there is nothing to ask with.
Any packet a client sends towards another address inside the tunnel network is dropped before it reaches the operating system, then dropped again by a firewall rule in case the first barrier is ever wrong. Source addresses are checked against the lease, so a client cannot pretend to be another.
The servers that carry traffic hold everything they need to keep a session going. If sign-in is down, existing tunnels carry on. Closing the window leaves the tunnel up — quitting says so — and the background service owns the connection, not the interface.
IPv6 is carried through the tunnel and shares the gateway’s address the same way IPv4 does, so a dual-stack device does not fall back to its real address for half its traffic. A gateway checks its own routing before offering IPv6, and one that cannot carry it advertises none — the device then blocks outbound IPv6 system-wide rather than letting it slip around the tunnel. Carried where it works, closed where it does not; never leaked.
A full kill switch — holding all traffic if the tunnel itself drops — is on the roadmap.
Every handshake message carries a MAC that only a client who knows the gateway’s public key can compute — checking it costs about five hundred times less than the key exchange it protects. Under load the gateway hands out short-lived cookies bound to your address and requires them on the next attempt. Nothing it sends back is larger than what it received, so it cannot be used to amplify an attack on someone else.
Time-based one-time codes from any authenticator app. Enrolment is two steps, so a secret that has never been proved never protects the account. Ten single-use recovery codes are issued once, and disabling the factor requires a code.
Press Sign in and the app opens the account site in your browser, where you sign in as usual — second factor included. You approve the connection there, with the app’s name and platform shown, and the app receives its own session over a one-time code. No password field in the app means no password for it to mishandle, and a sign-in page in a real browser is one your password manager already knows.
Each app you sign in gets its own session. End one from that app, or end all of them at once from the portal — changing your password does the same. We do not limit how many.
The card form is served by the payment processor and the browser confirms the payment with them directly. We hold the last four digits and the expiry for display, and nothing else.
Paying with cryptocurrency is planned but not built.
While connected, your device resolves names through a resolver on the gateway, reached only through the tunnel. That resolver does not forward to a big public DNS provider — it resolves from the root, so no single party is handed the whole stream: the root sees a top-level-domain referral, that domain sees a delegation, and each authoritative server sees only names in its own zone. Repeat lookups are answered from cache and leave the node not at all.
Shipped, with a limit worth knowing before you rely on it.
The default is everything. Turn "Route all traffic" off and only traffic addressed to the tunnel network goes through it; the rest uses your normal connection. Changing it reconnects, so the routing table is never half-applied.
Split tunnelling is by destination, not by app. Choosing which applications use the tunnel is not built.
The iOS app is in testing now, with Android to follow. Phones require the tunnel to run inside the operating system’s VPN extension, so it is a separate build with the same core rather than a port of the desktop app.
On the things other VPNs list that are missing here