Features
With a status on every card, so you know what you are getting before you install.
The app creates a virtual network adapter and routes your traffic through it. Each packet is encrypted with ChaCha20-Poly1305 under keys agreed in a one-round-trip Noise IK handshake, so a new tunnel is up in a single exchange. Keys are replaced every two minutes without dropping the connection.
When you connect, the app presents a signed credential. It contains a validity window, a tier, and a signature. There is no account number, no email, no name — not hidden, absent. The server verifies it on its own and never asks who is connecting, because there is nothing to ask with.
Any packet a client sends towards another address inside the tunnel network is dropped before it reaches the operating system, then dropped again by a firewall rule in case the first barrier is ever wrong. Source addresses are checked against the lease, so a client cannot pretend to be another.
The servers that carry traffic hold everything they need to keep a session going. If sign-in is down, existing tunnels carry on. Closing the window leaves the tunnel up — quitting says so — and the background service owns the connection, not the interface.
Every handshake message carries a MAC that only a client who knows the gateway’s public key can compute — checking it costs about five hundred times less than the key exchange it protects. Under load the gateway hands out short-lived cookies bound to your address and requires them on the next attempt. Nothing it sends back is larger than what it received, so it cannot be used to amplify an attack on someone else.
Time-based one-time codes from any authenticator app. Enrolment is two steps, so a secret that has never been proved never protects the account. Ten single-use recovery codes are issued once, and disabling the factor requires a code.
Press Sign in and the app opens the account site in your browser, where you sign in as usual — second factor included. You approve the connection there, with the app’s name and platform shown, and the app receives its own session over a one-time code. No password field in the app means no password for it to mishandle, and a sign-in page in a real browser is one your password manager already knows.
Each app you sign in gets its own session, ended from that app or when you change your password. We do not limit how many.
The card form is served by the payment processor and the browser confirms the payment with them directly. We hold the last four digits and the expiry for display, and nothing else.
Paying with cryptocurrency is planned but not built.
Shipped, with a limit worth knowing before you rely on it.
The default is everything. Turn "Route all traffic" off and only traffic addressed to the tunnel network goes through it; the rest uses your normal connection. Changing it reconnects, so the routing table is never half-applied.
Split tunnelling is by destination, not by app. Choosing which applications use the tunnel is not built.
A VPN that silently leaks is worse than one that visibly disconnects. Under a full tunnel, when the gateway does not offer IPv6, outbound IPv6 is blocked system-wide for as long as the tunnel is up. IPv6-only sites will not load; they also will not see you.
Today gateways block IPv6 rather than carry it. There is no general kill switch yet: if the tunnel drops, routing is restored and traffic resumes unprotected.
Gateways do not yet run a resolver. Until they do, your device keeps its own DNS settings, and those queries take their usual route.
Not built. This is the largest open item on the privacy side, and it is listed here so nobody has to discover it.
The desktop apps share a core that cannot run inside a phone’s VPN extension. The mobile apps are planned; they are not started.
On the things other VPNs list that are missing here