WireGuard® on Android, without the configuration file.

What WireGuard is

WireGuard is a VPN protocol and the reference software that implements it, published at wireguard.com. It is deliberately small: a few thousand lines where older protocols run to hundreds of thousands, which makes it easier to audit and harder to misconfigure. It is part of the Linux kernel, and its Android implementation is the library NetCloak ships.

Why it suits a phone

A phone changes networks constantly, from wifi to mobile data and back, and sleeps between uses. WireGuard handles both well. A connection completes in a single round trip, so reconnecting after a network change takes a fraction of a second. The tunnel is keyed to the device rather than to a network address, so moving between wifi and cellular does not drop it. And because the protocol does little work per packet, it costs the battery less than the alternatives while it runs.

No config file, no QR code

The official WireGuard app expects you to bring your own server and import a configuration file or scan a QR code that describes it. That is the right design for people who run their own servers, and the wrong one for everyone else. NetCloak includes the server, generates a fresh key pair on the phone for each session, and exchanges the public halves with the server when you tap connect. You never see a configuration, because there is nothing for you to get wrong.

The encryption, in one paragraph

WireGuard encrypts every packet with ChaCha20 and authenticates it with Poly1305, a combination chosen for speed on processors without dedicated encryption hardware, which describes most phones. Keys are exchanged with Curve25519 and rotated regularly, so a key captured today cannot decrypt yesterday’s traffic. The network you are on, the hotspot, the cafe, the carrier, sees only encrypted packets addressed to our server in New York.

Where it has limits

WireGuard’s own known limitations page is honest and short, and so is this. The protocol is not post-quantum secure by default; NetCloak does not add a pre-shared key on top, so neither is NetCloak. WireGuard traffic has a recognisable shape on the wire, which means a network that wants to know you are using a VPN can tell; it cannot read what is inside. And a VPN protects the path between your phone and our server, not what you do once your traffic leaves it.

WireGuard versus OpenVPN

OpenVPN is older, larger, and more configurable; it can run over TCP, wear more cipher suites, and hide inside ordinary HTTPS traffic in ways WireGuard cannot. WireGuard is faster, connects quicker, uses less battery, and has far less code to audit. For a phone that roams between networks, those are the properties that matter, which is why NetCloak uses WireGuard and nothing else.

Android 8.0 or later. You must be 18 or older to use NetCloak.