Android setup

1. Install the official WireGuard app from Google Play, or as an APK from wireguard.com.
2. On your account page, choose Add device. Your WireGuard key pair is made on your side, never by us; there are two ways to do it, described below.
3. In WireGuard tap + and import the configuration (Create from QR code, or Import from file or archive for a .conf or the ZIP).
4. Switch the tunnel on. The first handshake takes a few seconds.

Two ways to add a device

In the browser (JavaScript on). The account page generates the key pair inside your browser, sends us only the public key, and shows one download link and one QR code per server with the private key already filled in. Scan a QR code with + → Create from QR code and you are done. The private key exists only on that page: download or scan everything you want before leaving it.

With the WireGuard app (JavaScript off, or if you prefer). In WireGuard choose + → Create from scratch, tap Generate next to the private key, and copy the public key into the account page. Download the ZIP, import a .conf, then edit the imported tunnel and replace PRIVATE_KEY_HERE with the private key the app generated (or simply paste the Interface and Peer values from the .conf into the tunnel you created from scratch).

Checks

• With the tunnel on, open our leak check. Each address it shows should be an ironkeel server's; "No answer" means that family was not checked. It can't see DNS or WebRTC: ipleak.net, a leak-check site we do not run, tests your browser for both, and no DNS server or address it lists should be your internet provider's.
• The app's tunnel page should show a recent Latest handshake and growing transfer counters.
• Android's Always-on VPN and Block connections without VPN (Settings → Network → VPN → gear icon) block most traffic when the tunnel drops. Android still sends some system traffic, such as connectivity checks, time sync and the traffic of tethered devices, outside the tunnel.
• Turn on Block connections without VPN: without it, any app can send outside the tunnel, even while the tunnel is on, by tying its connection to the Wi-Fi or mobile network. With it on, GrapheneOS refused test connections tied to the Wi-Fi in our one test so far; we have not yet tested this with the WireGuard app, an ordinary app, mobile data or other versions of Android.

If the tunnel stops

If pages stop loading, check your paid-until date first: switch the tunnel off, or use another device. With Block connections without VPN on, nothing loads while the tunnel is off, so use another device. When paid time runs out, the tunnel stops without a message: it stays on, but nothing gets through, and Latest handshake grows more than a few minutes old. To add time, redeem a voucher on the account page, then switch the tunnel back on.