iPhone and iPad setup

1. Install the official WireGuard app from the App Store.
2. On your account page, choose Add device. Your WireGuard key pair is made on your side, never by us; there are two ways to do it, described below.
3. In WireGuard choose Add a tunnel and import the configuration (Create from QR code, or Create from file or archive for a .conf saved to the Files app).
4. Allow the VPN configuration when iOS asks, then switch the tunnel on.

Two ways to add a device

In the browser (JavaScript on). The account page generates the key pair inside Safari, sends us only the public key, and shows one download link and one QR code per server with the private key already filled in. On an iPhone the easiest path is to open the account page on another screen and scan the QR code with Add a tunnel → Create from QR code; on the same device, download the .conf to Files and share it to WireGuard. The private key exists only on that page: download or scan everything you want before leaving it.

With the WireGuard app (JavaScript off, or if you prefer). In WireGuard choose Add a tunnel → Create from scratch, tap Generate keypair, and copy the public key into the account page. Download the ZIP, then either edit the tunnel you created and enter the Interface and Peer values from a .conf, or import the .conf and replace PRIVATE_KEY_HERE with the private key the app generated.

Checks

• With the tunnel on, open our leak check. Each address it shows should be an ironkeel server's; "No answer" means that family was not checked. It can't see DNS or WebRTC: ipleak.net, a leak-check site we do not run, tests your browser for both, and no DNS server or address it lists should be your internet provider's.
• In WireGuard, the tunnel page should show a recent Latest handshake.
• Enable On-demand in the tunnel's settings if you want it to connect automatically on Wi-Fi and mobile data.

Limits

• iOS has no full kill switch. On-demand reconnects the tunnel automatically, but nothing is blocked while the tunnel is down, and Apple services may bypass the tunnel.
• Avoid untrusted Wi-Fi for sensitive traffic: a network you do not trust can send some traffic around the tunnel.
• There is no split tunnelling. While the tunnel is up all your traffic goes through it, and the WireGuard app on iOS cannot leave individual apps out.

If the tunnel stops

If pages stop loading, check your paid-until date first: switch the tunnel off, or use another device. When paid time runs out, the tunnel stops without a message: it stays on, but nothing gets through, and Latest handshake grows more than a few minutes old. To add time, redeem a voucher on the account page, then switch the tunnel back on.