WireGuard

WireGuard is a VPN protocol designed by Jason A. Donenfeld, built into Linux and known for its small code and fast connections. This is WireGuard’s own Android app. Its README sums it up: “This is an Android GUI for WireGuard. It opportunistically uses the kernel implementation, and falls back to using the non-root userspace implementation.” The app comes without servers: you need a configuration from a VPN provider that supports WireGuard, your company, or a server you run.

What it does

• Add a tunnel by scanning a QR code, importing a configuration file or a zip of several, or typing it in. Exporting all tunnels to a zip, and viewing a private key, ask for your fingerprint or screen lock first.
• Choose which apps use the tunnel, by excluding some or including only some.
• A Quick Settings tile turns the most recent tunnel on and off.
• Always-on VPN: when you set WireGuard as Android’s always-on VPN, it brings back the tunnels that were running.
• An Android TV version of the interface is included.
• Control from other apps, such as Tasker, is off by default. With Allow remote control apps on, an app you have given the “control WireGuard tunnels” permission can turn tunnels up and down.

The update check

WireGuard offers two ways to get the app, Google Play and the direct download this page hosts, and the direct version keeps itself up to date. From the code of this version:

• When it checks: every time the app starts, which also happens when the tile, the always-on VPN or a remote-control request starts it, then again 15 minutes later and every 45 minutes after that while it runs, until it finds a newer version. Installs from Google Play never check.
• What it sends: a request to download.wireguard.com whose user agent includes the app version, your Android version, and your phone’s manufacturer, model, board and full build fingerprint.
• How it verifies: the list of versions is signed with WireGuard’s release key, and the download must match the SHA-256 in that list. Android also refuses an update that isn’t signed with the same key as the installed app.
• What you see: a message at the bottom of the tunnel list, with a Download & Update button. If you cancel the installation, the app says it “Will retry momentarily” and offers it again.

WireGuard’s developer explained why he wrote it: “I don’t find it wise to rely on F-Droid to do anything at all”. Since then, he has written, “The new direct APK download and the Play Store are the only two supported installation sources. Alternative builds and alternative app stores aren’t supported (unless they’re shipping the direct APK file that the WireGuard project provides).” This page hosts that direct APK file, unchanged.

About this file

• This is WireGuard 1.0.20260315, tagged on 15 March 2026 and still the current version. WireGuard publishes no release notes; the changes since 1.0.20260102 are small: the update check backs off when it fails instead of retrying straight away, the user agent now names the app, and the build tools are updated. The previous releases raised the minimum to Android 7.0.
• The file is byte for byte the one on download.wireguard.com, whose SHA-256 matches WireGuard’s signed list. It is signed with the WireGuard project key (O=WireGuard LLC), whose fingerprint, 84a13fa2…4127, WireGuard’s developer published in April 2023. WireGuard says that key “is held in an HSM”.
• The 16.9 MB file runs on ARM and x86, 32- and 64-bit, and declares 9 permissions: the camera for QR codes, internet, starting at boot, installing its own updates, storage on Android 9 and older, fingerprint or screen-lock checks, and on Android 14 and later showing over other apps, which the Quick Settings tile uses when it can’t start a tunnel otherwise.
• Our scan matched no tracking libraries, and we found no analytics or crash reporting in the code. Apart from your tunnels and the update check, the app goes online only when you tap a link, such as Donate.
• The app is licensed under the Apache License 2.0. The APK also carries WireGuard’s command-line tools, wg (GPL-2.0 or MIT) and wg-quick (GPL-2.0), and the wireguard-go implementation (MIT), all from the same project.
• Known problem: on Android TV, importing a configuration file can fail with “Please install a file management utility to browse files”, which a user reported in January 2026 for versions since 1.0.20260102; the TV import code hasn’t changed in this version.
• The app is translated into Brazilian Portuguese.
• The screenshots are WireGuard’s, from its Google Play listing, and show version 1.0.20200923 from 2020.
• “WireGuard” and the “WireGuard” logo are registered trademarks of Jason A. Donenfeld. wireguard.com

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).