unbraid is a split tunneling VPN client for Android that lets every app take its own exit. Your banking app can skip the VPN while a streaming app leaves from the US, a second app from Italy and everything else from the Netherlands, all at the same time. If you use Tailscale, your home network stays reachable too.

Download the APK  ·  unbraid for Mac  ·  Website  ·  Privacy policy  ·  Report a bug

Each app gets its own exit	See every app's route at a glance	Mix providers and countries	Usage, speed and connected time

There is also unbraid for Mac, with the same idea and the same providers. It needs macOS 26 or later.

Highlights

• Give any app its own exit country or server, or let it skip the VPN with Direct. Several exits stay connected at once.
• Use the VPN accounts you already have. One route can go through Mullvad while another uses NordVPN.
• Reach your home network through Tailscale or Headscale, or send chosen apps out through a Tailscale exit node.
• A low-load server is picked for you when the provider publishes load, or you can pin one server yourself.
• Ad and tracker blocking per route with the provider's own blocking DNS, where it has one.
• Saved profiles, a home-screen widget, a quick-settings tile and a pause that reconnects by itself.
• Stats on the phone: data per provider, connected time and speed tests across several exits at once.
• No ads, no unbraid account and no analytics of our own. Free software under the GPL.

What it works with

You bring the VPN. unbraid has no servers of its own and works with the accounts and servers you already have.

You can sign in with NordVPN (NordLynx, OpenVPN, Double VPN and Onion over VPN), Mullvad, Private Internet Access, IVPN or ExpressVPN. For Proton VPN (Free included) and Surfshark you add your WireGuard key once, and for Windscribe and AirVPN you paste one WireGuard config from their website. After that you choose from the servers your plan includes. You can also import your own WireGuard or OpenVPN config, paste a Shadowsocks key, or join a Tailscale tailnet (a self-hosted Headscale works as well).

Routes can mix providers. One app can use Mullvad in Sweden while another uses NordVPN in Japan.

Getting started

1. Download the APK from the releases page and open it on your phone to install it. Android may ask you to allow installs from your browser or file manager first.
2. Turn off any other VPN app, including your provider's own app, and its "Always-on VPN" setting. Android only lets one VPN app run at a time.
3. Open unbraid, accept the terms and choose your VPN. You can sign in to a provider, import a WireGuard or OpenVPN file, paste a Shadowsocks key, or use Tailscale on its own.
4. On the Routes tab, tap the default route, choose Change location and pick a country. This is where every app goes unless you say otherwise. If you imported a file, its server is already set. Then tap the power button to connect and allow the VPN when Android asks. With Tailscale on its own, connect first and then tap Sign in to Tailscale.
5. To send some apps somewhere else, tap +, then Route, and choose another country or server. Open the Apps tab and tap Show my apps (the list stays on your phone). Then tap an app and pick its route. Pick Direct for apps that should not use the VPN at all, like a banking app.

Each release lists the APK's SHA-256 checksum and the fingerprint of the signing certificate. unbraid.app/download explains how to check them before you install.

Good to know

unbraid is a VPN app, not a VPN service. It has no servers, so you need an account with a supported provider (the free Proton VPN plan works) or a server of your own.

Because Android runs only one VPN app at a time, unbraid takes the place of your provider's app while it is on. If you connect another VPN app, Android stops unbraid. If you allow its notifications, unbraid tells you it is off.

Your provider's limits still apply. Providers with a connection limit count each route in use as a connection, while Mullvad counts unbraid as one device. The default route stays connected while unbraid is on. Other routes connect as soon as an app is assigned to them, even if that app is idle.

The app needs Android 13 or later on a 64-bit ARM phone. It is not on Google Play yet. To update, download the new APK from the releases page and install it over the old one; your settings stay.

Questions

How is this different from the split tunneling in my VPN app?

In many VPN apps, split tunneling means you can pick apps that skip the VPN, while every other app leaves from the same place. unbraid lets you choose an exit for each app, and those exits can come from different providers.

Can I use it without a VPN subscription?

Yes. The free Proton VPN plan works, and so does a server of your own. You can import a WireGuard or OpenVPN file, paste a Shadowsocks key, or use only Tailscale, for example with an exit node at home.

Can I reach my home network while I use a VPN?

Yes. With Tailscale, or with your router's WireGuard config added as a home tunnel, apps can reach devices at home and still use their VPN exit for everything else.

Does it have a kill switch?

It works with Android's own "Always-on VPN" and "Block connections without VPN" settings, which you can open from the app's settings. With blocking on, apps stay offline while unbraid is paused or off. Apps you set to Direct still use your normal connection while unbraid is connected.

Does it get around my provider's device limit?

No. Providers with a connection limit count each route in use against it. Mullvad counts unbraid as one device.

How it works

Android allows one VPN app at a time, so unbraid runs a single VpnService with one TUN interface and the sing-box engine behind it.

apps -> TUN -> sing-box -> rules: DNS, home, LAN, the app's route, default
                           |- one WireGuard or OpenVPN exit per location
                           |- Tailscale node (home)
                           '- direct

Each TCP and UDP connection is routed by the app that owns it, which Android reports through ConnectivityManager.getConnectionOwnerUid. When an app hands a connection to another app or system service, such as for a download, a browser tab or a push message, that connection follows the other app or service's route. Ping has no owning app, so it follows the default route (when Direct is the default and other apps use VPN routes, internet ping is blocked instead). DNS is answered with fake addresses and looked up again on the exit the app really uses, so a site sees the country you picked for that app. Apps you set to Direct are left out of the VPN by Android itself; apps that only follow a Direct default route still go through unbraid. If you turn on "Block connections without VPN", they are sent out directly from inside the app instead. Only the default route and the routes your apps use are connected.

For NordVPN, unbraid picks a server from the provider's low-load recommendations when it connects, unless you pinned one. Server lists come from each provider's public API where there is one, and otherwise from gluetun-servers.

Build

You need JDK 17 or newer, Android SDK 37, NDK 28 and Go 1.26 (Go fetches the exact toolchain itself through GOTOOLCHAIN).

tools/build-libbox.sh                 # builds app/libs/libbox.aar from sing-box v1.14.4 with the patches in tools/
./gradlew :app:assembleFossRelease    # the APK published here and meant for F-Droid, without Google Play Billing
./gradlew :app:bundlePlayRelease      # the Google Play bundle, which adds an optional tip jar through Play Billing
./gradlew :app:testFossDebugUnitTest

The build script keeps its work files in ~/.cache/unbraid-libbox. Set WORK to use another folder. The patches in tools/ stop libbox from writing the running configuration, which holds private keys, to disk, seal the Tailscale node state with an Android Keystore key, refuse files sent through Taildrop, give an OpenVPN tunnel a resolver inside it when its server pushes none, and let the app's connection checks look up their servers through the tunnel being checked. A release build is signed only if .secrets/signing.properties exists, so a plain checkout builds an unsigned APK.

Privacy

We add no advertising or analytics of our own. The Play version includes Google's Billing library for optional tips. You don't need an unbraid account. Your provider credentials are encrypted with an Android Keystore key and are only sent to the service they belong to. The list of installed apps is read on the phone so you can assign routes, and it never leaves the phone. App data is excluded from backups. The privacy policy, with every service the app talks to, is at unbraid.app/privacy.

To report a security problem, see SECURITY.md.

Support the project

unbraid is free and has no paid features. If it is useful to you, see unbraid.app/donate for ways to support it. A donation doesn't unlock anything.

Bug reports are welcome in the issue tracker. The project doesn't take pull requests. CONTRIBUTING.md explains why and how else you can help.

Licence

unbraid is free software under the GNU General Public License, version 3 or (at your option) any later version. See LICENSE. sing-box, which unbraid is built on, is under the GPL as well.

unbraid includes or downloads work by other people under their own licences. THIRD-PARTY.md lists them, and the full texts ship inside the app (app/src/main/assets/notices.txt, generated by tools/notices.sh from the Go modules that are actually linked).

unbraid is an independent project and isn't affiliated with or endorsed by the VPN providers named here, Tailscale or SagerNet. Product names belong to their owners.

About this repository

unbraid is published by Quiet Crafts. Parts of the code and of the text in this repository were written with the help of AI tools. The developer reviews and tests every change before it is released.