Vaayil Source Download

WireGuard® client for Android

Bring your own tunnel.

Vaayil is a calm, private client for the WireGuard tunnels you already have: a server you run yourself, or a configuration from a provider you trust. It sells no bandwidth, runs no servers and has no accounts.

Download APKView source

Free, every feature · Android 8.0 or newer · Needs a WireGuard configuration to connect

The dashboard: the connect disc reads Active above the session totals
"Connected" only after your server answers
No accountsNothing to sign up for.
No analyticsNo telemetry, no update checks.
No crash reportingNothing leaves when it fails.
No adsAnd no in-app purchases.

How it works

Three steps, then forget about it.

1

Add your tunnel

Import a .conf file, open one from another app, paste it, scan a QR code or type it in.

2

Tap the disc

Android asks for VPN permission the first time. After that, one tap connects and disconnects.

3

See that it's real

Connected shows only once your server completes a handshake, with real session totals and never made-up speeds.

Profiles

Every tunnel, one switch away.

  • Each profile has its own connect switch, and the dashboard's disc connects the one you pick.
  • Share a profile as a QR code, in a window that blocks screenshots, or export a .conf file.
  • If a switch to another profile fails, the tunnel you were on stays up, and Vaayil tells you.
The Profiles tab: each profile with its own connect switch, and Share QR, Export and Edit

Encrypted DNS

DNS that travels inside the tunnel.

  • DNS over HTTPS or DNS over TLS for each profile, with one-tap presets for well-known resolvers.
  • Split DNS sends chosen domains to your current network's resolver, for names on your local network. Only the resolver changes; connections are routed as before.
  • Vaayil warns you when a profile would send DNS lookups outside the tunnel, and when Android's Private DNS sends them elsewhere.
The profile editor's DNS section: Secure DNS and split DNS

Split tunneling

Choose which apps use the tunnel.

  • Exclusive: every app except the ones you pick. Inclusive: only the ones you pick.
  • One set of rules for whichever profile is connected. A change applies as soon as you save it.
  • Allow local network keeps printers and cast devices reachable while you're connected.
The Split Tunnel tab: Exclusive or Inclusive mode and the app list

Automation

Connects when you'd want it to.

  • Wi-Fi guard: connect on any Wi-Fi network that isn't on your trusted list and, if you choose, disconnect on one that is. Open networks never count as trusted.
  • Connect on mobile data, or when the phone starts.
  • Optional: start and stop tunnels from Tasker and other automation apps, protected by a per-install token.
Automation settings: auto-connect on untrusted Wi-Fi, trusted networks, mobile data and connect on boot

Backup and quick controls

Ready for your next phone.

  • Export every profile into one .vylconf file, encrypted with a passphrase you choose.
  • A Quick Settings tile and a home-screen widget turn Vaayil on and off.
  • Long-press the app icon to connect any of up to four profiles.
The Backup tab: export and restore an encrypted snapshot

Kill switch, explained

Android's kill switch, and its limits.

What it blocks

With Always-on VPN and Block connections without VPN turned on, Android blocks apps' connections whenever the tunnel is down. Vaayil walks you through turning both on.

What it doesn't

Android doesn't block DNS lookups. While the tunnel is down, and for apps you exclude, the network you're on can still see the names apps look up. Android also lets any app send small keep-alive packets outside the VPN, even while Vaayil is connected, and the server they go to sees your real IP address. Install only apps you trust.

Privacy

Private by design.

Only the connections you set upYour WireGuard server and the DNS servers you configure, plus your current network's resolver for hostname lookups and split-DNS domains.
Keys encrypted at restPrivate keys are encrypted with a key held in the Android Keystore, when the device's Keystore is available.
No silent copiesAndroid cloud backup and device-to-device transfer are off. You move to a new phone with a backup you export yourself.
Wi-Fi names stay on the deviceThe Wi-Fi guard reads the network's name and security type, keeps no history and sends neither anywhere.
What each permission is for
VPNRunning your tunnel. Android asks before the first connection.
NotificationsThe tunnel's status and its Disconnect button. Asked once on Android 13 and newer.
CameraScanning a profile's QR code, asked when you first scan. Frames are decoded on the device and never stored.
Location, all the timeOnly for Auto-connect on untrusted Wi-Fi and Disconnect on trusted networks, even when the app is closed: Android counts a Wi-Fi network's name as location data. Asked when you turn on Auto-connect on untrusted Wi-Fi. No GPS coordinates.
Network and Wi-Fi stateFollowing network changes, and checking whether the current Wi-Fi network is secured.
Run at startupConnect on boot, and restarting the Wi-Fi guard after a reboot, when you've turned them on.
Foreground serviceKeeping the tunnel and the Wi-Fi guard running while you use other apps.
InternetReaching your WireGuard server and your DNS servers.

Read the privacy policy →

Open source

Read every line of it.

Vaayil is free software under GPL-3.0-or-later. The WireGuard tunnel is built from source, and the F-Droid build is set up to be reproducible.

How Vaayil is built. AI coding agents write and review the code under the maintainer's direction. The maintainer decides what gets built, sets the design and the rules, reviews the results and tests releases on real devices.

View source on GitHubReport an issue

Install

Install Vaayil.

Android 8.0 or newer, and a WireGuard configuration to connect to.

GitHub ReleasesThe signed APK, attached to every release.Download APK
ObtainiumAdd https://github.com/ATGPlatforms/vaayil and it installs each new release.
F-DroidComing in early 2027.Planned
Google PlayComing soon.Planned
Check the APK before you install it 
apksigner verify --print-certs vaayil-1.1.0-2.apk
The certificate SHA-256 digest must read

6db86593371589a71a026eacab61770bb1e902552fcdfb3ebfd5f9d0ef141558

FAQ

Questions people ask.

Does Vaayil come with a VPN server?
No. Vaayil is a client: it connects to a WireGuard server you run, or to one from a provider you trust. It sells no bandwidth and runs no servers.
Is it really free?
Yes: every feature, with no trial limit, no in-app purchases and no ads. Vaayil is free software under GPL-3.0-or-later.
What does Vaayil collect?
Vaayil has no accounts, no analytics and no crash reporting. It talks only to your WireGuard server and the DNS servers you configure, plus your current network's resolver for hostname lookups. The privacy policy has the details.
Why does it ask for location?
Vaayil accesses location data to enable Auto-connect on untrusted Wi-Fi and Disconnect on trusted networks, even when the app is closed or not in use. Android counts the name of the Wi-Fi network you're on as location data, so Vaayil asks for location access, set to "Allow all the time" on Android 10 and newer, when you turn on Auto-connect on untrusted Wi-Fi. Vaayil checks that name against your trusted list on the device. On Android 11 and older, it also reads the list of nearby Wi-Fi networks, to find the connected network's security type. It never stores your location data or transmits it anywhere, keeps no history of networks and reads no GPS coordinates.
How do I move to a new phone?
Export an encrypted backup on the Backup tab, copy the file across and restore it on the new phone. Android's cloud backup is off for Vaayil, so nothing moves without you.