StandVPN is a free, post-quantum-ready VPN built on WireGuard. Every tunnel uses a hybrid ML-KEM-768 + X25519 key exchange (NIST FIPS 203), so traffic captured today stays unreadable when a CRQC ships.
"Harvest now, decrypt later" is real. Adversaries with quantum programmes are storing encrypted traffic to break the day a cryptographically-relevant quantum computer ships. We use the NIST-ratified replacement — already, today, on every tunnel.
NIST FIPS 203. Both secrets are mixed into the WireGuard PSK via HKDF-SHA256. Classical security floor + quantum-resistant ceiling.
WG AllowedIPs=/32 + nftables FORWARD drop wg0→wg0 + sysctl + automated end-to-end test. Other peers cannot route to you, ever.
Every exit runs its own resolver inside the tunnel. OS DNS is firewall-blackholed by the client, so DNS leaks are structurally impossible.
Engages automatically when the tunnel covers 0.0.0.0/0. No bypass. Drop the tunnel, drop the network — packets do not leak.
By default, traffic to RFC1918 ranges (10/8, 172.16/12, 192.168/16) bypasses the tunnel — your printer, NAS, and Roomba still work.
Stage-1 free tier is rate-limited at peer-add time. Honest cap, hard limit, no fair-use clauses. Lifts when a paid tier ships.
We do not replace classical cryptography — we mix it. Each session runs an X25519 exchange, encapsulates a quantum-resistant secret with ML-KEM-768, and feeds both into the WireGuard pre-shared key via HKDF-SHA256.
No anycast magic, no resold-VPS supply chain. Each exit is a privileged LXC on Proxmox baremetal the operator owns, with a dedicated public IP and the WireGuard kernel module on a tuned 6.8 kernel.
100.64.0.0/10 fleet-reserved · /16 per exitNo "premium" countries, no upsell tiers on encryption. The 10 Mbps stage-1 free-tier cap is identical across all four exits, kernel-enforced via Linux tc htb at peer-add time.
No billing surface in stage 1. Sign up with email, verify, install, connect. Paid tiers ship in stage 2 once the audit work and EV code-signing land.
Every claim on this site links back to a file or commit in the open repo. If a number here doesn't match the source, the source wins.
Pre-beta security blocker bundle: TLS pinning, IPAM race fix, allowlist sanitization, atomic Connect state, pipe ACL caller-identity, atomic file writes, LAN-default-on.
Connect → handshake → traffic → disconnect on Paris · Frankfurt · Ashburn-1 · Ashburn-2. Real-IP confirmation via am.i.mullvad.net/json on each.
Migrated off 10.64.0.0/16 after a real bug where LAN-access excluded the tunnel resolver from the tunnel itself. RFC 6598 doesn't collide with consumer LANs.