unbraid is a split tunneling VPN client for Android that lets every app take its own exit. Your banking app can skip the VPN
while a streaming app leaves from the US, a second app from Italy and everything else from the Netherlands, all
at the same time. If you use Tailscale, your home network stays reachable too.
There is also unbraid for Mac, with the same idea and the same
providers. It needs macOS 26 or later.
Highlights
- Give any app its own exit country or server, or let it skip the VPN with Direct. Several exits stay connected at
once.
- Use the VPN accounts you already have. One route can go through Mullvad while another uses NordVPN.
- Reach your home network through Tailscale or Headscale, or send chosen apps out through a Tailscale exit node.
- A low-load server is picked for you when the provider publishes load, or you can pin one server yourself.
- Ad and tracker blocking per route with the provider's own blocking DNS, where it has one.
- Saved profiles, a home-screen widget, a quick-settings tile and a pause that reconnects by itself.
- Stats on the phone: data per provider, connected time and speed tests across several exits at once.
- No ads, no unbraid account and no analytics of our own. Free software under the GPL.
What it works with
You bring the VPN. unbraid has no servers of its own and works with the accounts and servers you already have.
You can sign in with NordVPN (NordLynx, OpenVPN, Double VPN and Onion over VPN), Mullvad, Private Internet Access,
IVPN or ExpressVPN. For Proton VPN (Free included) and Surfshark you add your WireGuard key once, and for
Windscribe and AirVPN you paste one WireGuard config from their website. After that you choose from the servers
your plan includes. You can also import your own WireGuard or OpenVPN config, paste a Shadowsocks
key, or join a Tailscale tailnet (a self-hosted Headscale works as well).
Routes can mix providers. One app can use Mullvad in Sweden while another uses NordVPN in Japan.
Getting started
- Download the APK from the releases page and open it
on your phone to install it. Android may ask you to allow installs from your browser or file manager first.
- Turn off any other VPN app, including your provider's own app, and its "Always-on VPN" setting. Android only
lets one VPN app run at a time.
- Open unbraid, accept the terms and choose your VPN. You can sign in to a provider, import a WireGuard or
OpenVPN file, paste a Shadowsocks key, or use Tailscale on its own.
- On the Routes tab, tap the default route, choose Change location and pick a country. This is where every app
goes unless you say otherwise. If you imported a file, its server is already set. Then tap the power button to
connect and allow the VPN when Android asks. With Tailscale on its own, connect first and then tap Sign in to
Tailscale.
- To send some apps somewhere else, tap +, then Route, and choose another country or server. Open the Apps tab
and tap Show my apps (the list stays on your phone). Then tap an app and pick its route. Pick Direct for apps
that should not use the VPN at all, like a banking app.
Each release lists the APK's SHA-256 checksum and the fingerprint of the signing certificate.
unbraid.app/download explains how to check them before you install.
Good to know
unbraid is a VPN app, not a VPN service. It has no servers, so you need an account with a supported provider
(the free Proton VPN plan works) or a server of your own.
Because Android runs only one VPN app at a time, unbraid takes the place of your provider's app while it is on.
If you connect another VPN app, Android stops unbraid. If you allow its notifications, unbraid tells you it is
off.
Your provider's limits still apply. Providers with a connection limit count each route in use as a connection,
while Mullvad counts unbraid as one device. The default route stays connected while unbraid is on. Other routes
connect as soon as an app is assigned to them, even if that app is idle.
The app needs Android 13 or later on a 64-bit ARM phone. It is not on Google Play yet. To update, download the
new APK from the releases page and install it over the old one; your settings stay.
Questions
How is this different from the split tunneling in my VPN app?
In many VPN apps, split tunneling means you can pick apps that skip the VPN, while every other app leaves from the
same place. unbraid lets you choose an exit for each app, and those exits can come from different providers.
Can I use it without a VPN subscription?
Yes. The free Proton VPN plan works, and so does a server of your own. You can import a WireGuard or OpenVPN file,
paste a Shadowsocks key, or use only Tailscale, for example with an exit node at home.
Can I reach my home network while I use a VPN?
Yes. With Tailscale, or with your router's WireGuard config added as a home tunnel, apps can reach devices at home
and still use their VPN exit for everything else.
Does it have a kill switch?
It works with Android's own "Always-on VPN" and "Block connections without VPN" settings, which you can open from
the app's settings. With blocking on, apps stay offline while unbraid is paused or off. Apps you set to Direct
still use your normal connection while unbraid is connected.
Does it get around my provider's device limit?
No. Providers with a connection limit count each route in use against it. Mullvad counts unbraid as one device.
How it works
Android allows one VPN app at a time, so unbraid runs a single VpnService with one TUN interface and the
sing-box engine behind it.
apps -> TUN -> sing-box -> rules: DNS, home, LAN, the app's route, default
|- one WireGuard or OpenVPN exit per location
|- Tailscale node (home)
'- direct
This is the beginning of the README. Read the rest at the original. Read the full README ↗
