Support

How do I get a configuration onto my iPhone or Mac?

From your own WireGuard server. Any server you run or control will do — one you set up yourself on a machine you rent, one a WireGuard-compatible tool produced for you, or one the Android OwnTunnel app built in your cloud account. What the app needs is the configuration that server issues for this device: the [Interface] and [Peer] block with your private key, your address, the server’s public key and its endpoint. Paste it as text on either platform, or scan its QR code on iPhone. The iOS and macOS apps create no servers and ask for no cloud account, so this step is yours; the Mac has no QR reader at all, which is why pasting is the only route there. There is also no way back out: neither app exports a configuration or draws a QR code, so moving a server from an Android phone to a Mac means getting the configuration from the server, not from the phone. Adding a second device to a server through the app is an Android feature today and does not exist on iPhone or Mac.

Who pays for the server?

If the Android app built it for you: you do, directly to your cloud provider. On iPhone and Mac the app builds nothing, so it costs nothing beyond whatever you already pay for the server you brought. A Hetzner server of the size the Android wizard creates costs roughly €5.50 a month in Europe and roughly €17.50 a month in the United States — the location you pick decides, and it decides the included traffic too: the European locations come with 22 TB a month, while the American ones include around 1.1 TB and Singapore as little as 0.5 TB, with every further terabyte charged. Prices are the provider’s, quoted before VAT, and can change; the current ones are on Hetzner’s price page. Hetzner currently advertises €20 of credit for new accounts; whether you get it, and how far it goes, is the provider’s call and depends on the location you pick. OwnTunnel itself is free: no subscription, no in-app purchases, no ads, and we take no share of what you pay your provider.

How do I delete my server?

Log in to your cloud provider’s console — for Hetzner that is console.hetzner.cloud — open the project you used, and delete the server there. Servers created by the app carry the label owntunnel, so they are easy to spot. Deleting the OwnTunnel app does not delete your server, and a server keeps billing until you delete it. If setup was interrupted halfway, the Android app asks about the leftover server at the next launch and can delete it for you. The iOS and macOS apps never create or delete anything in a cloud account, so there is nothing for them to clean up — and if an earlier version of them left a cloud token on your device, version 1.2.0 erases it at its first launch.

Can I use one server on more than one device?

Yes, and on Android the app can do it for you. The iPhone and Mac apps have no “add a device” screen, so joining a device to a server is not something they can do; an Apple device set up from such a server’s configuration is simply another peer on it. What follows describes the server built by the Android wizard. A second phone or laptop can join the server you already pay for instead of costing you another one: the joining device generates its own key pair, hands over only the public half, and receives its own address on the tunnel. Its private key never leaves it, exactly like the first device’s. The server accepts these registrations only from inside the tunnel — there is no port for it on the public internet, so the only way to reach it is to be connected already. Two things follow, and they matter before you hand your configuration to anyone: any device holding your configuration can add further devices, because being inside the tunnel is the only proof the server asks for; and an added device cannot be removed — there is no revoke, so taking access back means deleting the server and setting up a new one. Devices sharing a server can also reach one another across the tunnel, the way machines on a home network can. Treat your configuration as a key to the server, not merely a ticket through it.

Where is my configuration stored?

On your device, in encrypted storage, and nowhere else. On iOS and macOS there is one secret: the configuration, including your WireGuard private key. It lives in the Keychain with the AfterFirstUnlockThisDeviceOnly protection class: not synchronised to iCloud Keychain and excluded from device backups, encrypted ones included. A second copy lives in a shared Keychain group so the VPN system extension — a separate process iOS requires to run the tunnel — can read it. Version 1.2.0 stores no cloud API token, because it creates no servers, and it erases at its first launch the token and the server list an earlier version may have left behind. On Android there are two secrets — the configuration and your cloud API token — written as encrypted files in the app’s own private storage using Jetpack Security’s EncryptedFile, with the key that decrypts them generated on the device and held in the Android Keystore; allowBackup="false" and the app’s data-extraction rules keep both files out of cloud backup and out of device-to-device transfer. On either platform, Your data → Forget this configuration erases all of it, plus the VPN profile in system settings, and tells you if any part of that erasure failed.

Why scan a QR code?

Because copying a WireGuard configuration between devices by hand is where things break: a line break lost in the paste, a key truncated. If you already run a server, its configuration can be shown as a QR code (qrencode does it, and most WireGuard servers can produce one), and the scanner reads it in one shot. The camera frames are analysed on the device — by the system’s built-in code detector on iOS, and by ZXing, an open-source decoder compiled into the app, on Android — so nothing is written to disk, saved to your photo library or sent anywhere, and if you decline camera access you can paste the configuration as text instead. There is no scanner on macOS: the system code detector does not work there, so the Mac app never asks for camera access.

Which platforms are supported?

iOS 16 or later and macOS 13 Ventura or later, from one codebase, using the official WireGuardKit, plus Android 8.0 or later as a full Kotlin build. Android 1.1 is live on Google Play, and it is the version with the setup wizard. On iPhone and Mac, OwnTunnel is a configuration-importing client only; version 1.2.0 is the build going through App Store review and is not downloadable yet. On Windows and Linux there is no OwnTunnel app: take the configuration from your server and import it into the official WireGuard client, which speaks exactly the same standard. WireGuard is the only protocol, on purpose.

Something is not working

On iPhone and Mac, check that the configuration was pasted whole — a lost line break or a truncated key is the usual cause — that the Endpoint host and port are right, and that the server is actually running and accepting WireGuard on that port. On Android, if setup itself failed, check that the server exists and is running in your provider’s console, that your API token has read and write scope, and that your cloud account has been verified — new accounts often cannot create anything until the provider verifies them. If the tunnel still refuses to come up, write to us with what you did and what you saw; there is no account for us to look up, so a description is all we have to work with.