Made for restricted networks.
Free, open-source VPN software. Run a server yourself, or add a profile from someone you trust.
This VPN is made for private connections, including places where internet access is restricted. Start with a profile from someone you trust.
No central Kurdistan VPN account required.
Android app coming soonSelect a part to see its role.
A connection on your terms.
Kurd is our open-source protocol. Your profile brings the settings; you choose the connection.
Your phone, your choice.
You choose the profile and when to connect.
Run your own, or use one you trust.
The server operator runs the VPN software. The hosting provider supplies the underlying infrastructure.
Interactive explanation · not a live VPN session
More details
Access is not the same everywhere.
Some networks block websites, filter traffic or interrupt connections. Kurdistan VPN is being built for people who live with those restrictions.
That is a design goal, not a promise that any VPN will work on every network.
Technical details
The reviewed Kurd compiler varies framing, scheduling and padding through a signed profile. Permitted fallback stays within that profile. These mechanisms do not, by themselves, prove resistance to a particular censor.
A protocol is how the connection works.
Kurd is our own open-source protocol. More connection methods are planned, giving you more ways to connect through the app.
Explore the connection methods planned for the app.
Kurd
Our own open-source protocol.
VPN and tunnels
Established tunnel projects.
Proxy connections
Different approaches to proxy connections.
QUIC connections
Projects and standards built around QUIC.
Standards and routing
Connection standards and routing options.
Run a server. Or use one you trust.
A profile is the connection setup you add to the app. Someone who runs a Kurdistan VPN server can give you one. You can also run a server and create your own.
Check the fingerprint with the person who gave you the profile. Accepting a profile gives access to a server, not control of your phone.
Who controls each part?
The phone, the profile and the server have different roles. Select one to see where its control ends.
You
You choose the profile and grant Android VPN permission. A profile does not give its issuer control of your phone.
Technical details
Android grants VPN permission. Device-owned private material remains in protected local storage; the operating system controls its own always-on and lockdown settings.
A compromised or unlocked device remains a separate risk. A VPN does not secure every app or permission on the phone.
The profile issuer
A profile is the connection setup you add to the app. Its signed rules define access to a particular server.
Technical details
The signed artifact binds permitted runtime policy, validity and deployment identity. A recipient-sealed profile is intended for its enrolled device.
The issuer can expire or revoke that access. A valid signature does not, by itself, tell you whether to trust the issuer.
Your device
Device-bound keys open profiles made for this phone. They do not give the server operator remote control.
Technical details
The Android flow exports a public enrollment request. Private key material does not leave encrypted local storage except inside an encrypted backup.
The public request is not a password. Backups and device compromise still need deliberate handling.
The operator and hosting provider
The operator runs the VPN software. The hosting company controls the underlying VPS infrastructure. You decide whether to connect.
Technical details
kurd-node runs on an operator-controlled VPS. Host-level networking and resolver policy are outside the relay process’s authority.
Self-hosting gives you operational control, not ownership of the hosting company’s equipment or guaranteed anonymity.
Project maintainers and contributors
Kurdistan VPN manages the connection on your phone according to the verified profile. It is software, not a remote device administrator.
Technical details
The public source contains the Kurd compiler, runtime, Android foundation and operator tooling. Review source and exact release provenance separately.
Open source is not an independent audit. Build, distribution and operational evidence must be checked for each release.
Who can see what?
A VPN changes who you trust. It does not make you invisible. Your connection still has several boundaries.
What may be visible
Your device
Your apps handle your messages and data. Profiles and settings are stored locally; device-bound keys open profiles made for that device.
What this does not mean
A VPN cannot repair a compromised phone or stop an app that already has access to your data.
What may be visible
Kurdistan VPN project
The architecture needs no central Kurdistan account or central traffic service. This website sends no analytics.
What this does not mean
The website host still receives your web requests. This is separate from the VPN server you use.
What may be visible
Server operator
The operator controls the VPN server. Source IPs, connection timing, destination IPs and server-side DNS may be visible, depending on the configuration.
What this does not mean
HTTPS can protect application content beyond the VPN server. Unencrypted traffic does not gain that protection after leaving the tunnel.
What may be visible
VPS or hosting provider
The provider controls the hosting infrastructure and may know the operator’s account, billing details and network metadata.
What this does not mean
Renting and operating your own VPS does not remove the hosting provider from the trust model.
What may be visible
Website or service you visit
The destination receives your requests and the information you send. Signing in can identify you even when a VPN is on.
What this does not mean
HTTPS protects data in transit to that service; it does not hide that data from the service itself.
See the evidence behind the claims.
Read what a statement means, how the software supports it and where the limits are. The source is one click away.
Read the security modelNo required central Kurdistan VPN account.Implemented in sourceView evidence
- What this means
- The product architecture does not require a central product login or public relay directory.
- How the design works
- An owner-issued profile and an explicitly confirmed deployment fingerprint establish the intended relationship.
- The limit
- This does not mean anonymous use. A VPS host, deployment operator or another service can have its own account requirements.
Reviewed . Source code alone is not release qualification.
Profile validity and owner trust are separate decisions.Implemented in sourceView evidence
- What this means
- A valid signature is not proof that a profile came from the person you intended.
- How the design works
- The Android import flow previews the profile, requires comparison of the deployment fingerprint, and confirms storage.
- The limit
- You need an independent, trusted way to compare the fingerprint. A code repeated by the same untrusted sender is not independent confirmation.
Reviewed . Source code alone is not release qualification.
Android profile storage is designed around local encryption.Implemented in sourceView evidence
- What this means
- The reviewed Android foundation uses encrypted storage backed by Android Keystore.
- How the design works
- Sensitive profile admission is bounded; the app accesses verification through a native Go bridge.
- The limit
- The browser preview is not that secure store. A compromised device or unsafe backup can still expose information.
Reviewed . Source code alone is not release qualification.
No required product advertising or analytics service.Implemented in sourceView evidence
- What this means
- Independent deployments do not depend on a Kurdistan advertising, analytics or remote crash-reporting service.
- How the design works
- The repository specifies local custody and categorical, secret-safe diagnostics rather than central traffic logging.
- The limit
- This does not establish a logging policy for every operator or VPS host. The website has its own, separate privacy notice.
Reviewed . Source code alone is not release qualification.
Try the app.
Select a profile, compare its fingerprint or switch to Grandma Mode. The same app gives you as much detail as you need.
Try the app’s controls.
This sandbox uses the supplied app design. Do not enter real profiles, passwords or server details.
Try a connection state
Explore the app
Example data only. No real VPN traffic.
Read the app workflow
Run your own VPN server.
Install the node on your own VPS and create profiles for the people who will use it. You manage the configuration, updates and backups.
Recovery material and encrypted backups help restore access if the server is lost or replaced. The guide explains each step and where to run it.
Read the self-hosting guideFOSS — Free and Open-Source Software
Read the code. Build it yourself. Share improvements. No advertising or analytics is needed to fund your connection.
See what is available today.
The Android download is coming soon. The source and documentation are available now. Check the exact source and release evidence before using a build.