un/braid
DonateGet the app
MENU

Security

How un/braid handles your traffic: what protects it, what doesn’t, and what happens when something fails. For what data goes where, read the privacy policy.

How it works

un/braid uses Android’s VPN service, the same one every VPN app uses. Inside it, the open-source sing-box engine keeps several tunnels: WireGuard, OpenVPN, Shadowsocks and Tailscale. Android tells un/braid which app opened each connection, and un/braid sends it through that app’s exit.

Your traffic goes to your providers’ servers, your own servers or your tailnet. un/braid runs no servers, and nothing passes through us.

What it protects, and what it doesn’t

It protects traffic sent through a VPN exit. It’s encrypted between your phone and that exit by the tunnel’s protocol, and websites see the exit’s address instead of yours. Connections to your local network, and some Tailscale sign-in connections, use your normal connection.

It doesn’t:

  • make you anonymous. Your VPN provider can see your traffic leave its servers, and websites can still recognise you by your logins and cookies;
  • protect apps set to Direct. They use your normal connection, as you asked;
  • encrypt anything after the exit. A site without HTTPS is still unencrypted from the exit onwards;
  • protect against malware on your phone or a compromised provider.

DNS

Routed apps look up addresses inside their own tunnel: through your provider’s DNS, the DNS you set, or Quad9 when neither is set. Websites usually see the exit’s country, not yours.

Direct apps and names on your local network use your normal network’s DNS. Apps with their own encrypted DNS do their lookups themselves, normally through their own exit. If you set Android’s Private DNS to a provider, Android may use it instead of un/braid’s DNS. To open a tunnel, un/braid may look up your VPN server’s address on your normal network.

IPv6

un/braid tunnels IPv4 only. IPv6 is blocked for apps that go through un/braid, so it can’t go around the tunnel. Apps set to Direct are normally left out of un/braid and keep IPv6. With Android’s blocking on, they go through un/braid and are IPv4-only too.

When something fails

  • One exit stops working. un/braid checks provider exits about once a minute. After three failed checks in a row it tries another server in the same location. Pinned servers, imported configs, Dedicated IPs and Tailscale exit nodes are not moved. While un/braid stays connected, apps on a failed exit don’t switch to Direct. Moving an exit can briefly reconnect the other routes too.
  • Your network changes, for example from Wi-Fi to mobile data. un/braid moves its tunnels to the new network. If the network disappears, it waits three seconds before treating it as gone. Open connections may drop.
  • un/braid stops, crashes or is paused, or a sign-in fails and it can’t reconnect. Android then sends traffic over your normal connection, unless you turn on Block connections without VPN. With blocking on, apps stay offline until un/braid is back.

Always-on VPN and blocking

Android’s Always-on VPN starts un/braid again after a restart or an update. Block connections without VPN stops all traffic whenever un/braid isn’t connected. Turn on both if traffic must never leave without un/braid. In Android’s Settings, open VPN (usually under Network & internet), then the gear next to un/braid.

While un/braid is connected, Direct apps still reach the internet without a VPN, even with blocking on. That’s what Direct means. While it’s paused or off, blocking keeps them offline too.

On your phone

  • Encrypted with a key kept in the Android Keystore (AES-256-GCM): your provider logins, keys and imported configs, your Tailscale auth key, and your recent tunnels.
  • Not encrypted by the app, but private to it: Tailscale’s own device state, statistics if you turn them on, and a table of domain names that apps looked up. The domain table is kept even with Stats off, and deleting statistics doesn’t clear it. Signing out of everything or clearing the app’s storage does.
  • Not in backups. These files are excluded from Android backups and device transfers.

How it’s checked

  • The project includes automated tests and configuration checks.
  • Code is reviewed with AI assistants, as the terms describe.
  • NordVPN, and Tailscale with Headscale, have carried real traffic in tests on Android emulators. See Tested live.
  • There has been no independent security audit. We’ll say so here if that changes.

Report a problem

Found a way to leak traffic, keys or data? Email info@unbraid.app and start the subject with “Security”. Please tell us privately first and give us time to fix it before you publish. un/braid is made by one person, so an answer can take a few days. Our security.txt has the same details.