The VPN Element
Powerful VPN protection built for Everyone™.One tap to connectNO setup, NO account, NO headache.
Why NITRONET
No accounts, no configuration to get wrong, and no browsing history to lose. Here is what the tunnel does — and what we deliberately never collect.
We don't record the sites you visit, the DNS names you look up, or the destination IPs you connect to. Limited connection metadata is kept only for routing and abuse prevention — the policy lists every field and its retention.
An encrypted WireGuard tunnel carries your traffic and DNS. Private DNS is resolved through the VPN, not by your carrier or the café Wi-Fi, so the local network sees encrypted packets rather than your destinations. No account is required — your device gets a pseudonymous identity — and Android asks for your permission before any VPN can route traffic.
A custom transport built for speed and stability on restrictive networks, running on top of WireGuard. The encryption and handshake are standard, proven WireGuard; only the outer wrapper is ours, so you get camouflage without a home-grown cipher.
Choose where you connect and browse with an IP from that region. Servers span multiple regions: Best Performance selection stays free, Nitronium opens every location.
Your apps' IP traffic and DNS go through the tunnel by default, and NITRONET reconnects on its own if the connection drops. Tethering, apps that bind to another network, rooted devices, and aggressive battery optimisers can weaken that protection; Android's always-on VPN with lockdown is the strongest setup.
One button. No profiles, configuration files, or manual server settings. Install, grant Android's VPN permission once, and tap Connect; Best Performance selects a healthy server for you. Moving between Wi-Fi and mobile data does not require a new setup — NITRONET handles the reconnection itself.
Every claim above maps to something the app or servers implement. The Privacy Policy and Security pages explain the limits, including the metadata we do keep.
The app
One pill-shaped button, your location, and your status. The molecule on the Home screen bonds when you connect.
One app, one download. No account, no email, no profile to create.
Android shows its VPN permission dialog and NITRONET explains what is collected before anything is routed through the tunnel.
Traffic and DNS go through the tunnel, and there is nothing else to configure. Disconnect with the same button.
Locations
Best Performance picks the fastest healthy server for your network. Nitronium unlocks every location, so you can choose the region you want instead of the one you are in.
Free plans use Best Performance. Location names in the app may differ from this page, and locations or servers can change without notice. A location may have servers in multiple cities, but servers are chosen automatically, so a specific city or server is not guaranteed.
Plans
The free plan is not a trial. One small banner keeps the servers running. If you want every location and a clean screen, Nitronium is a Google Play subscription you can cancel any time.
Supported by one adaptive banner on the Home screen. No forced full-screen ads, no app-open ads, and no ads inside the tunnel.
Ads are served by Google AdMob with your consent choice where required and never injected into your traffic. Read theadvertising section of the Privacy Policy.
Privacy by default
NITRONET identifies your device with a pseudonymous key, not an account. There is no profile of where you go, and no browsing data to sell, hand over, or lose.
We do keep short-lived connection metadata — assigned addresses, lease times, and limited request logs — to route traffic and stop abuse. The Privacy Policy lists each field and how long it stays.
Under the hood
NITRONET is not a home-grown cipher. WireGuard provides the secure tunnel; our custom layer is the transport wrapper that helps it move through restrictive networks.
The cryptographic handshake, symmetric encryption and authentication are standard WireGuard (Noise IKpsk2 handshake, Curve25519 ECDH, ChaCha20-Poly1305 AEAD, BLAKE2s). We do not invent a proprietary cipher or an unverified key exchange.
Each WireGuard datagram is placed in a versioned NITRONET frame with a 64-bit connection ID and datagram type. This maintains persistent tunnel state across mobile carrier and Wi-Fi network handovers.
The NITRONET frame sits inside a private EDNS0 option (code 0xFDE9) within a syntactically valid RFC 1035-shaped DNS packet. To many middleboxes it looks like an ordinary DNS query, reducing the protocol fingerprint available to DPI.
The server strips the DNS shell, validates the NITRONET frame, then passes the datagram to WireGuard. WireGuard authenticates the Poly1305 MAC and decrypts it before the inner IP packet is routed. Lease control is separate over HTTPS/TLS 1.2 or newer.
Deep Packet Inspection
Network firewalls and ISP filters use Deep Packet Inspection (DPI) to detect and throttle VPN protocols by analyzing packet type and protocol fingerprints. WireGuard traffic begins with recognizable message types and handshake patterns that DPI engines can match.
NITRONET wraps identical, unmodified WireGuard cryptography inside syntactically valid RFC 1035-shaped DNS datagrams, presenting standard DNS message structures and reducing its protocol fingerprint.
Structured as valid RFC 1035 DNS datagrams carrying unmodified WireGuard inside private EDNS0 Option 0xFDE9. Middleboxes classify it as standard recursive DNS queries. Unthrottled delivery with zero DPI heuristic match.
Standard UDP port 51820 with recognizable WireGuard Type 1 initiation bytes and fixed 148-byte handshake size. Heuristic matchers detect known cryptographic signatures and drop or throttle traffic at the firewall.
WireGuard handshake (Type 1) and data (Type 4) packets begin with recognizable message-type bytes that DPI matchers can key on.
Every packet is structured as a valid DNS datagram with standard DNS headers, carrying the tunnel payload inside EDNS0 Option 0xFDE9.
Fixed packet lengths and identifiable cryptographic negotiation flows can make traditional VPN traffic easier for heuristic filters to classify.
Camouflaged transport envelopes are designed to reduce heuristic fingerprinting; middleboxes see DNS-shaped traffic rather than an obvious VPN handshake.
Standard Noise IKpsk2, Curve25519 ECDH, and ChaCha20-Poly1305, but exposed handshake bytes can still be matched by DPI filters.
NITRONET does not invent a custom cipher. The DNS shell only provides transport disguise; the inner tunnel is unmodified WireGuard.
FAQ
If something is not covered here, the Privacy Policy is the source of truth — or email us and a human will answer.
No. NITRONET creates a pseudonymous device key on first launch — no email, phone number or name. Resetting your identity in the app removes the local key and starts a fresh device identity; uninstalling removes the local key from your device.
We do not log the sites you visit, DNS query names, destination IPs, or packet payloads. We do keep limited connection metadata: device public keys and ID (90 days after last seen), lease details such as assigned addresses and timestamps (24 hours after release or expiry), limited API request logs (up to 30 days), and aggregate traffic counters without device labels. The Privacy Policy lists every category and retention period.
Yes. The free plan has no data cap and one adaptive banner on the Home screen. There are no forced full-screen ads, no app-open ads, and no ads injected into your traffic. Nitronium is an optional Google Play subscription that removes ads, unlocks every location, gives priority when a location is busy, and covers up to 10 devices at once.
No. NITRONET excludes only its own ad and app requests from the tunnel, so ads load over your normal connection and never use VPN capacity. No other app is excluded from the tunnel by default. The ad networks therefore see your real IP address, not the VPN's. Nitronium removes the banner and makes no ad requests.
Your apps' IP traffic and DNS go through the tunnel by default. Some situations can weaken leak protection: tethering, apps that bind to another network, rooted devices, and aggressive battery optimisers. For the strongest setup, enable Android's always-on VPN and lockdown.
NITRONET reconnects automatically, up to three times, refreshing its credentials each time, and shows that it is reconnecting. While it does, Android may send traffic over your normal network. Only Android's always-on VPN with lockdown blocks traffic completely until the tunnel is back.
Yes. The custom part is only the outer wrapper, which makes packets resemble ordinary DNS traffic so they get through restrictive networks. Your data is encrypted and authenticated by WireGuard, a modern open protocol that is widely deployed and extensively reviewed. We did not invent our own cipher or handshake. Lease control messages use TLS 1.2 or newer to the control plane; your payload stays inside WireGuard. The Security page explains what remains visible to an on-path observer.
An Android 8.0 or newer device and a network that allows VPN connections. Availability may vary by region. iOS and browser versions are coming soon.
Download
Free with one small banner. No account, no quota, and nothing to configure after the first tap.
