A free, open-source Android VPN app that tunnels your traffic through Cloudflare WARP using WireGuard. No account needed, no subscription, no ads.
- Free Cloudflare WARP tunnel — registers automatically, no Cloudflare account required
- Split tunneling — whitelist (only selected apps use VPN) or blacklist (all apps except selected)
- Separate whitelist and blacklist — each mode remembers its own app list independently
- Trusted networks — automatically pauses VPN on your home/trusted WiFi, resumes when you leave
- Route exclusions — toggleable per-route bypass for Android Auto, local LAN, link-local, loopback
- Quick Settings tile — toggle VPN from the notification shade
- Boot start — optionally start VPN automatically on device boot
- Persistent notification — shows connection status with optional disconnect button
- Android 8.0 (API 26) or higher
- Location permission (required by Android to read WiFi SSID for trusted network detection)
- Notification permission (Android 13+)
- Clone the repo
- Open in Android Studio (Hedgehog or newer)
- Build → Make Project
To build a release APK without the debug warning:
- Build → Generate Signed Bundle/APK → APK
- Create or provide a keystore
- Select release build variant
SleepyNet registers a free WireGuard device with Cloudflare's WARP API (api.cloudflareclient.com) and uses the wireguard-android library to run a userspace WireGuard tunnel. Split tunneling is implemented via the IncludedApplications / ExcludedApplications fields in the WireGuard config, which GoBackend reads and applies to the VPN's tun interface.
Route exclusions subtract specific CIDR ranges from AllowedIPs using a binary CIDR subtraction algorithm, so excluded traffic never enters the tunnel.
Trusted network detection on API 31+ (Android 12+) uses NetworkCapabilities.getTransportInfo() to read the connected SSID from a background service without requiring foreground context.
- No account, no login, no personal data collected by SleepyNet
- Your traffic goes through Cloudflare WARP — subject to Cloudflare's privacy policy
- WireGuard private key is stored in app-private SharedPreferences (
MODE_PRIVATE) allowBackup="false"— credentials cannot be extracted via ADB backup- No analytics, no crash reporting, no third-party SDKs beyond WireGuard and OkHttp
| Permission | Reason |
|---|---|
INTERNET |
VPN tunnel traffic |
ACCESS_NETWORK_STATE |
Detect network changes |
ACCESS_WIFI_STATE |
Read WiFi connection state |
ACCESS_FINE_LOCATION |
Required by Android to read WiFi SSID (trusted network detection) |
FOREGROUND_SERVICE |
Keep VPN running in background |
FOREGROUND_SERVICE_SPECIAL_USE |
VPN foreground service type |
RECEIVE_BOOT_COMPLETED |
Optional boot start |
POST_NOTIFICATIONS |
Persistent VPN notification (Android 13+) |
QUERY_ALL_PACKAGES |
App picker — list installed apps for split tunneling |
- Kotlin
- wireguard-android — WireGuard tunnel library
- OkHttp — WARP API registration
- Gson — credential serialization
- Material Components — UI
- Coroutines + StateFlow — async/reactive state
MIT