Keys stay where they belong
The Android app generates its WireGuard private key on the device. The backend receives the public key to register a peer. Device storage is protected using Android Keystore; hardware protection varies by device.
Security you can understand.
Strong tools are useful only when their boundaries are clear.
Handshake before Connected
The app waits for a real WireGuard handshake before showing Connected. A successful handshake confirms communication with the peer, but an exit-IP and DNS check provide additional evidence of correct routing.
Protect the transition
For stricter protection while reconnecting, configure Android Always-on VPN and Block connections without VPN in system settings. Nsec cannot silently turn those system settings on for you. Apps intentionally excluded from the VPN require careful review with lockdown settings.
DNS and IPv6
The current node configuration is IPv4-only. Do not assume IPv6 tunneling support. Resolver settings, Android Private DNS, browser DoH, and a device leak test should be reviewed together. We do not promise that a configuration screen proves the absence of leaks.
Security is a process
Keep Android and the app updated. Never share a private key or a test-tunnel QR code. Contact support about a suspected issue without including secrets or browsing history.