OnionVPN

byPsychopath · Tools

Verified safeExclusive

Download APK

—

No reviews reviews

downloads

8.0

android

AI summary

Privacy-focused VPN that routes all device traffic through Tor with DNSCrypt, kill switch, and interactive per-app firewall with threat-list coloring. Version 0.3.84 encrypts OpenVPN passwords in the Android keystore, improves DNS-over-TCP diversion to DNSCrypt, and fixes firewall rule persistence, kill switch behavior, and multiple routing edge cases.

Generated by AI. May contain inaccuracies.

About this app

Privacy-focused Android VPN that routes all device traffic through Tor, with DNSCrypt for app DNS over Tor SOCKS (TunDnsMux divert). Inspired by InviZible and Mullvad-style leak protection.

What it does

- Tor tunnel: full-device VPN via hev-socks5-tunnel to Tor SOCKS; kill switch blocks traffic when the tunnel is down. - DNSCrypt: app DNS resolved through DNSCrypt (upstream via Tor); TunDnsMux on 10.8.0.1. - Interactive firewall: OpenSnitch-style Accept / Deny for new outbound connections (notification and prompt, FIFO queue, permanent / session / temporary rules). - Domain threat lists: HaGeZi lists colour destinations on prompts: green safe (unlisted), orange ads/tracking/telemetry, red malware/C2. Updates prefer Tor when the tunnel is up. - App lock: lock the UI without stopping the tunnel or kill switch. - Tor tuning: circuit rotation presets, stream isolation modes, editable torrc / dnscrypt-proxy.toml. - Tor engine: dual backend, C Tor (libtor.so, default) or Arti (arti-mobile and/or onionmasq TUN). - TUN data plane: hev-socks5 (C Tor / Arti fallback) or onionmasq (Arti preferred when libonionmasq_mobile.so is present). - Circuit UI: Onionmasq path with per-app hops, NEWNYM-per-app, exit directory from NewDirectoryEvent.

Security

OnionVPN opts into hardware memory tagging (MTE) with android:memtagMode="async" on <application>, the same pattern as GrapheneOS Auditor and Camera. On MTE-capable devices the OS enables tagging for the app process; on other devices the attribute is ignored.

Components loaded in the app process (JVM, Compose, Hilt, JNI .so such as hev, arti, onionmasq) are covered by MTE. libtor.so (C Tor) runs in a child process; arm64 builds from the Tor-Android-build-script use -fsanitize=memtag when ENABLE_MTE=1. DNSCrypt, Lyrebird and Conjure run in a child process under OS defaults (Go PTs are not MTE-instrumented).

hardened_malloc and extended virtual address space (48-bit VA) are GrapheneOS system features, not something an APK can embed. For this 64-bit-only app they are on by default on GrapheneOS. Do not disable Native code memory tagging, Hardened malloc, or Extended virtual address space for OnionVPN unless debugging a confirmed native memory bug.

After enabling the tunnel on a GrapheneOS Pixel 8+, check logcat:

adb logcat -d | grep -E 'SEGV_MTEAERR|hardened_malloc|memtag'

License

Proprietary / OnionPhone family

vpn privacy tor firewall dns security

What's new

v0.3.84Oct 12, 2026

Security and privacy
The OpenVPN password is now encrypted with AES-256-GCM in the Android keystore, instead of being stored in plain text. - DNS requests over TCP port 53 are now diverted to DNSCrypt instead of being blackholed, so more apps keep working over the VPN. - Fail-closed behaviour for connections without a resolved app owner, instead of falling back to the configured default. - Developer option to allow ADB clearnet traffic now defaults to off, and is opt-in.
Fixes
Fixed the firewall rule store wiping all rules if the stored list could not be decoded. Corrupt entries are now skipped individually, and a whole-list failure aborts the save. - Fixed Always-On VPN and VPN revoke handling, which could be blocked by a wedged start holding the lifecycle lock. - Fixed the kill switch staying on after a failed Blocking TUN, and made the Error phase stoppable by the user. - Fixed firewall rules with session scope surviving a tunnel restart; they are now cleared. - Fixed OpenVPN routing and DNS configuration edge cases, including PAC proxy start failures. - Fixed IPv6 address packing in connection-owner resolution, which could misattribute connections. - Fixed oversized DNS replies now returning a truncated (TC) response instead of being dropped, so clients retry over TCP. - Fixed KPM socket-binding leaks on some vendor kernels.