WireGuard on Android: Complete Setup Guide (2026)

WireGuard is the fastest, simplest VPN protocol to run on a phone - once it is set up, connecting is a single toggle, and it sips battery compared with older protocols. This guide walks through WireGuard on Android end to end in 2026: installing the app, importing your server config, enabling a kill switch, per-app split tunneling, and fixing the handshake and MTU issues people hit. It works with any WireGuard server - PiVPN, NetBird, or a manual setup. No config to import yet? Our free WireGuard config generator writes the server file and the phone file in your browser, with a QR code to scan straight from the app.

No server yet? The client needs a WireGuard server to connect to; a HostPapa Unmanaged VPS Lite (affiliate link, 2.95 $ a month on a 3-year term, then the regular rate) or a Contabo Cloud VPS (affiliate link) runs one with its own public IPv4, from 5.50 € a month on a 24-month term as read on 17 October 2026. If you would rather have a US host with a 30-day money-back guarantee, Ultahost VPS Basic is 5.52 $ a month on a 24-month term (1 GB RAM, dedicated IPv4, read on 21 October 2026), enough for a WireGuard server for a few devices. Choosing a host? Compare the best VPS for a VPN and Contabo vs Hetzner vs OVH on the price actually billed. HostPapa's Lite plan is the smallest one here: 1 core, 1 GB RAM, 25 GB NVMe and 4 TB transfer, unmanaged (root SSH on Ubuntu or Debian, no control panel, you install WireGuard yourself), enough for a WireGuard server for a few devices, 30-day money-back guarantee, read on 28 October 2026.

Still choosing the server? Our cheapest-VPS ranking for WireGuard compares what each provider really bills for a usable endpoint.

Rather not run a server at all? Proton VPN creates WireGuard .conf files from its account page that import into the Android app exactly as described below, free plan included (Free plan configs are limited to its free servers); NordVPN runs WireGuard through its own NordLynx app instead. Either way you share IP addresses with other users (affiliate links).

Paid plan, Black Friday 2026: Proton's partner offer, checked on 28 October 2026, is VPN Plus at $2.49/month over 2 years ($59.76 for the first 24 months, then $83.88 per year), with a 30-day money-back guarantee and 10 devices. The order page shows the price for your country, and Proton does not publish an end date.

What you need before you start

• An Android phone or tablet on Android 10 or later (older versions work, but the always-on/kill-switch toggles are cleanest on recent releases).
• A running WireGuard server with a reachable public endpoint - a home Raspberry Pi with a forwarded UDP port, or a small VPS. The Android app is only the client.
• The client config for this device - a QR code on screen or a .conf file. Give each device its own key pair; reusing one config across phones breaks the handshake because two peers then share a public key.
• Only have that .conf on your computer? Paste it into the free .conf-to-QR converter at the top of our WireGuard QR code guide: it draws the code in your browser, sends nothing over the network, and warns you if the Endpoint is a private or CGNAT address that the phone cannot reach once it leaves your Wi-Fi.

Step 1 - Install the app

Install the official WireGuard app from the Play Store or F-Droid (open-source build). Avoid third-party "WireGuard" clones.

Play Store or F-Droid?

Both ship the same official client. The Play Store build updates automatically and is fine for most people. The F-Droid build is compiled from source by F-Droid, carries no Google dependencies, and suits a de-Googled phone - the trade-off is that updates arrive a little slower. Either is trustworthy; just avoid look-alike apps from unknown publishers, since a VPN client handles all your traffic.

Step 2 - Import your server config

In the app, tap + and choose one of:

• Scan from QR code - fastest and least error-prone. Your server renders the client config as a QR (pivpn -qr, NetBird's app, or qrencode on a manual setup).
• Import from file - copy the .conf to the phone and select it.
• Create from scratch - paste keys and the [Peer] endpoint manually.

WireGuard is the client half; it needs a server endpoint. If you do not have one, a Contabo VPS at €5.50/month runs a personal WireGuard server comfortably.

No config to import yet? Our free WireGuard config generator creates the server config and the client configs in your browser, with a QR code per client to scan from the Android app with Scan from QR code above. The generator is free up to 10 devices; past that, WireGuard Pro (our own product, 9 EUR once, no subscription) raises the limit to 250 and adds one ZIP with every client .conf and its QR code as a PNG, handy to set up a whole office or family in one go.

Step 3 - Connect and verify

Toggle the tunnel on. Check the latest handshake updates (not "never") and that your public IP changes. For the protocol background, see WireGuard vs OpenVPN.

Step 4 - Enable a kill switch (always-on)

Android has this built in: Settings > Network & internet > VPN > (gear next to WireGuard) → enable Always-on VPN and Block connections without VPN. Now the phone never leaks traffic outside the tunnel if WireGuard drops - the Android equivalent of a kill switch.

Step 5 - Per-app split tunneling

Edit the tunnel → Applications → Exclude apps (everything tunnels except those - useful for a banking app) or Include only chosen apps. Built into the client, no extra software.

Network-level routing: Allowed IPs

Per-app split tunneling (Step 5) decides which apps use the tunnel. AllowedIPs in the [Peer] config decides which destinations do - and the two combine:

• 0.0.0.0/0, ::/0 routes all IPv4 and IPv6 through your server - the full-tunnel default you want for privacy on public Wi-Fi.
• A narrow range like 10.0.0.0/24 sends only your home/office subnet through the tunnel, leaving the rest of your traffic on the normal connection - perfect for reaching a home NAS or Pi-hole without slowing everything down.

If you run a full tunnel but still want to print or cast at home, the cleanest route is to keep those devices on the LAN and use per-app exclusion for the casting app, since the Android client doesn't have iOS's "exclude private IPs" toggle.

To keep the LAN or one address out of a full tunnel, the free AllowedIPs calculator turns "everything except X" into the ranges to paste.

Troubleshooting

• No handshake (stays "never"): wrong Endpoint IP/port, server UDP port not open in its firewall, or a mismatched public key. Verify the server is listening and reachable. The free WireGuard port checker flags CGNAT and writes the port-forward and firewall rules for your server.
• Connects but no internet: lower the MTU (e.g. 1280) in the interface config - fixes many mobile-network MTU issues. The free MTU calculator writes the exact MTU = line from your ping test or link type.
• Drops on screen-off: disable battery optimisation for the WireGuard app (Settings → Apps → WireGuard → Battery → Unrestricted).
• DNS leaks: set the tunnel's DNS to your server or a trusted resolver, then test with our DNS-leak guidance.
• "Always-on" greyed out: Android only allows always-on once a tunnel imports cleanly and connects at least once - connect manually first, then set it.
• Reconnects slowly after switching Wi-Fi↔mobile: add PersistentKeepalive = 25 to the [Peer] so the tunnel keeps the path alive across network changes and behind NAT.

For reusable client/server templates, see WireGuard config templates.

A VPN changes your IP. It does not change your browser.

A tunnel replaces the address a service sees. It changes nothing about what your browser announces on its own - fonts, screen, time zone, graphics stack - and that combination is often stable enough to recognise you across sessions, tunnel or no tunnel.

Measure your own browser fingerprint - passive, no questions, no account, no email.

The bottom line

Generating that QR code takes one command, and it deserves care: the WireGuard QR code contains the client private key in full.

If you prefer not to run commands, our free WireGuard config generator generates the keys in your browser and shows a QR code for each client config, ready to scan from the Android app.

WireGuard on Android is a five-minute setup: install the official app, import your server config by QR, toggle on, and enable always-on + block-without-VPN for a kill switch. Add per-app split tunneling as needed, and keep the MTU trick in your back pocket for flaky mobile networks. You just need a WireGuard server to point it at - a Contabo VPS or a home Raspberry Pi does the job.

Editorial guide based on the documented behaviour of the official WireGuard Android client and Android's always-on VPN features. Security depends on your server configuration and key hygiene. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.