Skip to content

Features

What Kayzen VPN will do, and where we stand

Each feature states when it arrives: from launch, or later, as a measurable objective.

  • At launch

    WireGuard®-based tunnel

    The WireGuard® protocol, used without modification, for a fast tunnel and a small cryptographic codebase reviewed by the community.

  • At launch

    Kill switch on by default

    If the tunnel drops, the firewall blocks all traffic outside the tunnel until it reconnects or you explicitly disconnect. The rules are already generated and automatically tested on Linux.

  • At launch

    Leak-free DNS

    DNS requests go through the tunnel, to our resolvers. They never leave in clear text, not even towards the local network.

  • At launch

    K-Shield DNS filter

    Kayzen Security’s DNS filtering blocks dangerous sites and, depending on your choices, ads, trackers, adult content or gambling. Included in the free tier.

  • At launch

    Anonymous 16-digit account

    No e-mail address. Our servers only store an HMAC fingerprint of your number, never the number itself.

  • At launch

    Signed server list

    The application checks the Ed25519 signature of the server list and rejects a list that has been modified, has expired or is older than the previous one.

  • At launch

    ‘Check my protection’

    A built-in test compares your IP address before and after connecting and looks for DNS, IPv6 and WebRTC leaks. Without enough data, it answers ‘inconclusive’, never ‘all is well’.

  • At launch

    Getting past blocks

    On networks that block VPNs (hotels, companies), the connection automatically switches to port 443, the port of the encrypted web, without changing the WireGuard® protocol.

  • At launch

    Automatic connection on public Wi-Fi

    At the station or the café, the VPN connects by itself; at home, it leaves things to you. The list of your trusted networks stays on your device.

  • Objective

    Protected applications

    Choose which applications go through the VPN: for example the browser yes, your banking app no. The permanent lock, if enabled, always protects everything.

  • Objective

    Double protection (paid tier)

    Your traffic goes through two servers in two countries: neither one knows both your address and your destination.

  • Objective

    Browser extension

    Protect only your browser, without installing the full application.

  • Objective

    Business edition

    A console to manage employees and their devices, with passkey sign-in and access rules, built into Kayzen Security.

  • Objective

    Post-quantum resistance

    A hybrid key exchange (X25519 and ML-KEM) to derive the WireGuard pre-shared key, so as to withstand deferred decryption.

  • Objective

    Diskless servers

    Relays started from a signed image, in memory only, with no writable disk.

  • Objective

    Verifiable builds

    Applications that can be reproduced identically from the published code, with fingerprints and signatures that anyone can verify.

On all your platforms

The planned applications share the same core, written in Rust: Windows, macOS, Linux, Android and iOS.

Windows · macOS · Linux · Android · iOS