Warren VPN
Try the beta

Developers

Embed Warren in your app

A reference engine in Rust, thin wrappers for your language, and a wire contract locked by test vectors. All open source.

One engine, thin wrappers

The Rust engine is the reference implementation. Every SDK either embeds it through FFI or reimplements the protocol clean-room against the same test vectors. One source of truth for the wire, one idiomatic API surface per language.

Rust

The reference engine. Non-custodial identity, QUIC tunnel, sealed multi-hop, unprivileged proxy datapath (SOCKS5, HTTP CONNECT, DNS over the tunnel, IPv6, port forwarding). Validated against the live network.

Repository: WarrenBrowse/warren-sdk-rs
Dart / Flutter

Embed Warren in a Flutter app, desktop and mobile. The Rust engine runs in-process through flutter_rust_bridge and exposes a local SOCKS5 proxy, no privilege required. System-VPN mode (TUN) is validated on macOS; the other platforms are in progress.

Repository: WarrenBrowse/warren-sdk-dart
TypeScript

Clean-room reimplementation of the control plane, wire-compatible: browser, Node, Electron. Node datapath via napi-rs, validated against a real exit. A browser alone stays on the control plane: raw QUIC is out of reach there.

Repository: WarrenBrowse/warren-sdk-ts
Python / Kotlin

uniffi bindings generated on top of the Rust engine (crate warren-sdk-ffi), validated in CI.

Repository: WarrenBrowse/warren-sdk-rs

Golden vectors, the wire contract

Every wire format (identity, signatures, exit roster, multi-hop sealing) is frozen in warren-vectors: reference bytes every implementation must reproduce exactly. An SDK that drifts breaks in CI.

What the SDK can do

  • Non-custodial identity: BIP39 mnemonic, Ed25519 key derived locally, SS58 address starting with wb…
  • API requests signed with the account key, no bearer token, and verification of the signed exit roster.
  • Full WarrenGuard tunnel: QUIC, TLS 1.3 Raw Public Keys, obfuscation by default.
  • HPKE sealed multi-hop through a blind relay.
  • Unprivileged proxy datapath: SOCKS5, HTTP CONNECT, DNS over the tunnel, dual-stack IPv6.
  • Port forwarding: request and release public ports on an exit node.

Licenses and repositories

The SDKs and the engine are released under AGPL-3.0, the app under GPL-3.0. The same vectors validate any third-party implementation.

Integration terms

The SDK is free software and free of charge. Every user of an application that embeds it becomes a subscriber of warrenBrowse SRL, under the Warren terms of service. An application that embeds the SDK follows four rules:

  1. Purchases happen only on the Warren payment site, to which the application redirects the user, whatever the payment method. The application collects no payment on behalf of Warren.
  2. The application does not present Warren as a way to evade the authorities, to be anonymous or untraceable, or to commit an offence, and does not target criminal audiences.
  3. The application states nothing about Warren that the Warren privacy policy does not say.
  4. Warren may refuse payments coming from an application that does not follow these terms.
Read the WarrenGuard page