How vpn.golf works
A straightforward look at the architecture, because for a VPN, "trust us" isn't good enough.
1. WireGuard tunnels
Every connection uses WireGuard, a modern, audited protocol with fixed modern cryptography. Fast enough to leave on all day.
2. Your keys are made on your device
The key pair is generated locally; the private key never leaves your machine. A provider that never holds your private key cannot leak it.
3. Control plane separated from exit nodes
Accounts and billing live on a control plane that never routes your traffic. The exit nodes, the "holes", run on separate infrastructure and only know a public key.
4. No-log DNS on every hole
Each exit node runs its own resolver with query logging off. Test it with our DNS leak test.
5. Pick your hole, take the shot
From your clubhouse you choose an exit country, get a config (or use the app), and connect. See the full course.
Frequently asked questions
WireGuard: a modern, audited protocol with a tiny codebase and fast, fixed cryptography.
A hole is an exit node in a particular country. You pick a hole and your traffic comes out at that location.
So no single machine sees both who you are and where you go. The control plane handles accounts and never routes traffic; exit nodes carry traffic but know only a public key.
Your key pair is generated locally on your device. The private key never leaves your machine; only the public key is sent to us so we can register you as a peer.
Only a public key. Exit nodes carry traffic but hold no account identity, no email, and no logs of where that traffic goes.
From your clubhouse you choose an exit country, then either download a WireGuard config (or scan a QR code) or use our app. Your device builds the tunnel and connects directly to the exit node.
Yes. Every exit node runs its own resolver with query logging turned off, so your DNS lookups don't leak to a third party and aren't recorded by us.
No. The control plane handles only accounts, billing, and peer registration. Your actual traffic flows from your device straight to an exit node, never through the control plane.
Revoking a device removes its public key from the exit nodes, so that key can no longer connect. Your other devices are unaffected.
WireGuard has a far smaller codebase, one fixed modern cipher suite, and faster connections. Less code and no cipher negotiation mean fewer places for bugs or misconfiguration.
The control plane runs on its own server that never routes user traffic. Exit nodes run on separate, VPN-friendly providers, keeping accounts and traffic on physically distinct systems.
Each peer has an aggregate byte counter: a simple total of bytes in and out. It records the amount of data, not the destinations, timestamps, or contents.