How vpn.golf works
A straightforward look at the architecture — because for a VPN, "trust us" isn't good enough.
1. WireGuard tunnels
Every connection uses WireGuard, a modern, audited protocol with fixed modern cryptography. Fast enough to leave on all day.
2. Your keys are made on your device
The key pair is generated locally; the private key never leaves your machine. A provider that never holds your private key cannot leak it.
3. Control plane separated from exit nodes
Accounts and billing live on a control plane that never routes your traffic. The exit nodes — the "holes" — run on separate infrastructure and only know a public key.
4. No-log DNS on every hole
Each exit node runs its own resolver with query logging off. Test it with our DNS leak test.
5. Pick your hole, take the shot
From your clubhouse you choose an exit country, get a config (or use the app), and connect. See the full course.
Frequently asked questions
WireGuard — a modern, audited protocol with a tiny codebase and fast, fixed cryptography.
A hole is an exit node in a particular country. You pick a hole and your traffic comes out at that location.
So no single machine sees both who you are and where you go. The control plane handles accounts and never routes traffic; exit nodes carry traffic but know only a public key.