Everything you need, fully under your control

Ten capabilities, one client.

Connect to worldwide nodes run by the community and by us — zero setup, zero cost, right after you log in.

Nodes are listed by location (flag, country, city) and live status, with real-time latency and availability. One click connects — the app fetches and applies the latest configuration for you.

• Public nodes: available to any signed-in user.
• VIP / VIP2 nodes: reserved for higher-tier accounts.
• Node health is actively probed by the backend on a schedule; offline nodes are flagged automatically.

One command turns any Linux VPS into a WireGuard node that is yours alone. Traffic only ever flows through your own machine.

The script installs WireGuard, interactively picks a node type, downloads the node agent and registers it as a systemd service. Key generation, firewall and NAT setup are fully automatic. Refresh the app to see your new node.

• Private node: bound to your SafeID (KeyLockr ID · keylockr.app) — only you and the people you authorize can use it.
• Public node: contribute it to the community (subject to review).
• The node agent has built-in heartbeat, self-healing and auto-upgrade — nothing to maintain.

Already have infrastructure? Don't rebuild it — just drop your config into Wuse.

Because of the macOS sandbox, external certificates referenced by an OpenVPN file are inlined after you pick them; PKCS#12 is converted to PEM in place. Imported private keys, PKCS#12 bundles and login credentials always go into the system Keychain — never into a plaintext preferences file.

Two native protocol cores, each running in its own system network extension.

The App Store build offers WireGuard and OpenVPN; the website DMG runs them as a system extension with the same capabilities. Full details on distribution channels are on the tech page.

A private node isn't just an exit — it's a trusted network.

Every private node can authorize other SafeIDs (KeyLockr IDs · keylockr.app) to use it (ACL). Authorized members, like the owner, can reach every port on the node host, the node's local network, and each other's tunnel addresses.

Two routing modes

• Full Tunnel (default): all traffic goes through the node — a complete VPN exit.
• Custom Port: only traffic to the node's intranet address goes through the tunnel; your normal browsing and DNS are untouched. Ideal for pure SSH / reaching internal services. Defaults to SSH (22); add ports like 8080, 3000.

Security isn't one item on a feature list — it's the starting point of the design.

• No activity logs: we don't record the sites you visit or your traffic content.
• End-to-end encryption: WireGuard (Noise) and OpenVPN (TLS), both modern crypto.
• Zero-access self-hosting: private-node traffic only crosses your own machine — we can't see it.
• Secrets in Keychain: private keys, PKCS#12 and login credentials live in the macOS Keychain; UserDefaults only keeps stripped configs.
• No internal / tunnel IPs exposed to clients: the node detail page shows no internal address; public nodes even hide the real server IP.
• Fail-closed: if a Keychain write fails, saving aborts rather than falling back to plaintext.

Sign in by scanning with KeyLockr — no password, no new account to remember.

On first launch the app shows a QR code; scan it with the KeyLockr mobile app to approve and pair. From then on Wuse signs every request with an Ed25519 key on your device, and the server verifies identity from that — your password never leaves your phone, and the Wuse backend never stores one.

Once paired, Wuse can also act as a KeyLockr access point: view your 2FA list and request one-time TOTP codes from your phone on demand. Wuse itself never generates or stores your 2FA secrets.

Different nodes for different purposes, online at the same time.

By default Wuse disconnects incompatible tunnels before connecting, so routing and DNS priority stay predictable. But specific combinations may coexist — e.g. one WireGuard full tunnel carrying default traffic while an OpenVPN split tunnel carries specific routes. Multiple self-hosted nodes can also be connected simultaneously over one shared WireGuard tunnel.

Built for the Mac, so it feels like the Mac.

• Menu-bar resident: the icon reflects connection state in real time (full / split / off), with one-click quick connect and disconnect.
• Dark mode: follows the system automatically — this site too.
• 30 languages: full localization, not half-finished machine translation.
• Auto update: signed OTA upgrades, done in-app with one click.
• URL scheme: wuse://connect can trigger connections from Shortcuts or any app (enable it in settings).
• Launch at login, connect whenever you need it.