Frequently asked questions

During the test, codes go out through the anoni.net newsletter, one per subscriber. If you did not get the newsletter, write to [email protected], or tell us on the feedback page and leave a way to reach you, saying what you need. Places are limited, and codes go out in rounds depending on how the service is used.

No. Vessel is a service the community runs for the people around it, and partners who support the community fund its development and running costs.

It cannot be recovered. The service has no email address for you and keeps only a hash of the number, so you would need a new invite code. A password manager is a good place to keep it.

Sixteen digits give ten quadrillion combinations, and sign-in attempts are rate limited, so guessing is not practical. The database stores only a keyed hash of the number, which is hard to reverse even if the database leaks.

An account holds up to 3 devices sharing 50 GB a month, so family devices are fine. Anyone with the account number can also see and delete your devices, so share it only with people you trust. Accounts and invite codes must not be sold.

VPN is the general name for services that send your connection through another server before it goes out. VPNs connect in different ways, called protocols, and WireGuard is one of them: simple, fast and used by many VPN apps. AmneziaWG is an open-source project built from WireGuard that adds a disguise, so connections are harder to recognize as a VPN and get through more easily on networks that block VPNs. Vessel uses AmneziaWG.

The Amnezia team, and its code is public on GitHub for anyone to check. Vessel has no direct affiliation with Amnezia. Get the app from its official store page or GitHub; the links in the setup steps all point to official sources.

Vessel disguises its connections with AmneziaWG, so its packets look different from regular WireGuard, and the regular app cannot use the config.

In tests with the open-source traffic analyser nDPI, plain WireGuard is classified as a VPN and Vessel as QUIC web traffic. Equipment that matches packet patterns has a hard time recognising Vessel, but equipment that analyses traffic more deeply may still recognise it. The disguise lowers the chance of being blocked; it does not guarantee that every network lets you connect. If a network will not let you connect, tell us on the feedback page, and we will use it to adjust the disguise.

It is listed in Taiwan, Hong Kong and Japan. In the few regions where it is missing, you can download it with an Apple ID from another region; iPhones have no other way to install it. On Android you can install the APK instead.

Android allows one VPN at a time, and the first connection shows a confirmation dialog; AmneziaWG can create the tunnel only after you tap OK. The most common cause is another VPN app set to "Always-on VPN": go to Settings → Network & internet → VPN, tap the gear next to that app, and turn off "Always-on VPN" and the option below it that blocks connections without a VPN. If you cancelled the dialog before, or turned the tunnel on from the notification shade, open AmneziaWG and use the switch in the app so the dialog appears again. On a phone with several users or a work profile, install AmneziaWG in the profile that should use the VPN.

No. Two devices connected at once keep taking the connection from each other and drop out often. Create a config for each device, up to 3 per account.

A config is shown only once, when it is created, and the service's servers do not have the private key. Delete the old device from your list and create a new one.

Blocking malicious sites uses HaGeZi's Threat Intelligence Feeds (mini), and blocking ads adds HaGeZi Multi (Normal). The lists are updated every 8 hours. If unsure, pick no filtering. The ad list sometimes blocks sites that work fine. To change it later, delete the device and create it again. Browsers whose “secure DNS” is set to another provider skip the filter.

Yes, this is called split tunneling. When you edit a tunnel in AmneziaWG for Android, you can exclude apps or send only chosen apps through the VPN, for example to let a banking or work app connect directly. The iPhone and desktop apps have no per-app option. Apps left out of the VPN connect directly, so your network provider and whoever runs a public Wi-Fi can see where they go, and the domain filter does not apply to them. If unsure, keep the default and send all traffic through the VPN.

Like WireGuard, AmneziaWG shows "connected" as soon as you turn it on, without checking that the node answers. The connection details in the app show a "Latest handshake" time; if none appears, the node is not answering. Sign in to the portal and look at your devices: if this one is missing, it has expired and been deleted, so add a new one. A device marked "Paused" has used up this month's 50 GB and resumes on the 1st. If neither applies, the network you are on may be blocking the connection; try mobile data.

Make sure AmneziaWG is up to date, then try another network, such as mobile data instead of Wi-Fi. If it still fails, delete the device and create it again. The disguise makes blocking less likely, but no network is guaranteed to work.

It depends on your network and how far you are from the node. In tests from Taiwan, the Singapore node had about 67 ms of latency and about 200 Mbps; the Tokyo node about 180 Mbps down and 100 Mbps up.

Singapore and Tokyo for now. More will follow depending on how the test goes. You pick the city when you create a device; to switch cities, add another device.

Even if you stay connected, an account's devices expire after 30 days without opening the Vessel portal. Expired devices are deleted from the nodes and the device list, so unused configs do not linger on the nodes. Signing in, or opening the Vessel portal while signed in, extends them by 30 days, and opening it while connected to Vessel counts too. The device list shows each expiry date.

The account does not expire, and its number still signs you in. The expired device is gone from the node, so the config on your phone or computer no longer works; AmneziaWG may still say connected, but nothing gets through. Sign in, add a new device, import the new config, then delete the old entry in the app. Expired devices do not count toward the limit, and the service keeps no record of them, so they do not appear in the list.

The account's devices pause and resume automatically at 00:00 UTC on the 1st of the month. Nothing needs to be set up again.

The terms ban BitTorrent and other P2P file sharing during the test. Nodes also block outgoing TCP port 25, so you cannot send mail straight to a mail server on port 25. Port 587, which mail apps normally use, is not affected.

Nodes handle the domains and IP addresses you connect to, but not the contents of HTTPS connections. Nodes keep no logs of them, and the DNS resolvers do not log queries. Using a VPN moves the trust you place in your network provider to the service. Use Tor Browser when you need anonymity.

The device list shows each device's traffic this month, and for devices with a DNS filter, how many malware lookups were blocked. A device you rarely use with a lot of traffic, or a sudden jump in blocked lookups, suggests an app connecting in the background. The service only keeps the counts and does not know which app it is or which domains it reached. Finding the cause takes a check on the device itself: on Android, PCAPdroid or TrackerControl records each app's connections and keeps the data on the phone. If you suspect spyware, use a forensic tool such as the Mobile Verification Toolkit (MVT), or contact a digital security helpline.

Only what is listed under “What we keep”. There are no connection logs, so an exit IP address and a time cannot be traced to an account.

To stop attack traffic. Cloudflare can see visitors' IP addresses and the pages they view. VPN connections do not go through Cloudflare.

Delete it on the account page. All devices disconnect right away and the data is deleted with them. Database backups disappear after their retention period, which the privacy policy states.