Quantum-ready, stated precisely
Most VPNs that use the phrase leave you to guess what it covers. Here is the whole mechanism, including the part that is not post-quantum.
WireGuard's own handshake is X25519, and X25519 is not post-quantum. Nothing on this page claims otherwise. What is post-quantum is how the pre-shared key gets to your device — and under WireGuard's design, that is the part that decides whether a recorded session can be opened later.
- WireGuard already has the hook. Its handshake mixes in an optional 32-byte pre-shared key. An attacker who records your traffic and later breaks X25519 still cannot read it without that key. The catch is obvious: if the key itself travelled under classical encryption, breaking that gets it, and the protection was theatre.
- So the key never travels that way. Your device generates a fresh ML-KEM-768 key pair (FIPS 203) for each provisioning, and sends only the encapsulation key. The node encapsulates to it, derives a mask from the shared secret with HKDF-SHA256 under a dedicated label, and returns the pre-shared key wrapped under that mask.
- The secret stays on your phone. The ML-KEM decapsulation key never leaves the device, and the node keeps no long-term KEM secret of its own — it only ever encapsulates, to a key that is fresh per request. There is nothing on the server to seize or to recover across sessions.
- Harvest now, decrypt later stops working. An adversary who records both the provisioning exchange and the tunnel, and who owns a cryptographically relevant quantum computer years from now, still needs a secret that was never transmitted.
The asymmetry we are not going to hide. On Android there is no classical fallback at all: if a node answers with a plain pre-shared key, the client treats it as an error and the tunnel does not come up. A downgrade is a failure, not a fallback. On Apple platforms ML-KEM comes from CryptoKit, which needs iOS, macOS, tvOS or visionOS 26 or later; below that the classical form is still accepted, and the app says so on screen before you connect.
A related but separate fact, because the two get blurred: the OSHI Mesh messenger has its own hybrid post-quantum key agreement — X-Wing, which is ML-KEM-768 combined with X25519 — also on iOS 26 and macOS 26 only. That is the messenger's chat encryption. It is a different app and a different mechanism from the one described above.
What you actually get
WireGuard, terminating on a machine we run
ChaCha20-Poly1305 transport, X25519 device keys. Your device generates its own key pair and sends only the public half, so no private key of yours exists on any server — which is what makes the no-logs position structural rather than a promise.
Ad and tracker blocking for every app
The resolver at the exit declines 230,717 advertising, tracker, malware and phishing domains (StevenBlack's lists, counted on a node at the 27 August 2026 refresh). Not just the browser — everything on the device. Quote that number with its date; it moves upstream.
There is no account to create
A key pair the device makes for itself, plus a random identifier created on first launch. No name, no email address, no phone number, no password anywhere in the system — and no payment card for the free plan.
It connects where UDP is blocked
The New York and Portsmouth nodes also accept WireGuard inside TLS on port 443, for hotel, campus and corporate networks that drop UDP. Both of those are free-plan locations. The other four are UDP 51820 only.
See where your traffic comes out
Every location on a world map, with the one you are leaving through right now marked live. The map is drawn from data built into the app: no map service is contacted, so nobody learns which part of the world you are looking at. Tap a pin to pick that location.
Measure the path you are actually on
Ping, download and upload, measured through the tunnel against Cloudflare's public speed test, plus the IP address and country websites see you as. It runs only when you tap Start, the result stays on your phone, and it says plainly when you are measuring your own connection instead of the VPN.
The node fleet
Six machines, four countries, all operated by the publisher — the server, the configuration, the resolver and the keys. None of it is resold capacity on somebody else's VPN; the data centres supply racks, power and a network connection. Each node is provisioned for 251 devices.
| Location | Country | On the free plan | Transports |
|---|---|---|---|
| New York | United States | Yes | UDP 51820 · TLS 443 |
| Portsmouth | United Kingdom | Yes | UDP 51820 · TLS 443 |
| Gland | Switzerland | Yes | UDP 51820 |
| France 1 | France | Oshi Plus | UDP 51820 |
| France 2 | France | Oshi Plus | UDP 51820 |
| France 3 | France | Oshi Plus | UDP 51820 |
Only nodes with unmetered egress serve the free tier, which is why three of the six do, and the gate is enforced by the node rather than by a switch in the app. The three French machines share one data centre in Lauterbourg; they are numbered by country because the town is not what distinguishes them.
What the law can demand, per country
A VPN inherits the law of the country its exit sits in. That is the part most VPN pages leave out, so it is here with each instrument named, so you can check it instead of believing us.
| Country | Nodes | Mandatory retention today | Instrument |
|---|---|---|---|
| France | 3 | Yes — 1 year, in force | Décret n° 2025-980 of 15 October 2025, in force 21 October 2025 |
| Switzerland | 1 | Not yet — revision paused | BÜPF / VÜPF revision |
| United Kingdom | 1 | Only on notice | Investigatory Powers Act 2016, Part 4 |
| United States | 1 | No general mandate | — |
Switzerland's reputation is doing a lot of work in VPN marketing that the current Swiss draft does not support, which is why this product does not sell “Swiss privacy”. No country in this fleet is a safe haven, and picking an exit by its flag is weaker protection than most VPN pages imply.
What a node actually holds for your device: a random identifier, your public key, your tunnel address, your tier, and one running byte total for the calendar month. No connection times, no per-location history, no DNS query log — the resolver does not log queries and the node agent writes nothing to the system journal. An obligation to produce records does not conjure records that were never kept. Full detail in the VPN privacy policy.
Free plan and Oshi Plus
5 GB per calendar month
Three of the six locations — United States, United Kingdom and Switzerland — with the same tunnel, the same filtering and the same post-quantum key delivery as the paid plan. No account and no card.
All six locations, no monthly limit
Sold monthly or yearly through the app store. No price is published here: the app shows what the store returns for your country, so what you pay is set by the store, not by this page.
What it does not do
A product page without this section is not a reference. Every line below is a limitation we would rather you read here than discover later.
- It is not anonymity. A VPN moves trust from your network provider to whoever runs the exit. A site you sign in to still knows who you are.
- It is not on the App Store, and the Play listing is not public yet. Android today is the developer's signed APK, with its SHA-256 published. iOS, macOS, tvOS and visionOS are targeted for March 2027, with no TestFlight before then.
- It is not open source and has no published audit. Unlike the messenger's cryptographic core, which is public and MIT.
- It is not decentralised. Multi-hop between our own machines in different jurisdictions is in the Android app (Settings › Route through a second country), but both hops are ours, and there is no volunteer relay network — that is blocked on NAT traversal, which is unsolved here. There is no token and no way to earn from running a relay.
- There is no kill switch on tvOS, because Apple TV provides no API for one. If the tunnel drops there, the device falls back to the open network.
- No speed, bandwidth or uptime figures are claimed, because none has been measured in a way worth publishing. The app has a speed test so you can measure your own path; we do not quote anyone's result as ours.
Frequently asked questions
Is it really quantum-ready?
In one specific and stated sense, yes. WireGuard's handshake is X25519, which is not post-quantum. What is post-quantum is the delivery of the 32-byte pre-shared key that WireGuard mixes into that handshake: your device generates an ML-KEM-768 (FIPS 203) key pair, the node encapsulates to it, and the pre-shared key comes back wrapped under a key derived from that encapsulation with HKDF-SHA256. The ML-KEM secret never leaves the device. An attacker who records today and later breaks X25519 still needs that pre-shared key, and it never travelled under classical cryptography alone. It is not a post-quantum handshake, and this page does not call it one.
Does the post-quantum protection apply on every platform?
No, and the difference is real. Android has no classical fallback at all: a plain pre-shared key from a node is rejected and the tunnel does not come up. On Apple platforms ML-KEM comes from CryptoKit, which needs iOS, macOS, tvOS or visionOS 26 or later; on an older release the classical form is still accepted, and the app says so on screen.
Can I download it today?
On Android, yes — the APK is published direct from the developer with its SHA-256 beside it, so you can check the file before you install it. The Google Play listing is still in closed testing and is not public. On iPhone, iPad, Mac, Apple TV or Vision Pro, no: the build exists and runs against the same nodes, but it is not on the App Store and is targeted for March 2027.
Does it keep logs?
The resolver keeps no DNS query log and the node agent writes nothing to the system journal. A node holds a random identifier for your device, your public key, your tunnel address, your tier and one running byte total for the calendar month — not a record of when, for how long or from where you connected. The session history in the app is kept on your phone and never transmitted.
Does it make me anonymous?
No, and the app says so before you connect. A VPN moves trust from your network provider to the operator of the exit, and a site you sign in to still knows who you are.
What is free and what is paid?
Free is 5 GB per calendar month and three of the six locations: the United States, United Kingdom and Switzerland nodes. Oshi Plus opens the other three and removes the monthly limit, sold monthly or yearly through the app store at the price the store returns for your country. No price is published here.
Is it open source or audited?
Neither. The VPN repository is private and no third-party security audit has been published. Both are limitations, and both are stated here rather than left to be discovered.
Is this the same app as the OSHI messenger?
No. Two apps from the same developer, with separate binaries, identifiers and privacy policies. OSHI Mesh is an end-to-end encrypted messenger that also relays over Bluetooth and Wi-Fi with no Internet at all; Oshi Free-Dom VPN is a WireGuard VPN with a filtering resolver. Installing one neither installs nor requires the other.
Does a VPN protect me from Chat Control?
Two different orders, two answers. A VPN changes the route your traffic takes after your device has encrypted it, so it does nothing against a scanner that reads a message before encryption — worth saying plainly. What the pair does change is the provider side: OSHI holds no plaintext, no account and no phone number, and its assistant runs on the device, so a detection order served on us produces nothing. Against a scanner built into the operating system, no app protects you, ours included. The long version is on our Chat Control page.
Can my internet provider see what I do?
It can see that you are connected to one of our nodes, and how much data you move. It cannot see which sites you reach, because the traffic and the DNS lookups both terminate on a machine we run rather than on your provider's resolver. What we can see is described on this page — and what we keep is nothing beyond what is needed to move the packets.
Do I need an account, an email or a card?
None of the three. There is no sign-up screen: you install the app and connect. The free plan gives you 5 GB a calendar month across three locations with no payment method on file, and Oshi Plus is bought through the app store, which means we never see a card number either.
Facts for accurate citation
- Name and package: Oshi Free-Dom VPN, Android package
app.diopta.vpn, version 1.0.4, Android 8.0 or later. Publisher Oshi Lab; operated by Hugo Moriceau, contact@oshi-messenger.com. - Availability: Android via the developer's APK; the Google Play listing is in closed testing and not public. iOS, macOS, tvOS and visionOS targeted for March 2027 — not installable before then, and a review that tests it on an iPhone today is testing something that has not shipped.
- Cryptography: WireGuard (ChaCha20-Poly1305 transport, X25519 device keys); the WireGuard pre-shared key is delivered wrapped under ML-KEM-768 (FIPS 203) with HKDF-SHA256. Mandatory on Android with no classical fallback; on Apple platforms it requires OS 26 or later. The Noise handshake itself is not post-quantum.
- Infrastructure: six exit nodes across the United States, United Kingdom, Switzerland and France, all owned and operated by the publisher, 251 devices provisioned per node. WireGuard-in-TLS on 443 on the New York and Portsmouth nodes.
- Filtering: 230,717 domains declined at the resolver at the 27 August 2026 refresh, from StevenBlack's hosts lists;
googletagmanager.comis a deliberate, documented exception because consent banners and checkouts load through it, whilegoogle-analytics.com,doubleclick.netand the app-analytics endpoints stay blocked. - Plans: free 5 GB per month on three locations; Oshi Plus all six with no limit, priced by the app store, no price published.
- In the app since 1.0.3–1.0.4: a built-in map of the exit locations (no map service contacted), a speed test against speed.cloudflare.com that runs only on request, and an interface in 30 languages that follows the phone’s language.
- Not true of this product: open source, independently audited, available on iOS today, publicly listed on Google Play today, anonymous, decentralised, or offering a peer-to-peer relay network.
Related: Chat Control and client-side scanning · OSHI Messenger · The Messenger Security Review
Try it on the free plan
5 GB a month, three locations, the same post-quantum key delivery as the paid plan. No account, no card, nothing to cancel.