ES · cipherlan.net US · us.cipherlan.net Self-hosted · coming soon

CIPHERLAN

Decentralized, secure, and easy-to-use Virtual Private Network. State-of-the-art WireGuard encryption, blind relay, and temporary rooms with 4-character codes.

Download for Windows / Linux View architecture →
LAUNCH PROMO
The first 50 to use the license LIC-5CVCTS4HOI47KTD1W9K2 will get Organizations for free. (Only available in the Beta version).
WireGuardcryptographic engine
4-charroom codes
ES / USofficial servers
01 / Manifesto

A Cloud LAN built differently.

Not an opaque tunnel to a corporate server. A fully end-to-end encrypted network.

CipherLAN is a modern virtual private network solution that allows users to create and join secure networks via temporary rooms or permanent rooms within organizations.

Unlike traditional VPNs, it is designed to be decentralized, easy to use, and ultra-fast, using WireGuard as the underlying cryptographic engine.

No intermediate servers inspecting your traffic. No middlemen. Just you, your devices, and end-to-end encryption.

encryption is not a feature — it is the foundation.
02 / Architecture

Three components. One encrypted tunnel.

CipherLAN separates the interface, network logic, and cryptographic engine into three independent processes collaborating via HTTP and UDP.

[01] DESKTOP
Desktop App
Go + Wails v2

Cross-platform GUI for Windows and Linux. Web rendering with pure HTML/CSS/JS, no heavy frameworks. Professional dark theme.

[02] BACKEND
Blind Server
Python + FastAPI

REST server, authentication, room and organization management. Acts as a UDP relay forwarding encrypted packets without decrypting them.

[03] DAEMON
Network Engine
Go + WireGuard

Background service that configures TUN/TAP interfaces, manages connections, and maintains encrypted tunnels with persistent keepalive.

CLIENT A
Client Host
10.99.0.1
has private key
CLIENT B
Client
10.99.0.2
has private key
CLIENT C
Client
10.99.0.3
has private key
CIPHERLAN SERVER
Blind Relay UDP
NO DECRYPT · NO LOG · NO KEYS
The server relays UDP packets between multiple clients, but does not possess the private keys to decrypt the content. It only sees routing metadata.
03 / Features

Twelve details that matter.

Each is designed for one thing: ensuring encryption happens without you thinking about it.

01
WireGuard Encryption
State-of-the-art encryption with ChaCha20, Poly1305, and Curve25519 key exchange.
chacha20 / poly1305
02
Blind Server
The server acts as a UDP relay. It cannot inspect or decrypt your traffic because it travels end-to-end encrypted between devices.
no decrypt · no log
03
Centralized UDP Relay
Automatic and ultra-fast packet forwarding via the blind relay to guarantee client connectivity.
udp relay
04
4-character codes
Temporary rooms with codes like XK42. Easy to share verbally, hard to guess.
[A-Z0-9]{4}
05
Native cross-platform
Native app for Windows and Linux using Wails v2. No Electron, no browser overhead.
win / linux
06
OAuth Social
Sign in with Google, Microsoft, and GitHub. Verification against each provider's official endpoints.
google / ms / github
07
Real-time events
Smart polling with SSE updates. Instant detection of room changes.
sse · realtime
08
Auto-reconnection
Maintains the assigned virtual IP after disconnections. Room closes only if host leaves or TTL expires.
auto reconnect
09
Multi-server
Official server in Spain and USA. Support for custom servers and, coming soon, self-hosted.
es / us / custom
10
Enterprise Mode
Organizations with owner/admin/member roles, sections, stable slugs, and internal control and audit panels.
owner / admin / member
11
Permanent rooms
Reusable slugs within organizations. Members join without needing temporary codes.
/slug
12
Service daemon
Go background service managing WireGuard, TUN interfaces, and routing without user intervention.
systemd / wintun
04 / Connection Flow

From click to encrypted tunnel.

From the moment the user opens the app until the WireGuard tunnel is active, less than two seconds pass. Here is the internal pipeline.

average time: ~2s
[FASE 01]

Identity & Keys

01Authentication
→ POST /auth/login 200 OK session_token · long-lived
02WireGuard key generation
→ wg genkey > private.key → wg pubkey < private.key
03Public IP detection
→ GET api.ipify.org 200 OK 203.0.113.42
[FASE 02]

Room Negotiation

04Host: create room
→ POST /crear 200 OK code: "XK42" · ip: 10.99.0.1
05Client: join room
→ POST /unirse/XK42 200 OK virtual_ip: 10.99.0.2
06Local daemon activation
→ daemon start · bg service 200 OK daemon listening
07UDP HELLO to blind relay
→ UDP relay · routing only payload: CipherLAN_HELLO + HMAC token
[FASE 03]

Active Tunnel

08WireGuard setup
→ wg set cipherlan0 peer: <pubkey> · ip: 10.99.0.0/24
09State polling
→ GET /estado/XK42 SSE: user_joined · user_left
10Active session
● TUNNEL UP · keepalive until: host closes · ttl expires
05 / Enterprise Mode

Organizations. Roles. Permanent rooms.

A complete system for teams and businesses: owners, admins, and members, with stable rooms and department sections.

Acme Corp
@acme-corp
OWNER
/desarrollo
standup-diario4 online
code-review2 online
/ventas
demo-clientes7 online
/direccion
reunion-mensual3 online
estrategia-q4closed
Action
Owner
Admin
Member
Create organization
✓
—
—
Create / edit rooms
✓
✓
—
Create / edit sections
✓
✓
—
View invite code
✓
✓
—
Change roles
✓
partial
—
Kick members
✓
partial
—
Regenerate code
✓
—
—
Delete organization
✓
—
—
Join rooms
✓
✓
✓
OPTIONAL CONTROL
Although the default architecture is a blind server, organizations requiring it can activate greater control and internal visibility capabilities. This allows admins to audit traffic and manage corporate network policies, without compromising the default privacy of individual users.
Organization Activity
LIVE FEED · ADMIN VIEW
[02:58:13]JOINEDUSER sales.eu@acme joined /q4-strategy
[02:58:10]JOINEDUSER admin.sys@acme joined /it-support
[02:58:08]INVITEDNew member admin.sys@acme invited to organization
[02:58:05]LEFTUSER contractor@acme left /global-sync
[02:58:03]INVITEDNew member dev.lead@acme invited to organization
License token
LIC-XXXX…
format: prefijo + checksum
issuance: verificada por el backend
usage: crear organización
revocable: sí
ENTERPRISE CONTACT

Want to deploy CipherLAN in your infrastructure or need enterprise roles for your team? Contact us directly.

cipherlan.network@gmail.com
06 / Self-Hosted

Your infrastructure. Your sovereignty.

Coming soon, organizations will be able to deploy CipherLAN on their own infrastructure. Same API, same encryption, same protocol — without leaving your perimeter.

AVAILABLE
[01]
Official Server

Managed by us. No infrastructure to maintain, no devops, no worries. Connect and use.

España · cipherlan.net
EE.UU. · us.cipherlan.net
Automatic maintenance and updates
Guaranteed high availability
No hardware control
COMING SOON
[02]
Self-Hosted

Deploy the CipherLAN backend on your own server. Data sovereignty, full version and policy control, no outbound connections to third parties.

Deploy on your infrastructure
Total data sovereignty
Version and policy control
Compatible with existing desktop app
Requires server maintenance
in development · same protocol, same encryption, same daemon — only where the backend runs changes
07 / Security

Verifiable cryptography. No magic.

Every cryptographic primitive is documented. No magic, just math.

WireGuard Tunnel
transport
ChaCha20 · Poly1305 · Curve25519
Asymmetric keys per user · Persistent keepalive
cipher: chacha20
mac: poly1305
kex: curve25519
Password Hashing
auth
PBKDF2-SHA256
Hundreds of thousands of iterations · random salt
algo: pbkdf2
hash: sha256
salt: random
Session Token
session
HMAC-SHA256
Long-lived expiration · automatic rotation
sign: hmac-sha256
ttl: long-lived
rotate: auto
Blind UDP Relay
network
Blind server · no keys to decrypt
HMAC token signed in HELLO packet
proto: udp
mode: blind
token: hmac
Rate Limiting
Adaptive limits per endpoint to prevent abuse and brute force attacks.
CORS Estricto
Authorized origins only. No wildcards.
Trusted Host
Host header validation on every incoming request.
API Secret Key
All requests must include the secret key in headers.
Version Check
Old clients receive automatic upgrade required error.
Room limits
Per-IP, global, and per-room user limits to prevent abuse.
08 / Tech Stack

Tools chosen for performance.

Each piece is chosen because it is the best in its class for its specific task.

Go
1.26+
App backend and daemon
Wails
v2
Native desktop bridge
Python
3.8+
API server and relay
FastAPI
0.113+
Async REST framework
WireGuard
✓
Cloud LAN and crypto engine
SQLAlchemy
async
ORM with SQLite
Slowapi
✓
Rate limiting
HTML/CSS/JS
ES6+
Frontend without frameworks
09 / Download

Connect your first room
in less than five minutes.

Download the installer for your system. Create an account. Generate a code. Share it. You are inside an encrypted tunnel.

Windows
v1.0.0
Notice: No EV code-signing certificate. Windows SmartScreen will show warnings. Click "More info" → "Run anyway". The app is 100% safe.
Download for Windows
Linux
v1.0.0
Download for Linux
Windows (Beta)
v1.1.0-dev
Notice: Active development build. May be unstable and contain bugs. Use for testing purposes only.
Download Windows Beta
Linux (Beta)
v1.1.0-dev
Notice: Active development build. May be unstable and contain bugs. Use for testing purposes only.
Download Linux Beta
Instrucciones para Linux
# 1. Extraer el archivo descargado
$ unzip CipherLAN_Linux.zip && cd CipherLAN_Linux

# 2. Dar permisos e instalar (ver README para más opciones)
$ chmod +x install.sh
$ sudo ./install.sh
ES · España
cipherlan.net
US · EE.UU.
us.cipherlan.net
CUSTOM · Your server
configurable