What is boringtun?

cloudflare/boringtun — explained in plain English

Analysis updated 2026-06-22

★ 7,047RustAudience · developerComplexity · 4/5LicenseSetup · moderate

Mindmap

mindmap
  root((repo))
    What it does
      WireGuard VPN protocol
      Userspace implementation
    Platforms
      Linux macOS Windows
      iOS Android
    Bindings
      C C++ Swift
      Java C#
    Usage
      CLI tunnel creation
      Library embedding

mindmap root((repo)) What it does WireGuard VPN protocol Userspace implementation Platforms Linux macOS Windows iOS Android Bindings C C++ Swift Java C# Usage CLI tunnel creation Library embedding

Click or tap to explore — scroll the page freely

What do people build with it?

USE CASE 1

Create WireGuard VPN tunnels on Linux or macOS using the boringtun-cli command-line tool.

USE CASE 2

Embed WireGuard support into an iOS or Android app using the library and its language bindings.

USE CASE 3

Use existing WireGuard config files and management scripts with BoringTun without modification.

What is it built with?

RustWireGuardCC++SwiftJava

How does it compare?

	cloudflare/boringtun	prefix-dev/pixi	mullvad/mullvadvpn-app
Stars	7,047	7,045	7,078
Language	Rust	Rust	Rust
Setup difficulty	moderate	easy	hard
Complexity	4/5	2/5	5/5
Audience	developer	developer	developer

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 30min

The master branch is being restructured, use the stable release from crates.io instead.

Use freely in any project including commercial ones as long as you keep the copyright notice and license text (3-Clause BSD).

So what is it?

BoringTun is Cloudflare's implementation of the WireGuard protocol, written in Rust. WireGuard is a modern VPN (virtual private network) protocol known for being fast and relatively simple compared to older VPN technologies. BoringTun is specifically a userspace implementation, meaning it runs as a normal program rather than inside the operating system's kernel, which makes it portable across different platforms. The project comes in two forms. The first is a command-line tool called boringtun-cli that creates WireGuard tunnels on Linux and macOS. The second is a library that other applications can include to add WireGuard support, and it is designed to work on mobile platforms. Cloudflare uses this library in its 1.1.1.1 apps on iOS and Android, and the README states it runs on millions of consumer devices and thousands of Cloudflare servers. The library supports a wide range of platforms: standard 64-bit and ARM Linux, macOS, Windows (library only), iOS, and Android. It exposes bindings for C, C++, Swift, C#, and Java, so it can be integrated into apps written in those languages without needing to call it from Rust directly. Installation as a command-line tool is done through Cargo, the Rust package manager, with a single command. Running a tunnel follows the same configuration interface as standard WireGuard tools, so existing WireGuard configurations and management scripts work without changes. The README notes the project is currently being restructured and the master branch should not be relied on directly. The stable release is available through crates.io, Rust's package registry. The project is released under the 3-Clause BSD License.

Copy-paste prompts

Prompt 1

How do I install boringtun-cli via Cargo and create a WireGuard tunnel on Linux? Show me the full setup steps.

Prompt 2

How do I add boringtun as a library dependency in an Android app written in Java to support WireGuard tunnels?

Prompt 3

Show me how to configure boringtun-cli using the same WireGuard config file format used by the standard wg-quick tool.

Prompt 4

What platforms does boringtun support and how do I build it for iOS to embed WireGuard in a Swift app?

Frequently asked questions