Features
Protection you can account for.
Each feature below is something the service actually does. Plan gates are enforced by the API, and a simulated server is never offered as a tunnel.
WireGuard
Keys stay on the device
Quick Connect
A scored server choice
Kill switch
Plus and above
DNS protection
Standard, malware, or tracker DNS
Split tunneling
Choose which apps use the tunnel
Create an account and connect a device.
The device keeps its private key. The API assigns a server that is actually online.