--- title: "How WrapVPN works: from tapping Connect to a private connection" description: "Follow one tap of Connect: signing in, choosing a location, the encrypted WireGuard tunnel, the exit server, Clean Web and what we keep." section: "Guides" group: "How the technology works" source: https://wrapvpn.com/en/guides/how-wrapvpn-works last_reviewed: 2026-11-01 --- # How WrapVPN works: from tapping Connect to a private connection You tap Connect, and a moment later your phone says you're protected. It's fair to ask what actually changed in that moment, and who can see what afterwards. TL;DR: You sign in once with Apple or Google and pick a server location. When you tap Connect, our server gives your app a configuration for that location, your device builds an encrypted WireGuard tunnel to the exit server, and the exit server fetches websites on your behalf. With Clean Web on, lookups for known ad and tracking domains are refused before those connections can start. ## Before the first tap: signing in without a password We'll follow one example all the way through. It's a weekday morning, you're in a café in London with your phone on the café's Wi-Fi, and you want to read the news without everyone else on that network being able to watch you do it. The story starts a little earlier, though, on the day you installed the app. WrapVPN has no passwords of its own. You sign in with Apple or Google, who are already good at checking that you're you. They hand the app a signed token, and the app passes that token to our server. Our server checks that the token is genuine and current, then finds your WrapVPN account or creates one, matching first by your Apple or Google ID and then by email address. We never see your Apple or Google password, and if you use Apple's Hide My Email, we receive a private relay address instead of your real one. Everything else hangs off that account: your plan, your free sessions and every device you sign in on. Use the same sign-in on each device, because an Apple sign-in that hides your email can create a separate account from a Google one. ## Choosing where your traffic comes out Next you pick a server location, such as London, Frankfurt, Madrid, Singapore or Tokyo. That's where your traffic will leave our network and carry on to the rest of the internet, so it's also where websites will think you are. On iPhone, iPad, Android and Windows, each location in the app shows a speed figure, and a lower figure is faster. The figure mostly reflects distance. Every message between your phone and the exit server makes the journey there and back, and a trip across town is quicker than one across an ocean. In the café, the sensible choice is London. Sending the tunnel further away doesn't make it any more private; it only makes it slower. A distant location earns its place when you need websites to see you in that country. ## What happens when you tap Connect Now the tap itself. The app asks our server for a configuration for London, and the server first checks that your account can connect: either you have a weekly or monthly plan, or you have a free session left this week. On the free plan that's one of three one-hour sessions, and the hour runs from this moment even if you disconnect early. If all is well, our server tells the London exit server to expect your device's key and sends your app a short configuration that includes which exit server to talk to, the public key that proves it really is that server, and your device's address inside the tunnel. Once, early on, your device asks you to approve WrapVPN as a VPN. That prompt comes from the operating system rather than from us. No app is allowed to reroute your traffic until you've agreed, and you aren't asked again on every connection. A quick word on keys, since everything from here relies on them. Each key comes in two halves: a private half that stays secret and a public half that can be shared freely. A message made with the private half can be checked by anyone holding the public half, which is how two machines that have never met can be sure they're talking to the right one. Now your phone and the exit server introduce themselves. Your phone sends one message that only the holder of its private key could have written, and the exit server checks it against the public key it was told to expect and answers with one of its own. That single round trip is the whole handshake. It's WireGuard, the protocol at the heart of WrapVPN, doing what it's known for, and both sides now share fresh encryption keys that nobody else has. Because the tunnel is tied to your device's key rather than to the café's network, it isn't fragile. When you finish your coffee and your phone moves from the Wi-Fi to mobile data, the tunnel carries on and the replies follow you. ## The trip to the website and back Your browser asks for the news site's front page. Before that request leaves your phone, WrapVPN encrypts it and puts it inside a packet addressed to the London exit server. Think of a letter sealed inside a second envelope addressed to us. The café's Wi-Fi can see that envelopes are going to a WrapVPN server, and roughly how many, but not what's inside them or where they're ultimately going. The same is true for the café's internet provider and every other network along the way. At the exit server, the outer envelope comes off. The exit server sends your request on to the news site from its own address, collects the reply, encrypts it and sends it back down the tunnel. The news site sees the exit server's address, which everyone connected to that server shares, rather than yours. What the exit server could read depends on the site. Most websites and apps use HTTPS, which keeps the contents encrypted between your browser and the site, so the exit server forwards something it can't open. A site without HTTPS is different: its traffic can be read at the exit server, just as it could on any network it crosses after that. Running the exit servers puts us in a position to keep records, so here is what we keep: connection records (your account, the time, the server and how long the session lasted) and hourly usage summaries that include the amount of data and the addresses and domain names reached. Those can be linked to your account, and the privacy policy has the details. A VPN changes who is in a position to see your traffic, from the café and its provider to us; it doesn't make you anonymous. ## Where Clean Web steps in We skipped a step. Before your browser could ask for the front page, it had to look up the news site's address, much as you'd look up a name in a phone book. A news page rarely stops at one name, either: it loads photos from its own servers and scripts from advertising and analytics companies, each with a name of its own to look up. Those lookups travel through the tunnel too. With Clean Web on, the service answering them refuses the names of known advertising and tracking domains, replying that no such name exists. Your browser can't connect to a server it can't find, so those requests never start. The ad isn't downloaded, the tracker never hears about your visit, and your phone keeps the data and battery it would have spent. Clean Web judges by domain name alone. It can't remove ads served from the same domain as the article, it doesn't read pages, and it isn't antivirus. A browser set to use its own “secure DNS” sends its lookups around it. Clean Web is on by default on Android and off by default on iPhone, iPad and Mac; on Windows, check the switch. ## Putting it together So one tap sets off a short chain: an account that already knows you, a configuration for the location you chose, a one-round-trip handshake, and an exit server that fetches the web on your behalf, with Clean Web turning away ad and tracker lookups on the way. The best way to see it is to try it: install WrapVPN, sign in, and connect to the location nearest you. ## Questions ### Does WrapVPN make me anonymous? No. It hides your traffic from the network you're on and your address from the websites you visit, but we know your account and keep the connection records and usage summaries described above. If you need anonymity rather than privacy, use a tool designed for it. ### Can WrapVPN see the websites I visit? We can see which addresses and domain names are reached, and they're included in the hourly usage summaries we keep. We can't read the contents of pages and apps protected by HTTPS, which covers most of them, but traffic to a site without HTTPS can be read at the exit server. ### Do I have to sign in on every device? Yes, once on each device, using the same Apple or Google sign-in so they all share one account. No plan has a device limit; the Terms allow use within your household and forbid sharing the account beyond it. ### What happens when my phone switches from Wi-Fi to mobile data? The tunnel carries on. WireGuard recognises your device by its key rather than by the network it's on, so traffic arriving from the new network is accepted without a fresh sign-in or a new configuration. ### How does the free plan fit into this? Every account gets three one-hour sessions a week, checked when you tap Connect. Each hour runs from the moment the session starts, even if you disconnect, and the allowance resets every Monday at 00:00 UTC. Free sessions reach every server location. --- Source: https://wrapvpn.com/en/guides/how-wrapvpn-works Last reviewed: 2026-11-01