Pevnost

VPN for Android without Google Play: APK, hash check, installation.

Blog · 19 October 2026 · 5 min

State of things on 19 October 2026: Pevnost is in private beta. The first server, prg1 in Hluboká nad Vltavou (WEDOS data centre), has been live since 18 October; a first short test measured around 300 Mbit/s. Every new account gets two free hours (one trial per connection, one device), then 120 CZK / €5 for 30 days or 1 200 CZK / €50 a year. Pay with Bitcoin on-chain (preferred), by card through Stripe or by bank transfer; Lightning is planned and Monero is coming. Windows app 0.3.1 beta, Android app 0.1.0 beta. Last reviewed 19 October 2026.

Our Android app is not in Google Play or any other store yet, so to use a VPN on Android without Google Play you install our APK directly. This guide covers download, verifying the SHA-256 hash, installation, safe updates, and the alternative if you would rather not run an early beta.

What you are installing

Pevnost 0.1.0 beta for Android, about 20 MB, Android 8.0 (API 26) or newer. It is written in Kotlin on top of the official WireGuard Android library. It signs in with your account ID or creates an account, generates the device key on the phone and registers only the public half, checks our signature on the server list, and runs the tunnel through Android’s VPN service with our DNS inside. No analytics, no crash reporting, no third-party SDKs; the only server it talks to is app.pevnost.net. It is an early beta that we have not yet run on a real device; expect rough edges and tell us what breaks. Source code follows with the first paid release.

1. Download on a computer

Get Pevnost-0.1.0-beta-android.apk from the Apps page. Downloading on a computer makes checking the hash easy.

2. Verify the SHA-256

The expected value, also in /dl/SHA256SUMS:

a936aa497fe08e76581b4fbbc59796181cb568e3c1163a8729ca3f1569a47b67
# Windows (PowerShell)
Get-FileHash .\Pevnost-0.1.0-beta-android.apk -Algorithm SHA256
# Windows (cmd)
certutil -hashfile Pevnost-0.1.0-beta-android.apk SHA256
# Linux
sha256sum Pevnost-0.1.0-beta-android.apk
sha256sum --ignore-missing -c SHA256SUMS     # with SHA256SUMS in the same folder
# macOS
shasum -a 256 Pevnost-0.1.0-beta-android.apk

The output must match character for character. If it does not, delete the file and write to security@pevnost.net. What the hash proves: the file is the one we published, not a damaged download or a modified copy passed on through a chat or a mirror. What it cannot prove: if someone controlled our website, they could change the file and the hash together. That is where the signature comes in.

3. The signature carries updates

Every release is signed with our release key, and Android installs an update over an existing app only if it carries the same signature. Once you have a verified copy installed, a forged “update” signed by someone else is refused. If an update ever fails with a conflict with the existing package, do not uninstall and reinstall; check the hash and write to us. With the Android SDK you can print the signing certificate with apksigner verify --print-certs, note the SHA-256 digest, and compare it with the next release. The app does not update itself; new versions appear on the Apps page with a new hash.

4. Install

  1. Copy the APK to the phone, for example over USB, and open it in the Files app.
  2. Android asks you to allow Install unknown apps for that app (under Settings → Apps → Special app access; names vary by manufacturer). Allow it.
  3. Google Play Protect may warn about an app from an unknown developer. If the hash matched, choose to install anyway.
  4. Afterwards, switch the permission off again.

Google has announced developer verification for apps installed outside Google Play, phased in from 2026 and starting outside the EU. We will say on the Apps page if it affects installing our APK.

5. First run

Create an account or enter your account ID; the app makes the key on the phone. Android asks once to allow a VPN connection. Then turn on the system kill switch: Settings → Network & internet → VPN → gear next to Pevnost → Always-on VPN and Block connections without VPN (why). Finish with the leak test.

The app uses no Google services, so it should run on phones without Google Play services, such as GrapheneOS or LineageOS. We have not tested that yet; reports welcome.

The alternative: official WireGuard

If you would rather not run an early beta, install the official WireGuard app from F-Droid or Google Play and import the configuration from your account page as a file or QR code. It is mature and open source; you manage device keys on the account page instead of in an app. The setup guide has the steps.