Apps.
Windows
Our own client, in the same design as this site, source to be published with the first paid release. It talks to the account API, keeps the server list only if our signature on it checks out, generates and rotates your device key, and runs the tunnel itself: the official WireGuard tunnel code (tunnel.dll, MIT) and the WireGuardNT driver (signed by WireGuard LLC) ship in the zip, so nothing else needs to be installed. While the tunnel is up, the kill switch blocks everything that would leave the machine outside it.
Download Pevnost 0.2.1 beta for Windows zip, 5.1 MB · 64‑bit
| Requires | Windows 10 or 11, 64‑bit. Nothing else: unzip the folder anywhere and keep the three files together. The app asks for administrator rights at start, because it installs the tunnel service and the network driver on first connect. |
|---|---|
| SHA‑256 | 533600882024dbc3ff94af56705b021c03a49e27ea8d7de032d5606c5ec47be7 |
| Signature | The binary is not code‑signed yet, so Windows SmartScreen will warn before the first run. Verify the hash instead, see below. Code signing comes with the first paid release. |
| Source | Published with the first paid release, together with reproducible build instructions. |
Verify the download
In PowerShell, in the folder where you saved the file:
Get-FileHash .\Pevnost-0.2.1-beta-windows-amd64.zip -Algorithm SHA256
The hash shown must match the SHA‑256 above, character for character. If it does not, delete the file and write to security@pevnost.net. The same hash is in /dl/SHA256SUMS.
What it does not do yet
- No installer: a zip with Pevnost.exe, tunnel.dll and wireguard.dll. Keep them anywhere together; the app state lives in your Windows profile, encrypted with DPAPI. Not yet tested on many machines: this is a beta, tell us what breaks.
- Needs administrator rights for the whole app. A split into a small service and a normal‑user window is planned.
- No automatic updates. New versions appear on this page with a new hash.
Every other platform
Use the official WireGuard app for macOS, iOS, Android and Linux. On the account page your browser generates a device key and gives you one configuration file (or a QR code for phones) to import. The private half of the key is made on your device and never sent to us.
Our own apps for macOS, iOS and Android are planned once the Windows beta has settled.