boringtun

Free allowance: No service and no account; a Rust library and the boringtun-cli binary
Verdict: self-hosted, last resortverdict fails-egress: data cannot be read back out at a usable rate or price. Self-hosted options are listed last, because this site is for users who have no hardware.
Cost: not statedsee Price below
Identity: anonymousno card, no phone
Binding limit: noneno named constraint binds
Evidence: documented4 sources; a first-party page was read and the sentence quoted
Freshness: stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23

Free tier	no service and no account; a Rust library and the boringtun-cli binary unit none; metered on none
Price	USD 0
Binding	none boringtun adds no path of its own: it encrypts and decapsulates over UDP exactly as the protocol specifies, so a UDP block stops it
Identity	anonymous no account
Egress	not applicable; the software states no volume; ingress: none free allowance: none published
Interface	cli boringtun-cli, cargo, crates.io
Tooling	cargo install boringtun-cli; Rust library for embedding
Composes with	sits under a WARP client or under a wrapper; it composes with cloudflare-warp and adds nothing to a hosted tunnel by itself.
Reliability	README warns the master branch is mid-restructure; use the crates.io releases
Notes	Included because brief names it, and because the distinction matters: it is a WireGuard implementation, not a transport wrapper. It cannot carry a datagram across a network that drops UDP, and the library half has no network stack to do it with. Its practical role in this topic is as the engine inside WARP clients, which is where the .conf from wgcf ends up on a mobile device.
Evidence note	documented the verdict is about egress, not quality: boringtun is load-bearing inside the official Cloudflare WARP apps, and is the substrate a wrapper needs
Parsed numbers	price USD 0

Evidence 4

date	source	what it proved
2026-10-23	github.com/cloudflare/boringtun	"an implementation of the WireGuard protocol designed for portability and speed", deployed on millions of iOS and Android consumer devices
2026-10-23	github.com/cloudflare/boringtun	"It implements the underlying WireGuard protocol, without the network or tunnel stacks" - the library half does no I/O at all
2026-10-23	github.com/cloudflare/boringtun	release boringtun-cli-0.5.2 published 2022-07-20; last push 2026-06-29; 7230 stars
2026-10-23	github.com/cloudflare/boringtun	"Boringtun is currently undergoing a restructuring. You should probably not rely on or link to the master branch right now"

More fields 9

wg path	native-conf
wg detail	boringtun-cli is a userspace WireGuard executable that takes the standard interface configuration, so a normal .conf drives it
ingress	none
volume stated	not applicable; the software states no volume
bytes transit	yes
transit note	carries a user's own traffic to whatever peer it is configured against
hosting requirement	none beyond the device, but no far end either: it needs a WireGuard peer and speaks only UDP to it
last release	boringtun-cli-0.5.2 2022-07-20
stars	7230

Unknown values 2