Private Internet Access is the world's leading consumer VPN service. At Private Internet Access we believe in unfettered access for all, and as a firm supporter of the open source ecosystem we have made the decision to open source our VPN clients. For more information about the PIA service, please visit our website privateinternetaccess.com or check out the Wiki.

With the Private Internet Access VPN app for iOS and tvOS, you can access our network of VPN servers across the world from your iPhone, iPad, iPod touch, or Apple TV. Choose among many available countries and connect easily. Features include kill switch, multiple VPN protocols, DNS/IPv6 leak protection and ad-blocking.

• Plenty of countries to connect to
• OpenVPN and WireGuard VPN protocols, with automatic protocol selection
• Kill switch
• Fine-grained VPN settings
• DNS leak protection
• IPv6 leak protection
• Safari Content Blocker (iOS only)
• Dark theme
• Hotspot Helper (iOS only)
• tvOS support

• iOS 15.0+ / tvOS 17.0+
• Xcode 26+
• Homebrew
• SwiftGen (brew install swiftgen)
• Go (brew install go, required to build WireGuard-Go in the vendored Kape Platform SDK)
• Ruby with rbenv (recommended)
• Bundler (gem install bundler && bundle install)
• A Cloudsmith entitlement token to pull the Kape Platform SDK (see Kape Platform SDK)

# Install system dependencies
brew install swiftgen go

# Install Ruby dependencies
gem install bundler && bundle install

# Pull the Kape Platform SDK (required before building — see below)
CLOUDSMITH_TOKEN=<your-token> ./scripts/pull-kape-platform-sdk.sh

The VPN packet-tunnel engine is provided by the Kape Platform SDK, a Swift package that is not committed to this repository. It is pulled from a private Cloudsmith registry into LocalPackages/KapePlatformSDK/ (gitignored) by scripts/pull-kape-platform-sdk.sh, and pinned to a specific version in scripts/kape-platform-sdk.version with its archive SHA-256 pinned in scripts/kape-platform-sdk.checksum.

Because PIALibrary (consumed by nearly every target) depends on this package, no target will resolve Swift packages or build until the SDK has been pulled. A clean checkout that skips this step fails with an opaque "missing local package" SPM error.

You need a Cloudsmith entitlement token with read access to the SDK repository. The script resolves the token in this order:

1. CLOUDSMITH_TOKEN environment variable
2. CLOUDSMITH_API_KEY environment variable
3. A .cloudsmith file in the repo root (gitignored, containing just the token)

# Using an environment variable
CLOUDSMITH_TOKEN=<your-token> ./scripts/pull-kape-platform-sdk.sh

# Or, with a .cloudsmith file present in the repo root
./scripts/pull-kape-platform-sdk.sh

The script downloads the pinned version, verifies its SHA-256 against the committed checksum pin, and unpacks it into LocalPackages/KapePlatformSDK/. Verification is mandatory — an archive that fails or lacks a checksum is never installed. It is idempotent — re-running it when the pinned version is already installed is a no-op.

Open the workspace in Xcode (or run xcodebuild / fastlane) and let SwiftPM resolve.

CI: the same pull runs automatically before the build — ci_scripts/ci_post_clone.sh for Xcode Cloud and the GitHub Actions workflows. CLOUDSMITH_TOKEN must be configured as a secret environment variable there.

# Fetch the latest version from the registry, update the version and checksum pins, then pull
CLOUDSMITH_TOKEN=<your-token> ./scripts/pull-kape-platform-sdk.sh --update

The project uses three build configurations, each with iOS and tvOS variants:

# Unit tests
bundle exec fastlane iOStests
bundle exec fastlane tvOStests

We use a special entitlement to participate in the process of joining Wi-Fi/hotspot networks (https://developer.apple.com/documentation/networkextension/nehotspothelper).

You need to request this entitlement from Apple, or remove the call to configureHotspotHelper() in AppDelegate.swift and adapt the entitlements file to your needs.

To maintain consistency across developers, we use swift-format. The default formatting rules are defined in the .swift-format file. A pre-commit hook is available that automatically formats staged Swift files and blocks the commit if any changes are needed. To install it, run from the repo root:

ln -s ../../Tools/hooks/pre-commit .git/hooks/pre-commit

By contributing to this project you are agreeing to the terms stated in the Contributor License Agreement (CLA) here.

For more details please see CONTRIBUTING.

Issues and Pull Requests should use these templates: ISSUE and PULL REQUEST.

This project is licensed under the MIT (Expat) license, which can be found here.