Download GhostShield VPN

Free for Windows 10/11, Android 8.0+, and macOS 12+. iOS app in development — current iOS users connect via the official WireGuard app with a GhostShield config.

Windows

Windows 10 (build 19044+) and Windows 11. ~7 MB installer. Signed by GhostShield Ltd.

Download for Windows

Android

Android 8.0 (API 26) and later. ~12 MB APK. Available on Google Play and direct APK.

Download for Android

macOS

macOS 12.0 and later. Signed .pkg installer for Apple Silicon and Intel.

Download for macOS

Quick answer

Install takes under 60 seconds. Windows: download the signed installer, double-click, click through the UAC prompt, sign in. Android: install from Google Play or sideload the APK, grant the VPN permission once, sign in. iOS and macOS: install the official WireGuard app, scan the QR code from your GhostShield dashboard, activate the tunnel.

Windows install — step by step

System requirements

  • Windows 10 (build 19044 or later) or Windows 11.
  • x86-64 architecture (Intel/AMD 64-bit). ARM64 build coming Q3 2026.
  • Administrative privileges for the initial install (to register the VPN network adapter).
  • ~50 MB free disk after install.

Install steps

  1. Click Download for Windows. The signed .exe (~7 MB) downloads.
  2. Double-click GhostShield-Setup.exe. Windows SmartScreen may show a warning the first time; click “More info” → “Run anyway.” The signature is verifiable — see the SHA-256 hash and code-signing certificate below.
  3. The installer prompts for User Account Control (UAC). Click “Yes” — this is required to install the WireGuard network driver.
  4. Choose install location (default: C:\Program Files\GhostShield VPN). Click Next.
  5. Wait ~10 seconds for the install to complete. The app launches automatically.
  6. Sign in with your GhostShield account email and password (or sign up if you do not have one).
  7. Click any server in the list. The tunnel comes up within 2-3 seconds.

Verifying the installer

For users who want to confirm the installer is unmodified:

  • SHA-256: Published in the release notes on GitHub before every release. Verify with PowerShell: Get-FileHash GhostShield-Setup.exe -Algorithm SHA256
  • Code signature: Right-click the .exe → Properties → Digital Signatures. The certificate should read “GhostShield Ltd” with a valid Sectigo / DigiCert chain.

Android install — step by step

System requirements

  • Android 8.0 (API level 26) or later.
  • ~30 MB free storage.
  • For sideloaded APK: “Install unknown apps” permission for your browser or file manager.

Install from Google Play

  1. Open Google Play and search for “GhostShield VPN.”
  2. Tap Install. ~12 MB.
  3. Open the app. Sign in or sign up.
  4. Tap Connect. Android prompts for VPN permission — tap Allow. This permission is granted once.
  5. The tunnel is active. The Android system shows a small key icon in the status bar.

Sideload the APK

Recommended in regions where Google Play is restricted (China, parts of Russia, Iran):

  1. Download the APK from /api/download/apk.
  2. Tap the downloaded file. If Android blocks the install, go to Settings → Apps & notifications → Special app access → Install unknown apps, and grant permission to your browser or file manager.
  3. Install completes in ~5 seconds.
  4. Open the app, sign in, tap Connect, grant the VPN permission.

iOS — connect via WireGuard app (until native app ships Q3 2026)

Apple does not allow third-party VPN apps that handle their own WireGuard configurations without going through MDM enrolment, so until our native iOS app passes App Store review (target Q3 2026), iOS users connect via the official WireGuard app:

  1. Install WireGuard from the App Store (free, by WireGuard LLC).
  2. Sign in to your GhostShield dashboard from any browser.
  3. Go to Devices → Add iOS device. Pick a server location.
  4. A QR code appears containing the WireGuard configuration.
  5. In the WireGuard app, tap + → Create from QR code. Scan the code.
  6. Toggle the new configuration on. iOS prompts for VPN permission once.

The same configuration works for as long as the subscription is active. Switching server locations requires generating a new QR code.

macOS — connect via WireGuard app (until native app ships Q3 2026)

Same approach as iOS. Install the WireGuard app from the Mac App Store, import the configuration from your dashboard, toggle on. Works on macOS 12 (Monterey) and later, both Intel and Apple Silicon.

Linux — WireGuard config files

Linux users connect via the standard wg-quick tooling. Download the .conf file from the dashboard, drop it in /etc/wireguard/, run sudo wg-quick up ghostshield. Auto-start at boot via systemctl enable wg-quick@ghostshield.

Routers — OpenWrt and stock firmware

Compatible routers running OpenWrt (or any firmware with WireGuard support) can be configured with a GhostShield WireGuard endpoint. Every device on the router's LAN then routes through the VPN. Detailed setup guides for Asus, GL.iNet, OpenWrt, and pfSense are at /learn/wireguard-vs-openvpn.

Troubleshooting common install errors

Windows: “The installer cannot install the network adapter”

Caused by conflicting VPN software (typically an old OpenVPN or NordVPN installation). Uninstall the conflicting VPN, reboot, then retry GhostShield's install.

Android: “App not installed” on sideloaded APK

Usually means an existing GhostShield install has a different signing certificate. Uninstall the existing version (Settings → Apps → GhostShield → Uninstall), then retry.

iOS: WireGuard says “Configuration is invalid”

The QR code may have expired (dashboard QR codes expire after 24 hours for security). Regenerate from the dashboard.

macOS: VPN won't turn on after install

macOS may require explicit permission for the WireGuard system extension. Open System Settings → Privacy & Security, scroll down, click “Allow” next to the WireGuard system extension entry.

Uninstalling

Windows: Settings → Apps → GhostShield VPN → Uninstall. The uninstaller removes the binary, the WireGuard network adapter, and the kill-switch firewall rules.

Android: Settings → Apps → GhostShield → Uninstall.

iOS/macOS WireGuard configurations are removed by deleting the configuration in the WireGuard app, then revoking the device in the GhostShield dashboard.

What gets installed

The Windows installer adds:

  • The GhostShield application binary (~25 MB on disk).
  • A WireGuard network adapter (a virtual NIC).
  • Two Windows Filtering Platform (WFP) firewall callouts (kill switch).
  • A Start Menu shortcut.

The installer does NOT add: browser extensions, telemetry agents, persistent background services beyond the WireGuard tunnel manager, or third-party libraries that phone home.