This free app isn't a VPN, but it encrypts everything my phone sends

Most privacy apps make their purpose pretty obvious. They offer a map full of server locations, a long list of features, and typically a monthly subscription tying your name to the service, anyway. I only use a VPN to get back onto my home network, so Cloudflare WARP really felt like a different sort of tool.

The free 1.1.1.1 app has no pretty map for picking a country and does not attempt to pretend my phone is somewhere else. I installed it on my aging Samsung Galaxy Note 20, routed the phone through my own infrastructure, and captured the traffic leaving it.

I’ve never been a huge fan of free VPN applications for multiple reasons, but Cloudflare’s WARP app might be the one I leave on. Here’s why I chose to stick with it.

Setting it up took one switch and one awkward Android prompt

Android made the whole thing sound far more dramatic than Cloudflare did

The Cloudflare WARP app can be found on Google Play (and the Apple Store). Searching for it using 1.1.1.1 alone brings up several similarly named apps, but the right one is “1.1.1.1 + WARP: Safer Internet” on the Google Play Store, and "1.1.1.1 + WARP: Faster Internet" on the Apple Store, from Cloudflare, Inc.

Installing it was easy enough, with no need to create or sign in to an account. After accepting the terms and conditions, I was greeted by a large toggle letting me know my internet is not private. That was the entire setup. No maps, no lists of countries, or promises that I was about to become anonymous.

I tapped the toggle switch and Android immediately interrupted me with a connection request to allow a VPN. That’s because Cloudflare WARP needs system-level traffic to collect from individual apps to place their connections through the encrypted tunnel. I accepted the connection, which was completed in seconds, and a small key icon appeared at the top of my phone.

The app indicated my phone was connected, and my internet was now private. I still wanted to know whether it had changed anything outside its own interface. Most of this work came afterward, when I started checking the connection and capturing what was actually leaving the phone.

WARP protected much more than my DNS queries

The app’s two similar-looking modes provide very different levels of protection

Cloudflare’s WARP app has two modes, and they’re easy to confuse because one is named 1.1.1.1 and the other is just “WARP.” In the 1.1.1.1 mode, Cloudflare only handles DNS queries. These lookups, which convert a friendly name like “makeuseof.com” into an IP address, are encrypted with DNS over HTTPS or DNS over TLS. In this mode, the rest of my phone’s traffic follows its normal route.

WARP goes way further. It catches the internet traffic from my apps, adds the DNS queries, and carries it all through Cloudflare’s global edge network. WARP connections generally use MASQUE, which carries encapsulated traffic over HTTP/3 and QUIC over UDP port 443.

The WARP encryption ends at Cloudflare’s network as it becomes unwrapped and forwarded to the rest of the internet. HTTPS from each app’s own encryption continues protecting the traffic and connection on the way to its final destination.

Encrypted DNS alone wasn’t especially tempting to me. Android already has private DNS, and my browser can use DNS over HTTPS. But WARP was far more useful because it meant I didn’t need to configure the browser, Play Store, weather app, and email all separately. They all shared the same protected route, which was confirmed using Cloudflare’s one.one.one.one help page showing both WARP and its DNS resolver were indeed active.

I checked the tunnel from outside the phone

The OpenWrt NUC showed traffic disappearing into one Cloudflare connection

The big orange Connected screen was reassuring, as were the results from Cloudflare’s own help pages. But I wanted to check what WARP was doing from outside my phone, using a device I owned and trusted.

I added another wireless network to my existing OpenWRT router and connected my Android phone to it. This meant that I could collect the packets flowing through the router as they headed out toward the rest of the internet.

The path was simple enough:

Starlink Wi-Fi -> OpenWRT router -> WARP-Test SSID -> My Galaxy Note 20

My Android received an address on the router’s 192.168.55.0/24 network. That placed OpenWRT between the phone and the wider internet, where it could observe packets crossing br-lan without modifying anything on the Samsung.

I started with Cloudflare’s own checks. Its trace page changed from warp=off to warp=on, while the one.one.one.one help page confirmed that both WARP and Cloudflare DNS were active. It was a little bit more reassuring than trusting the app, but ultimately it was just Cloudflare reporting on Cloudflare, and I needed more.

From an outside view, I captured the phone’s traffic directly:

tcpdump -ni br-lan host 192.168.55.248 -w /tmp/warp-on.pcap 

While tcpdump ran, I opened up a few random apps on my phone, like the weather app and email, and went down a few Wikipedia rabbit holes to generate traffic. I then copied that capture into the Wireshark packet analyzer and filtered it with:

ip.src == 192.168.55.248

The result was a large stream of UDP packets traveling from the phone to a Cloudflare tunnel endpoint. Wireshark could easily identify the outer transport, but the apps and requests had disappeared into WARP’s MASQUE tunnel over QUIC and UDP 443.

Unreadable packets are, of course, not mathematical proof of encryption alone. HTTPS traffic is already unreadable to someone snooping in the middle of a connection. However, the selected tunnel mode, Android’s active connection state, the warp=on result, and the UDP stream all told the same story.

I gained a safer route, not anonymity

The things WARP can’t do aren’t important when I just want safer public Wi-Fi

WARP’s beautiful simplicity comes with one big, obvious limitation. Android only allows one device-wide tunnel operating at a time, so another privacy app would have to replace it rather than run happily alongside it.

It also moves trust rather than making it disappear. A café, hotel, mobile carrier, or ISP can still see my phone sending and receiving encrypted traffic with Cloudflare. It can’t directly see the requests wrapped inside WARP, but Cloudflare is merely operating at the other end of that tunnel and routing traffic onwards. WARP also doesn’t make me anonymous, offer relief from geo-restrictions, or provide a route back home into my network.

None of those limitations actually interfered with why I wanted to try it in the first place, though. I wasn’t trying to appear somewhere else. I just wanted the operators of public Wi-Fi, or even my home internet, to see little more than a single encrypted Cloudflare connection.

WARP gave me that with one simple, big orange switch, and Cloudflare never asked for an account or a subscription. I would still use a separate tool when I need to reach my home network, but WARP is perfectly suited for connections I simply don’t trust.

And that simplicity and proven protection are the big reasons why it’s now earned a permanent place on my Android phone.