Draco protects your traffic against the quantum computers of tomorrow — today. WireGuard for speed, Rosenpass for a hybrid post-quantum handshake, on RAM-only servers that keep no logs. Not a premium add-on. The whole network.
A hybrid Rosenpass exchange — ML-KEM768 and Classic-McEliece layered over WireGuard's X25519 — so a future quantum computer can't unlock today's captured traffic.
A hand-picked footprint across privacy-friendly jurisdictions and major business hubs — from Frankfurt and Zurich to Tokyo and Sydney. More added by the week.
Every exit runs diskless from a tmpfs root. Keys and state live only in memory; a reboot wipes the box. A pulled or imaged drive yields nothing.
The exits keep no disk to log to. The control plane holds only your account and entitlement — never your traffic, never your DNS. Privacy that's structural, not just a policy.
Pick a location or hit Quick Connect and Draco brings up the tunnel in a second. Your keys are generated on-device — the control plane never sees a private key.
Flip on Stealth and Draco's traffic is shaped to look like ordinary encrypted internet, so deep-packet-inspection firewalls on restrictive networks can't fingerprint or block the VPN. Leave it on Auto and it turns on by itself wherever a network needs it — the post-quantum handshake rides underneath, unchanged.
Hotels, airports and campus Wi-Fi hijack your first connection to a sign-in page — where ordinary VPNs get stuck fail-closed. Draco detects the portal, lets you log in, then brings the tunnel up automatically. It can even connect the moment you sign in to your device. No mainstream VPN does this.
Every URSA Secure Mobile OS license and every paid Lyra seat carries full Draco — all locations, no extra charge. One account, one post-quantum backend.
Adversaries are already recording encrypted traffic in bulk, betting that a large enough quantum computer will one day unlock it. A classical VPN doesn't protect against that bet — the ciphertext is copied while the key math is still breakable. Draco closes the window: with a post-quantum hybrid handshake on every connection, the data captured today stays sealed even against the machines of tomorrow.
Draco's app is deliberately simple: a live map, a list of every location with real latency, and one big button. The complexity — the post-quantum key exchange, the peer reconciliation, the kill-switch — happens underneath.
On FIPS: the default profile is tuned for the strongest known post-quantum resistance — two independent PQ KEMs (ML-KEM768 and Classic-McEliece) over WireGuard — and those primitives are deliberately not the FIPS-approved set. A FIPS-mode profile (AES-256-GCM, ML-KEM-768, SHA-384) is available for regulated customers who require it. Post-quantum module validation is in process industry-wide: no CMVP certificate yet covers ML-KEM or ML-DSA, from any vendor.
 Draco |
Proton VPN | Mullvad | NordVPN | ExpressVPN | |
|---|---|---|---|---|---|
| Post-quantum encryption on every server, every plan | ✓ | PartialWireGuard only, rolling out | Partialexperimental | — | — |
| Named PQ algorithms ML-KEM + Classic-McEliece | ✓ | — | — | — | — |
| No-logs, RAM-only exits | ✓ | ✓ | ✓ | ✓ | ✓ |
| WireGuard data channel | ✓ | ✓ | ✓ | ✓ | Lightway |
| DPI-resistant Stealth mode defeats VPN-blocking firewalls | ✓post-quantum preserved | ✓classical | ✓classical | ✓classical | ✓classical |
| Captive-portal auto-connect hotel / airport / campus Wi-Fi | ✓signs in, then tunnels | Partialdetects only | — | — | — |
| Free tier | ✓ | ✓ | — | — | — |
| Paid price entry annual, per month | $3.99 | $4.99 | $5.00 | $3.39 | $6.67 |
| Included with a secure device | ✓URSA OS & paid Lyra | — | — | — | — |
| Kill switch & DNS-leak protection | ✓ | ✓ | ✓ | ✓ | ✓ |
Competitor details reflect each provider's publicly documented posture at the time of writing and are provided for honest comparison. Draco is the only one where the post-quantum handshake is the default on every server and plan — not an opt-in, a beta, or a premium tier.
Windows 10 & 11 · app
DownloadmacOS 12 Monterey+ · Apple silicon · signed & notarized
DownloadDebian · Ubuntu · Raspberry Pi
DownloadIntel Mac, or want one build for both? Download the universal macOS build (Apple silicon + Intel, signed & notarized).
Linux — one line, auto-detects Intel or ARM (Debian · Ubuntu · Kali · Raspberry Pi): curl -fsSL https://draco.ursamobile.com/install.sh | sudo sh · ARM64 / Pi direct: .deb · .tar.gz
Get it on Google Play
Google PlayApp Store
Coming soonBuilt in · included
Learn moretvOS 17+
Coming soonFire Stick · sideload APK
DownloadAndroid TV · Google TV · APK
DownloadChrome Web Store · ChromeOS
Add to ChromeEdge Add-ons
Add to EdgeFirefox Add-ons (AMO)
Add to FirefoxCovered by the system app
System VPNThe browser extension needs the small local Draco helper to keep the browser hop post-quantum — it ships in the desktop app, or grab it standalone: Linux helper (Windows/macOS helpers ship in their desktop installers). One-click install from the Chrome Web Store, Edge Add-ons and Firefox AMO — or load the packaged .zip unpacked. Safari can't run a proxy extension (Apple restricts the proxy API) — on Apple devices the system Draco app protects Safari and every app.
Buy URSA Secure Mobile OS or a paid Lyra Team and full Draco comes with it — every location, every user, quantum-safe. One of the strongest privacy stories in enterprise and government mobility, included.
tailscale set --accept-dns=false (your tailnet keeps working; you lose short MagicDNS names), disconnect the other VPN, or use Draco Mesh — our own post-quantum device-to-device mesh — so you don't need a second mesh VPN at all. iPhone, iPad and Apple TV are unaffected: they allow only one active VPN, so Draco always answers DNS there.