Loading latest version

Nothing gets in
until it's verified.

Truzt is a zero-trust VPN. Every user and device proves who it is before it can reach anything, and the traffic then flows peer-to-peer over WireGuard®. There are no open ports and no central gateway.

Download TruztInstall guide

macOS · Windows · Linux  /  amd64 · arm64

Zero trust, in practice

Verify every request. Allow only what's needed.

Access is denied unless a policy allows it, checked against the user's identity and the device's key on every connection.

Least-privilege policies

Grant a group one port on one resource. Anything you didn't write down is blocked.

policy "engineering-to-prod" {
  from    = group("engineering")
  to      = group("prod-db")
  ports   = ["tcp/5432"]
  require = ["mfa", "registered-device"]
}
# everything else: denied

Every peer, accounted for

See who is connected, how, and revoke a device in one click from the dashboard.

mbp-anjalidirect
prod-db-01direct
ci-runner-2relayed
old-laptopblocked

A mesh, not a tunnel to HQ

Each device gets its own WireGuard identity and connects straight to its peers through NAT. A relay is used only when a direct path is impossible, and it can't read the traffic.

LaptopOffice serverCloud VMHome NASPhone hotspot

Zero open ports

No inbound firewall rules, no port forwarding, no public VPN endpoint to scan. Your servers stay invisible.

0
listening ports exposed

Sign in with your identity provider

Users authenticate with SSO and MFA in the browser. Leavers lose access the moment their account is disabled.

  • Group-based access policies
  • Private DNS for peers
  • Network routes & exit nodes
  • Posture checks
  • Setup keys for servers
  • Activity log
  • Intel & ARM builds
  • Upgrade-safe installers

Diagnose in one command

Truzt Doctor checks DNS, reachability, the service and peer state, then tells you what's wrong.

$ truzt-doctor
 PASS  internet reachable
 PASS  DNS resolves app.truzt.lk
 PASS  HTTPS to management · 38 ms
 PASS  service running
 PASS  peer registered
 PASS  Management: Connected  Signal: Connected

Install

On the network in about a minute.

Run one command, sign in in the browser, and you're connected. Re-run it later to update. Your settings and peer registration are kept.

macOS
curl -fsSL https://pkgs.truzt.lk/release/latest/install-macos.sh | bash
Windows · PowerShell as Administrator
irm https://pkgs.truzt.lk/release/latest/install-windows.ps1 | iex
Linux, Homebrew, WinGet & packages
Download TruztInstall guide