VPNonly Buy · $19

One app on the VPN. Not your whole Mac.

VPNonly lives in your menu bar. Switch an app on and it goes through your VPN, while everything else on your Mac stays on your normal connection.

Get it for Mac — $19 or see how it works

It's a Mac app. Buy on your phone and the licence key and download link arrive by email, ready for your Mac.

$19 once for 2 Macs · 14-day refund · Apple Silicon

The popup a moment after checking Chrome's exit address. The addresses shown are examples.

Works with

What people use it for

Most people switch on one or two apps. These guides cover the common setups, and there are more on the guides page.

Your torrent app, with a kill switch NewqBittorrent or Transmission goes through the VPN and is blocked if the tunnel drops. The rest of your Mac keeps its full speed.Torrents through the VPN on a Mac, and nothing else Just your browserChrome, Firefox, Arc or Brave on the VPN, while calls, banking and everything else stay on your normal connection.How to use a VPN for only one app on Mac WhatsApp calls from the UAEOnly WhatsApp goes through the VPN, so your bank and local services still see you at home. The guide shows where the call packets actually went.WhatsApp calls on a Mac in the UAE, without putting your bank on a VPN NordVPN for some apps, not allNordVPN's Mac app has no split tunneling. Paste an access token into VPNonly and choose which apps use your NordVPN account.NordVPN split tunneling on Mac Mullvad, Proton or your own serverDrop in a WireGuard config from your provider and pick the apps that use it. Your VPN's own app can stay closed.Split tunneling with Mullvad, Proton, IVPN or your own server Your bank and calls stay homeA normal VPN sends everything abroad, so banks ask questions and calls lag. Leave those alone and move only the app that needs it.Why does my whole Mac go through the VPN?

View all guides

How it works

VPNonly sits between your apps and the internet. The apps you switch on go through a WireGuard tunnel, and everything else takes your normal connection, untouched.

Google Chrome
CapCut
Slack
Spotify
WhatsApp

Try it: switch the apps on and off.

Google Chrome is switched on, so VPNonly sends it through the WireGuard tunnel to Singapore. CapCut, Slack, Spotify and WhatsApp are off, so they keep your normal connection at home.

  1. A tunnel nobody usesIt opens a WireGuard tunnel that nothing uses by default, so your normal connection is never touched.
  2. The firewall picks who goes inThe firewall already built into macOS sends just the apps you picked through that tunnel. An app restarts once when it joins, because macOS fixes how an app connects at the moment it opens.
  3. Blocked if the tunnel dropsIf the tunnel goes down, those apps are cut off from the internet until it's back. They never quietly fall back to your normal connection.

The longer version, with the actual rules

Kanishk

Hi, I'm Kanishk

I wanted CapCut on a Singapore IP while the rest of my Mac stayed home. No Mac VPN does that, so I built this.

What it can't do yet

  • Apple Silicon Macs only.
  • Safari and other browsers built on Apple's WebKit, like Orion, can't be routed, so VPNonly won't switch them on. WebKit hands their connections to separate system processes, so they never carry the app's identity. Chrome, Firefox, Arc, Brave and Helium all work.
  • Connections are tunneled, but DNS lookups still go through your normal resolver. If you need to hide which sites you visit from your ISP, this isn't the right tool yet.
  • Moving an app in or out drops its open connections. Most apps reconnect on their own, but a large upload would start over.
  • It isn't signed by Apple yet, so you allow it once in System Settings on first launch. Here's the full setup guide.

Quick answers

Do I need my VPN's own app running?
No, keep it closed. VPNonly connects to your provider's servers directly.
Which providers work?
For NordVPN, paste an access token and the app does the rest. For Mullvad, Proton, IVPN, AirVPN or your own server, download a WireGuard config and drop it in.
Why does it want my password?
Firewall rules need admin rights. It asks on first setup and when a security-sensitive engine update needs approval. The exact engine in every release is open source on GitHub, so you can read every privileged line before you trust it.
Do you collect anything?
No. There's no account and no analytics in the app, and no server of mine sits in your traffic.
How is this different from SplitTunnel.app?
It runs alongside a VPN client you already use and steers each app around it. VPNonly replaces the client: it connects to your provider itself, so your Mac never joins the VPN. They charge $49 a year, this is $19 once. More questions

Put one app on the VPN.

$19 once for 2 Macs. No subscription, and a 14-day refund.

Get it for Mac — $19

Prefer the terminal? The CLI is free, NordVPN only for now.