How Morke works, starting with the VPN kill switch.
Morke has a VPN kill switch, off by default, and with it on no page loaded for 6.7 seconds after the tunnel process was killed outright.
The tunnel comes back on its own. The parts under it are ordinary.
The switch ships off. With it on, we killed the tunnel process outright on an iPhone 16 Pro over cellular, on 1 August 2026. Nothing loaded for the 6.7 seconds that followed. The always-on rule then raised the tunnel again, with the app untouched and no prompt.
The tunnel is VLESS-REALITY over TLS 1.3. Confidentiality is TLS 1.3's own: AES-GCM or ChaCha20-Poly1305, X25519 for the key exchange, and no proprietary primitive anywhere in it. REALITY changes the handshake and how the client authenticates, and the client's TLS fingerprint is a browser's.
DNS is resolved inside the tunnel, and there are 4 presets. The one you start on filters nothing. The rest are aimed at ads and trackers, malware, or adult content. There is no field for a resolver of your own, and that is deliberate: a resolver only one account uses would identify that account across sessions.
IPv6 is decided per node. A node that can carry it does, inside the tunnel. A node that cannot answers AAAA with no records, so an address that node could not reach is never handed to the app.
The same thing as a table. For anyone who would rather scan it.
1.0The tunnel
- 1.1Protocol
- VLESS-REALITY over TLS 1.3
- 1.2Ciphers
- AES-GCM, ChaCha20-Poly1305, X25519
- 1.3Kill switch
- Off by default, 0 packets in a 6.7s outage
- 1.4DNS
- 4 presets, resolved in-tunnel
- 1.5Custom resolver
- Not offered
- 1.6IPv6
- Per node, fail-closed
2.0The app
- 2.1Platforms
- iOS 17+, Mac app not released
- 2.2Auto-connect
- Off, on launch, or on untrusted Wi-Fi
- 2.3Devices
- 5 at once, a sixth parks
- 2.4Credentials
- Keychain only
- 2.5Control plane
- SPKI pinning, App Attest
- 2.6Diagnostics
- No upload path
The kill switch has a cost. We hit it ourselves.
With the kill switch on, App Store and TestFlight downloads stall. We found it trying to deliver a build to a device with the tunnel up. Browsing worked the whole time. The download never arrived. iOS offers no per-service exception, so this is the price of the setting and not something waiting on a fix.
The rest of it is on other pages. This one is the mechanism and nothing else.
The home page carries a wider version of this table, with the account and the price on it. Every row the system keeps about an account, and how long each one is kept, is in the logging policy. How each node answered on the last check is on the status page.