The easiest way to build cross-platform tunnel apps.
Partout (French: /paʁtu/) is a tunnel library that uses Zig and C at its core, plus Swift and Kotlin for the OS bindings. It provides VPN functionality through the Network Extension framework on Apple platforms, through VpnService on Android, and it partially works on Windows (with Wintun) and Linux.
Partout is the backbone of Passepartout.
As per the GPL, the public license is not suitable for the App Store and other closed-source distributions. If you want to use Partout for proprietary or commercial purposes, please obtain a proper license.
Import the library as a SwiftPM dependency:
dependencies: [
.package(url: "https://github.com/partout-io/partout", branch: "master")
],
targets: [
.target(
name: "MyTarget",
dependencies: ["partout"]
)
]CMake is a thin wrapper around the Zig build. It resolves the selected vendors,
then invokes zig build install with their include and library paths.
- Zig 0.16+
- C build tools
- CMake
- ninja
- Android NDK (optional)
Partout consumes system libraries or artifacts published by the prebuilts project; it does not build vendor sources.
Use one of the scripts/build.* variants based on the host platform:
scripts/build.sh(bash)scripts/build.ps1(Windows PowerShell)
The script resolves the selected dependencies and accepts a few options:
-h,--help: Show the build help-gen: Configure CMake-install <dir>: Install the completed build artifacts into a directory-config (Debug|Release): The CMake build type (build.shonly)-crypto (openssl|mbedtls[,openssl|mbedtls...]): Pick one or more crypto subsystems between OpenSSL and Native/MbedTLS-wireguard: Enable WireGuard-android: Build for Android-prebuilts <version>: Use vendor archives from the matchingpartout-io/prebuiltsGitHub Release. CMake derives each archive name from the vendor, platform, and architecture. On macOS and Linux, CMake tries the system library first and uses the release only as a fallback.
The equivalent CMake variable is PP_BUILD_VENDOR_PREBUILT_URL. Optional
vendor-specific *_PREBUILT_HASH variables accept a CMake URL_HASH value
such as SHA256=<digest>.
After the initial -gen, invoke the script without arguments to rebuild the
existing configuration.
For example, this will build Partout for release with a dependency on OpenSSL:
$ scripts/build.sh -gen -config Release -crypto opensslSample output:
# macOS
bin/darwin-arm64/partout/lib/libpartout.dylib
# Linux
bin/linux-aarch64/partout/lib/libpartout.so
# Android
bin/android-aarch64/partout/lib/libpartout.so
# Windows
bin/windows-arm64/partout/bin/partout.dll
Partout must be bundled with the enabled shared vendor libraries to work. Building for Android requires access to the Android NDK.
Check out scripts/build.sh and scripts/build.ps1 for more details.
There is an Xcode Demo in the cross/apple directory. Edit Demo/Config.xcconfig with your developer details. You must comply with all the capabilities and entitlements in the main app and the tunnel extension target.
Put your configuration files into Demo/App/Files with these names:
- OpenVPN configuration:
test-sample.ovpn - OpenVPN credentials (in two lines):
test-sample.txt - WireGuard configuration:
test-sample.wg
Open Demo.xcodeproj and run the PartoutDemo target.
Copyright (c) 2026 Davide De Rosa. All rights reserved.
The library is licensed under the GPLv3.
By contributing to this project you are agreeing to the terms stated in the Contributor License Agreement (CLA). For more details please see CONTRIBUTING.
Libraries:
Special contributors:
- Tejas Mehta for the implementation of the OpenVPN XOR patch
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)
© Copyright 2026 OpenVPN | OpenVPN is a registered trademark of OpenVPN, Inc.
© Copyright 2015-2026 Jason A. Donenfeld. All Rights Reserved. "WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld.
Twitter: @keeshux
Website: partout.io