Free. No account. Collects nothing about you.
Dangerous sites and ads are stopped inside your phone.
Guard for Android blocks known dangerous sites and ads in every app on your phone, on any network: at home, on mobile data and on café Wi-Fi. The filtering happens on the phone itself. The app also refuses connections to known dangerous addresses on the internet (IP addresses). It is free and needs no account.
Early version. The first release is still being built, so you cannot download the app yet. The download is coming soon. This page describes how the app is designed to work.
- Passed on to the network's DNS server, which finds the address. The site opens as normal.
nyheder.exampleLet through - The app gives an empty answer. The ad is never loaded.
reklame.exampleBlocked - The app gives an empty answer. The site does not open.
svindel.exampleBlocked
Good to know
- The app collects no information about you. No account, no tracking, no analytics, and the app shows no ads.
- The filtering happens on the phone. There is no Cocode server, and the app does not send your traffic through a VPN server, as an ordinary VPN does.
- Only DNS lookups and connections to known dangerous addresses pass through the app. A DNS lookup is when the phone asks where a site is. The rest of your traffic, such as web pages, video and app data, goes out as before.
- DNS lookups that are not blocked go only to the network's own DNS server, as before.
- Lists of dangerous addresses are downloaded straight from their publishers. They can see the phone's IP address, as any website can when you visit it. An IP address is the number your connection has on the internet.
- You grant only two permissions: to use Android's VPN feature and to show notifications. The app has no access to contacts, location or files.
- Free of charge and free software under the GPL-3.0 licence. Anyone can read, change and share the code.
- Made for TalkBack, Android's screen reader, and for large text.
What it does
The app blocks in two ways, for every app on the phone. The name filter stops known dangerous sites and ads. Address blocking refuses connections to known dangerous addresses.
Every app
Games, news apps and browsers are filtered the same way. You don't set anything up app by app.
Any network
At home, on mobile data or on hotel Wi-Fi. The protection travels with the phone.
Dangerous addresses
Some apps and some malicious software go straight to an address without looking up a name, so the name filter cannot stop them. The app refuses connections to addresses on public lists of known dangerous addresses. When it does, a notification tells you which app tried.
Free, with no account
No payment and no login. The code is open under the GPL-3.0, so anyone can read it.
A name list from AdGuard
The names come from AdGuard's DNS filter, a list of sites to block. The list is inside the app. The app does not download it.
Public address lists
The addresses come from public lists of known dangerous addresses. The app downloads them to the phone itself, straight from the publishers, about once a day while protection runs. The publishers can see the phone's IP address. Read about it in the privacy policy.
How it works
Here is what happens when you open a site.
The phone looks up a site's address
Every site has a name, such as nyheder.example. Computers use addresses, which are numbers (IP addresses). Before an app can open a site, the phone has to find the address that belongs to the name. This is called a DNS lookup. The phone asks a DNS server, a bit like looking a number up in a phone book.
The app sees the lookup first
The lookup passes through the app first, inside the phone. If the name is on the block list, the app gives an empty answer. The phone then does not know where the site is, so the site does not open.
The rest is passed on
Every other lookup goes on to the network's own DNS server, and the site opens as usual.
And dangerous addresses?
Some apps and some malicious software do not ask for a name, but go straight to an address. So the app downloads lists of known dangerous addresses while protection runs. If an app tries to connect to an address on the lists, the app refuses the connection at once, inside the phone. Nothing is sent to that address. A notification tells you which app tried and which address it was. All other connections go around the app.
Why does the app ask for VPN permission?
Android's VPN feature is how an ordinary app can see DNS lookups. An ordinary VPN sends your traffic to a server somewhere else. This app does not. It uses the feature only as a local tunnel that starts and ends inside the app itself, and there is no VPN server. Only DNS lookups and connections to addresses on the lists go through the tunnel. The rest of your traffic does not. The first time you tap Start protection, Android asks whether the app may use the VPN feature. If you say no, the app cannot start protection. While protection runs, Android shows a key icon. It is Android's own icon and does not mean there is a VPN server.
What the app cannot do
Here are the limits, so you can judge whether the app suits you.
Private DNS must be Automatic or Off
Private DNS is an Android setting. Where it is depends on the phone; on Samsung phones it is under Connections. If it is set to Automatic or Off, the app works and you need to do nothing. If it is set to a specific server (a host name), the app cannot be used. The phone would not reach the internet while protection runs. So the app stops protection and tells you with a notification. The app's screen then has a button, Open network settings, where you can change the setting. Afterwards, tap Start again.
Apps with their own secure DNS bypass the name filter
Some apps and browsers look sites up in their own encrypted way, for example a browser's secure DNS (DoH) setting. The app cannot see those lookups, so it cannot block them.
One VPN at a time
Android allows only one VPN-type app at a time, so a work VPN cannot run alongside Guard for Android. Android's “Block connections without VPN” setting cannot be used with the app either. The app sends only DNS lookups and connections to dangerous addresses through its tunnel, so the phone would not be able to reach the internet. If the setting is on, protection cannot run, and the app says so.
No list catches everything
The app blocks what is on the lists. A new dangerous site or address can slip through, and a harmless site can be blocked by mistake.
Address blocking needs fresh lists
The app downloads the address lists when the phone is online. If a list is missing or is more than 7 days old, the app does not use it, because old lists can block addresses that other people use now. The screen tells you. Right after the first start, address blocking begins once the lists have downloaded. The name filter works regardless.
If protection stops, you are told
If protection stops without you asking, the app sends a notification saying that DNS lookups are no longer filtered. This needs notifications from the app to be switched on. If they are off, the screen shows a warning about it. If you stop protection yourself with Stop protection, the screen says it has stopped.
Get the app
The download is coming soon. The first version has not been released yet, so there is nothing to download today. The app is free.
GitHub
Download GuardAndroid.apk, the Android installation file. The link only works once the first version is released.
F-Droid
Planned. F-Droid is an app store for free software. The app is not there yet.
Source code
Read the source code on GitHub. The app is free software under the GPL-3.0.
The Cocode Guard box
The Cocode Guard box is a small box by the router that protects the whole home and writes to you on Telegram. Guard for Android is its companion: the box protects the house, and the app protects the phone when it leaves the house. You do not need the box to use the app.