Cloudflare WARP

Overview

This is two products behind one switch. The first is an encrypted resolver, which stops the network you are on from seeing which sites you look up and replaces whatever resolver your router handed you with one that answers faster. The second is a full device tunnel that carries all of your traffic encrypted to the nearest edge location before it goes out to the internet.

The distinction is worth understanding because the two modes serve different problems. Resolver only mode is close to free in performance terms and fixes the most commonly leaked piece of browsing information. Full tunnel mode hides everything from the local network and from an internet provider, at the cost of routing every packet through an intermediary, though in practice the network it routes through is often faster than the direct path.

It is not a location changing service, and that is a deliberate design decision rather than an oversight. Traffic exits near where it entered, so this will not make anything think you are somewhere else. What it does instead is make a connection over a hostile network, a hotel, an airport or a cafe, behave like a private one, and often improves throughput on congested paths by using better routing than the default.

The client is deliberately small. One switch to connect, a mode selector, per application split tunnelling for anything that must bypass the tunnel, a family filter option that blocks malicious or adult content at resolution time, connection diagnostics for when something is not working, and an option to connect automatically on untrusted networks while staying off at home.

Key Features

• Encrypted private resolver replacing whatever the local network provides
• Full device tunnel encrypting all traffic to the nearest edge location
• Resolver only mode for privacy at near zero performance cost
• Split tunnelling to exclude specific applications or address ranges
• Optional filtering of malicious and adult content at resolution time
• Automatic connection on untrusted networks with trusted network exceptions
• Modern tunnel protocol with fast reconnection after a network change
• IPv4 and IPv6 support with a fallback for restrictive networks
• Connection diagnostics and a live throughput indicator
• Free and unmetered with no bandwidth cap

What Changed in This Build

• Faster reconnection when moving between wireless networks
• Improved throughput on congested paths through revised routing
• Split tunnel rules now accept address ranges as well as applications
• Reduced battery impact on portable machines while idle

System Requirements

Processor	Any modern x86 or x64 processor
Memory	1 GB
Storage	200 MB free
Network	Any internet connection
Operating system	Windows 10 or Windows 11, 64-bit

Release Details

Full title	Cloudflare WARP
Version string	2026.6.905.0
Publisher	Cloudflare
Category	Software
Licence	Free, unlimited
Platform	Windows 10 and 11, 64-bit
Interface language	Multilingual, 14 interface languages
Archive size	68 MB
Mirrors	4 active, all reporting online
Listed	refreshed 2 months ago, checked again 40 minutes ago

Installation Notes

• It does not change your apparent location. If that is what you need, this is the wrong tool.
• Add corporate or local network applications to split tunnelling if they stop resolving once the tunnel is up.
• Some restrictive networks block the tunnel protocol entirely, in which case the client falls back automatically but more slowly.

Before You Start

Read the notes above before running setup. Most of the problems people write in about are covered there, and almost all of them come down to an older version of the same software still being installed, a graphics driver that predates the release, or a security suite quarantining part of the package mid install.

There is no archive password on this or any other entry in the library. If something you downloaded elsewhere claims to come from here and asks for one, it did not come from here. Nothing on this site is behind a survey, a shortener or a countdown either.

If the entry does not match what the page describes, say so on the contact page and include the version string from the release details table. Reports naming a specific version get checked first because the checker can reproduce them straight away.

Frequently Asked