Shark BiteTorrent

A lightweight BitTorrent client with a VPN built in. Only the torrent client goes through the VPN;
the rest of your computer keeps its normal connection.

---

Why this exists

Most people who want their torrent traffic on a VPN have two options, and neither is great:

1. Run a system-wide VPN. Everything on the PC (games, streaming, work apps) now goes through it too, often slower or blocked.
2. Use split tunneling or bind the client to a VPN adapter. That's fiddly to set up, depends on the VPN app, and can leak your real IP if the VPN drops and the client falls back to the normal connection.

Shark BiteTorrent puts the VPN inside the app. The torrent engine has no network access except through its own WireGuard tunnel, so:

• nothing else on your computer is affected,
• there's nothing to install system-wide: no network adapter, no driver, no admin rights,
• and if the VPN goes down, torrents stop instead of leaking. That kill switch is a consequence of the design, not a setting you have to remember.

It works out of the box with free Cloudflare WARP, so there's protection from the first launch, and you can switch to a paid VPN provider at any time.

Features

VPN

• 🦈 Per-app VPN: only this app's traffic uses the tunnel.
• 🆓 Cloudflare WARP by default: free, no sign-up, registered automatically on first launch.
• 🔑 Sign in to your VPN provider: Mullvad, Private Internet Access, NordVPN and IVPN. Pick a server location, or let the app choose one in your own country.
• 🔓 Automatic port forwarding with PIA: other peers can connect to you, which means much better seeding. The forwarding is renewed every 15 minutes.
• 📄 Import any WireGuard .conf file: works with any provider (Proton, AirVPN, …), with an optional forwarded port.
• 🛑 Kill switch by design: the torrent engine starts only after the tunnel is verified (exit IP checked) and has no other network path.
• 🔒 Encrypted secrets: WARP keys, VPN sign-ins and imported configs are encrypted on disk.

Torrents

• Magnet links and .torrent files: paste, open, drag and drop, or click a magnet link in your browser.
• Choose which files to download in a torrent.
• Piece map: a qBittorrent-style bar showing which pieces are done, downloading, being checked, missing or skipped.
• Malware checks: every torrent is checked for disguised programs as soon as its file list arrives (e.g. movie.mp4.exe, or a program inside a video torrent). Finished files are marked as downloaded from the internet (Windows SmartScreen and Defender, macOS Gatekeeper and XProtect check them when opened) and scanned with Microsoft Defender on Windows, or ClamAV on Linux and macOS if it's installed.
• Pause/resume, and remove with or without deleting the downloaded files.
• Speed limits that apply immediately.
• Per-torrent download folders: changing the folder affects new torrents only, and the choice is remembered.
• Torrents and settings survive restarts. Incomplete files are kept as .part files.
• Right-click menu on a torrent: Show files, Pause/Resume, Remove.

Desktop

• Tray icon with close-to-tray, Pause all / Resume all, and live speeds in the tooltip.
• Updates: on launch the app checks GitHub (through the VPN) and offers new versions. On Windows, Update now downloads the installer, verifies its SHA-256 checksum and upgrades in place. There's also Check for updates in Settings.
• Single instance: clicking a magnet link while the app is open sends it to the running window.
• Windows installer: per-user, no admin. It registers magnet links and .torrent files and cleans up on uninstall.

Install

Download the latest build from the Releases page.

Note: On Windows 11, the first magnet link you click after installing shows a one-time "Pick an app" prompt. Choose Shark BiteTorrent. Windows requires you to confirm this yourself; no installer can skip it.

How it works

flowchart LR
    subgraph App["Shark BiteTorrent process"]
        UI["UI<br/>(Svelte in a WebView)"] <--> Go["Go backend"]
        Go --> Engine["Torrent engine<br/>(anacrolix/torrent)<br/>OS sockets disabled"]
        Engine -- "peers, trackers, DHT,<br/>webseeds, DNS" --> Stack["Userspace TCP/IP stack<br/>(gVisor netstack)"]
        Stack --> WG["WireGuard<br/>(wireguard-go)"]
    end
    WG -- "one encrypted UDP socket" --> VPN["VPN server<br/>(WARP / Mullvad / PIA / …)"] --> Net(("Internet"))
    Other["Everything else on your computer"] -- "normal connection" --> ISP["Your ISP"] --> Net

1. WireGuard runs inside the app. wireguard-go is paired with gVisor's userspace network stack, the same approach Tailscale uses. The app gets a private, in-memory network interface that the operating system doesn't know about.
2. The torrent engine only has that interface. All of anacrolix/torrent's own sockets (TCP, uTP, DHT, UPnP, WebRTC) are disabled, and the app supplies tunnel-backed replacements for peer connections, HTTP and UDP trackers, DHT and webseeds.
3. DNS goes through the tunnel too. Every hostname lookup in the process goes to the VPN's DNS server, so your ISP doesn't see which trackers you contact.
4. Verification before anything starts. After connecting, the app fetches its exit IP through the tunnel and checks it: warp=on for WARP, and for other providers, an IP different from your real one. Only then does the engine start.

We checked this with the OS's own socket list: while downloading, the app's only real network socket is the WireGuard UDP socket to the VPN server.

Design decisions

Limitations

• WARP can't forward ports, so peers can't connect to you and seeding is limited. Use PIA, or a provider with port forwarding via .conf import.
• WARP isn't anonymous: it hides your IP from peers, not your identity from Cloudflare.
• TCP peers only (no uTP), by choice: the only uTP library that can run inside the tunnel is an older, slower pure-Go one. TCP already reaches 35–40 MB/s through WARP, so it isn't worth the CPU cost and complexity.
• macOS: no tray icon yet (the tray library and Wails both need the main thread), and the app is unsigned.
• Linux and macOS builds are new and much less tested than Windows.
• VPN sign-in follows each provider's official flow and is tested against their real server lists, but not yet with real paid accounts for every provider. Please report problems.

Build from source

All platforms need:

• Go 1.26+: https://go.dev/dl/
• Node.js 22+ (with npm): https://nodejs.org/
• Wails CLI v2.16:

  go install github.com/wailsapp/wails/v2/cmd/[email protected]
  

  Make sure $(go env GOPATH)/bin is on your PATH, then check your setup with wails doctor.

Clone the repo:

git clone https://github.com/trevercomb/SharkBiteTorrent.git
cd SharkBiteTorrent

Windows

Requirements: WebView2 (built into Windows 10/11) and, for the installer, NSIS:

winget install GoLang.Go OpenJS.NodeJS.LTS NSIS.NSIS

Build:

# App only -> build\bin\SharkBiteTorrent.exe
wails build -trimpath -ldflags "-s -w"

# App + per-user installer -> build\bin\SharkBiteTorrent-amd64-installer.exe
wails build -trimpath -ldflags "-s -w" -nsis -installscope user

If makensis isn't found, add C:\Program Files (x86)\NSIS to your PATH.

Linux

Arch / CachyOS:

sudo pacman -S --needed base-devel go nodejs npm gtk3 webkit2gtk-4.1 xdg-utils

Debian / Ubuntu 24.04+ (install Go from go.dev if your distro's is older than 1.26):

sudo apt install build-essential pkg-config nodejs npm libgtk-3-dev libwebkit2gtk-4.1-dev xdg-utils

Fedora:

sudo dnf install golang nodejs npm gtk3-devel webkit2gtk4.1-devel xdg-utils

Build. The webkit2_41 tag selects WebKitGTK 4.1, which current distros ship:

wails build -trimpath -ldflags "-s -w" -tags webkit2_41
# -> build/bin/SharkBiteTorrent

To register magnet links for your user, open Settings → Open magnet links & .torrent files with Shark BiteTorrent. That writes a .desktop entry and runs xdg-mime.

Make an Arch package (what the release does):

v=0.2.0; name=SharkBiteTorrent-$v-linux-x86_64
mkdir -p dist/$name
cp build/bin/SharkBiteTorrent packaging/linux/sharkbitetorrent.desktop dist/$name/
cp build/appicon.png dist/$name/sharkbitetorrent.png
tar -C dist -czf packaging/arch/$name.tar.gz $name
cd packaging/arch && makepkg -si

Saved VPN logins on Linux need a Secret Service keyring. KDE's KWallet and GNOME Keyring both provide one.

macOS

Requirements: Xcode Command Line Tools, plus Go and Node (via Homebrew or the installers above):

xcode-select --install
brew install go node

Build a universal app (Intel + Apple Silicon):

wails build -trimpath -ldflags "-s -w" -platform darwin/universal
codesign --force --deep --sign - build/bin/*.app   # ad-hoc signature so it launches
# -> build/bin/SharkBiteTorrent.app

Magnet links and .torrent files are declared in the app's Info.plist (generated from wails.json), and macOS registers them when the app is moved to Applications.

Build without funding links

Add the nofunding build tag to any build command above, on any platform:

wails build -tags nofunding -trimpath -ldflags "-s -w"                    # Windows / macOS
wails build -tags "webkit2_41 nofunding" -trimpath -ldflags "-s -w"     # Linux

That build has:

• no sponsor button,
• plain links to every VPN provider (no referral codes, no referral labels),
• an About section that says funding links are turned off,
• update notices that link to the release page instead of installing the official release, which has the links back in.

Everything else is identical. To check it, run go test -tags nofunding -run TestLinks .

Development

wails dev                      # live-reloading app; frontend changes apply instantly
go test ./...                  # unit tests (add -short to skip the tests that need the network)
go run ./cmd/tunnelcheck       # bring up WARP and print the exit IP
go run ./cmd/enginecheck -seconds 30 [-down KB/s] [-delete] <magnet|file.torrent>
                               # headless download through the tunnel; ENGINE_STATUS=1 dumps client state

Releases

Pushing a version tag builds Windows, Linux and macOS on GitHub Actions and publishes a Release:

git tag v0.2.1 && git push origin v0.2.1

Running the Release workflow by hand from the Actions tab builds everything without publishing.

Project layout

main.go, app.go          Wails entry point; app state, VPN connect/reconnect, torrents
accounts.go              VPN provider sign-in/out (encrypted storage)
links*.go                Sponsor and VPN sign-up links (links.go); the nofunding build flag strips them
tray*.go                 Tray icon (per-OS files)
internal/tunnel          In-process WireGuard + netstack, .conf parser, exit-IP check
internal/engine          anacrolix/torrent wired to the tunnel; files, limits, removal
internal/warp            Cloudflare WARP registration (via wgcf)
internal/vpnprov         Mullvad, PIA, NordVPN, IVPN sign-in and server selection
internal/secret          Encryption at rest (DPAPI / keyring + AES-GCM)
internal/platform        Open folder, magnet/.torrent registration (Windows/Linux/macOS)
internal/winassoc        Windows registry associations and Default Apps
earlyinit/               Sets the torrent library's file I/O mode before it initializes
frontend/                Svelte 5 + TypeScript UI
packaging/               Linux .desktop file and Arch PKGBUILD
build/                   Icons, Windows installer script, macOS Info.plist
.github/workflows        Release builds for all three platforms

App data (settings, saved torrents, encrypted keys) lives in:

Downloads default to Downloads/Torrents in your home folder.

Credits

Built on wireguard-go and gVisor netstack, anacrolix/torrent, wgcf, Wails, Svelte, fyne.io/systray and go-keyring. The PIA certificate and connection flow come from PIA's manual-connections scripts.

How this project is funded

We'd rather tell you upfront than have you find out later.

What earns money:

• Donations through GitHub Sponsors (the Sponsor button on this repo, and Support development in the app's Settings → About). Entirely optional.
• Referral links for two VPN providers: NordVPN and Private Internet Access. In Settings → VPN account, each provider has a "Don't have an account? Get …" link. For these two, it's a referral link: if you buy a subscription through it, the provider pays this project a commission. The price you pay is the same.

What that means for you:

• Every referral link is labelled as one in the app, right next to the link.
• The provider's website will know you came from Shark BiteTorrent. That's how referral tracking works (a code in the link, usually stored in a cookie on their site). The app itself shares nothing with them.
• No link is ever a recommendation. Providers are listed alphabetically, and support for a provider is never added, removed or reordered because of a commission.
• Mullvad and IVPN links are plain links. Neither runs a referral program, by their own choice. We include them because they're good providers.
• You never have to pay anything. The free Cloudflare WARP default and WireGuard config import (for any provider) will always be available.

What never happens:

• No ads, no bundled software, no "recommended offers" in the installer.
• No telemetry or analytics. The app never sends data to us; there is no server of ours for it to talk to. Its only connections are the torrent network (peers, trackers and web seeds, all through the VPN), your VPN provider's own API when you sign in or connect, Cloudflare's public trace page to check your exit IP, and GitHub to check for updates (through the VPN, about once a day; you can turn this off in Settings).
• Your data, logins and download history are never sold or shared.

Every link lives in one file, links.go, so anyone can check exactly what the app links to. To build without any of it, use the nofunding build flag (see Build without funding links): no sponsor button, plain provider links and no referral labels. Because this is GPL software, you're free to change or remove anything else too.

Contributing

Bug reports, ideas and pull requests are welcome. Please open an issue first for big changes.

License

Shark BiteTorrent is free software, licensed under the GNU General Public License v3.0 or later.

You can use, study, share and modify it. If you distribute a modified version, you must make its source available under the same license, so forks stay open (no closed-source or adware repackaging).

It includes third-party libraries under MIT, BSD, ISC, Apache-2.0 and MPL-2.0 licenses, all compatible with the GPL. Their notices are in THIRD_PARTY_LICENSES.txt, which also ships with every release. To regenerate it after changing dependencies, use go-licenses:

go install github.com/google/go-licenses/v2@latest
go-licenses report .   # lists every Go dependency and its license

Please use Shark BiteTorrent only for content you have the right to download and share.