fips2go fips2go runs a FIPS mesh node on your phone and hands it to the apps you pick, over a per-app VPN tunnel. Selected apps reach .fips names on the mesh and keep normal internet; every other app on the device is untouched. Per-app split tunnel. You choose which apps join the mesh. They get the mesh and clearnet at once; nothing else on the phone is affected. With no apps selected the tunnel does nothing. .fips names just resolve. DNS for covered apps is answered in-process for .fips, and forwarded to your normal resolvers for everything else. Default-deny inbound firewall. Other mesh nodes cannot reach ports your apps listen on. Only replies to connections you opened, ICMPv6, and an explicit port allowlist get through. Identity sealed by the Android Keystore, with backup and restore so it survives a reinstall. FIPS Hotspot. Auto-joins open Wi-Fi named !FIPS to reach nearby peers, while your internet stays on your normal network. LAN discovery (mDNS). Finds peers on your Wi-Fi and dials them directly, with no relay hop. Survives network changes. A Wi-Fi to cellular hand-over keeps every session and route; peers are re-pinned within a second, no reconnect. Diagnostics. Resolve or ping an npub, inspect live peer sessions, and read the node log. Open source (MIT), no accounts, no telemetry. Requires Android 8.0 or later.