VPNonly

Pick an app, flip a switch, that app is on the VPN. Nothing else changes. $19 once, open-source engine.

What it does:

Most VPNs are all or nothing. You connect, and your whole Mac moves to another country: browser, calls, banking, everything. NordVPN's Mac app has no split tunneling at all, and the providers that do offer it only work with their own service. Here's what each one supports.

VPNonly works the other way round. Your Mac stays where it is, and you switch individual apps onto the VPN from a list in your menu bar.

An app restarts when it joins the tunnel, because macOS fixes how an app connects at the moment it opens. While it stays open, switching it in and out is instant. Quit it and open it yourself later and VPNonly relaunches it once to put it back.

How it works:

It opens a WireGuard tunnel that nothing uses by default, so your normal connection is never touched. Then it uses the firewall already built into macOS to send just the apps you picked through that tunnel.

If the tunnel goes down, those apps are blocked until it's back. They never quietly fall back to your normal connection.