MegaProxy is an open-source Android VPN client for HTTPS, SOCKS5, MASQUE α (HTTP/3) and SSH servers you control or trust, including HTTPS and SSH jump hosts for multi-hop connections. Route all apps or selected apps through your server. No account, ads, analytics or remote telemetry. Servers and credentials are not included.
Android 8.0+ is required. Choose GitHub's universal APK or install through F-Droid:
| GitHub | F-Droid |
|---|---|
 |
 |
Installation guide · Установка на русском. For updates, use Settings → App updates or your installer; keep the same APK variant and install over the existing app to preserve profiles. PR APKs are test builds.
- Add or import a server profile.
- Choose global routing or select apps for split tunneling.
- Run Test from the main menu, then Connect and approve Android's VPN request.
Server setup: MegaProxyServer. All guides: English / Русский.
- HTTPS and SSH jump hosts with separate authentication and trust checks for each hop.
- HTTPS CONNECT over HTTP/1.1 or multiplexed HTTP/2; optional HTTP/3 preference with HTTPS fallback.
- SOCKS5 TCP/UDP, experimental MASQUE TCP/UDP over HTTP/3 and SSH.
- Per-app routing, local-network bypass, optional IPv6 and Android Always-on VPN.
- Multiple profiles, import/export, HTTPS configuration subscriptions and automatic failover.
- DNS-over-HTTPS, optional plain TCP/UDP DNS, selectable TLS/QUIC/SSH fingerprints and custom JA3.
- Traffic totals/rates, passive TCP/QUIC metrics, connection tests, download/upload speed tests and VPN visibility with ProxyCheck IP reputation.
- Local diagnostic logs, encrypted stored credentials, English and Russian interfaces.
Diagnostics and measurement limits · Subscriptions · App updates.
Supports optional username/password authentication and UDP ASSOCIATE. SOCKS5 does not encrypt the proxy connection or credentials; application TLS and DoH keep their own encryption. Setup and limits.
Chains two HTTPS proxies with separate authentication and certificate verification. HTTP/3 preference requires MASQUE support on both hops; otherwise the whole chain uses HTTPS. A failed hop never causes a direct connection around it. Setup.
Experimental HTTP/3 TCP CONNECT and CONNECT-UDP. GOST needs the http3 listener, not h3;
packet-size, fingerprint and server IPv6 limits apply. Setup and limits.
MegaProxy does not intercept application TLS or install a CA certificate. HTTPS/MASQUE certificates and SSH host keys are verified by default; optional trust exceptions weaken those protections. Proxy operators can see connection metadata/destinations and unencrypted traffic, so choose trusted servers. Passwords/private keys are stored encrypted with AES-GCM and an Android Keystore-held key; Android backup is disabled. Logs stay local unless shared explicitly. Privacy policy.
Network services receive the request and the source IP of its route. Diagnostics are explicit; configured subscriptions and enabled app-update checks can also run in the background.
| Purpose | Services and routing |
|---|---|
| Proxy bootstrap DNS | Cloudflare, Yandex, Google or Quad9 DoH may be contacted directly before VPN exists |
| Application DNS | DoH through the proxy by default; optional TCP DNS through the proxy or UDP DNS (direct for HTTPS/TCP and SSH). Intercepted UDP/TCP port 53 only; app-specific encrypted DNS follows normal routing. Routing and security |
| Connection test | example.com; exit IP/country from speed.cloudflare.com/cdn-cgi/trace, then IP fallbacks ifconfig.me, api.ipify.org, icanhazip.com and country fallbacks ifconfig.co, ipapi.co, api.country.is |
| UDP/HTTP3 test | www.cloudflare.com/cdn-cgi/trace and quic.browserleaks.com/, independently through MASQUE/SOCKS5 UDP with verified certificates and no TCP fallback |
| VPN visibility | Route IP lookup as above, then https://proxycheck.io/v3/; successful reputation results cached per IP for 24 hours, quota exhaustion shown separately |
| Speed | https://h3.speed.cloudflare.com/cdn-cgi/trace, /__down, /__up; underlying/VPN networks separately, 10/25/50 decimal MB per direction (up to four times the selected amount plus overhead) |
| Subscriptions | Configured HTTPS sources receive their URL/query, optional Basic Auth, app version and android client ID; normal MegaProxy routing applies |
| App updates | Selected F-Droid or GitHub source; metadata/download endpoints and consent |
Speed defaults to h3 → h2 → h1; fallback only applies to initial protocol negotiation. Latency is median time to first byte from three requests, not passive proxy RTT. Leaving the screen cancels transfers; backgrounding alone does not. Its temporary timing log excludes IPs and response payloads. Details. UDP probes test the proxy path, not every app's routing; fingerprint presets approximate handshakes, not complete browser behaviour. ProxyCheck verdicts and local VPN heuristics are not proof of anonymity.
Import MegaProxy JSON, ProxyList, FoxyProxy JSON or supported SuperProxy text. Portable JSON version 8 uses stable profile IDs; omitted secrets preserve saved values, explicit empty values clear them. Unsupported explicit transports are rejected. Schema and examples · MegaProxyConfig contract. Trusted configuration subscriptions refresh owned profiles without replacing local profiles or interrupting current tunnels; changed live settings offer reconnect. Exported credentials and URL tokens are sensitive.
- HTTPS over TCP and SSH do not forward arbitrary UDP; MASQUE/SOCKS5 require a reachable UDP path.
- MASQUE remains experimental; QUIC datagram-size and GOST interoperability limits are documented in the MASQUE guide.
- Passphrase-protected SSH private keys are unsupported. Fingerprint presets are approximations.
- Android/OEM background restrictions still apply; explicit force-stop cannot be bypassed.
Use JDK 21, Go 1.26.3+ (native/go.mod), Ruby 3.4.10, Android SDK Platform 36 /
Build Tools 36.0.0 and NDK 29.0.14206865. Set ANDROID_HOME; native builds download pinned
Go tooling. JDK discovery uses JAVA_HOME, macOS java_home or PATH without a fixed install path.
bundle install
bundle exec fastlane android debug_artifactOutput: app/build/outputs/apk/debug/app-debug.apk. Use the checked-in Gradle wrapper through
Fastlane. Setup, tests, emulator and signing: English / Русский.
Go dataplane · Release automation.
Select checks using the testing policy (по-русски). Keep credentials, private keys and personal traffic out of issues/logs. Focused bug reports and PRs are welcome.
MIT. Bundled dependencies and artwork retain their own licenses/notices.