MegaProxy

MegaProxy is an open-source Android VPN client for reliable, secure connections through proxy servers you control or trust. It supports HTTPS and SSH transports, per-app routing, encrypted DNS, connection diagnostics, and automatic failover in one privacy-focused application.

MegaProxy contains no advertising, analytics SDKs, tracking, or remote telemetry. Connection statistics and diagnostic logs stay on the device unless you explicitly choose to share them.

MegaProxy is under active development. Review the current limitations before relying on it for critical connectivity.

Why MegaProxy Private by design. No account, ads, analytics, tracking identifiers, or background telemetry. Your infrastructure. Connect to HTTPS, SSH, or SSH-with-jump servers that you configure. End-to-end application encryption. HTTPS proxying uses CONNECT without intercepting or decrypting application traffic. Flexible routing. Route the whole device or only selected applications through the VPN. Resilient connections. Profile failover, encrypted DNS fallback, SSH keepalives, and connection health reporting help recover from network and server failures. Fully open source. The Android application and Go network core are available under the MIT License. Features Connection profiles Multiple named, colored, reorderable profiles. HTTPS proxies over TLS with Basic authentication. HTTP/2 CONNECT multiplexing when supported by the proxy, with automatic HTTP/1.1 fallback. SSH direct-tcpip transport and SSH through a jump host. SSH password and unencrypted private-key authentication. SSH host-key verification with trust-on-first-use confirmation. Profile cloning, import, export, and configurable failover. Import from MegaProxy JSON, ProxyList, FoxyProxy JSON, and supported SuperProxy text files. VPN and routing Global VPN and per-app split tunneling. Local-network bypass enabled by default. Per-profile IPv6 support; IPv4-only operation is the default. Android Always-on VPN integration and a persistent foreground-service notification. Automatic reconnect when the active profile or pending connection settings change. Approximate upload speed, download speed, proxy latency, and recent connection-error rate. DNS and transport DNS-over-HTTPS through the configured transport. Cloudflare, Google, Quad9, Yandex Basic, Yandex Safe, Yandex Family, and custom DoH endpoints. DNS-provider fallback where it does not weaken an explicitly selected filtering policy. HTTPS ClientHello profiles powered by uTLS, plus manual JA3 configuration. Configurable SSH client profiles, keepalives, channel limits, and session rotation. Arbitrary UDP is intentionally not forwarded; QUIC/HTTP/3 clients normally fall back to TCP. Diagnostics A staged connection test for proxy setup, example.com, and the observed exit IP. Local, size-limited, rotating diagnostic and crash logs designed to omit credentials and traffic content. On-device connection visibility checks and actionable connection warnings. Optional feedback or crash reports opened in the user's email client; nothing is submitted automatically. English and Russian interfaces with an in-app language selector. Privacy and security MegaProxy does not operate a proxy service and does not send configuration or usage data to the project author. Network traffic is sent only where required by the selected profile, destination, and DNS configuration. The explicit connection test additionally contacts example.com and ifconfig.me.

HTTPS proxy certificates are checked against the Android trust store, including hostname and validity. Normal CA certificate renewal does not require certificate pinning. Application TLS remains between the application and its destination. MegaProxy does not install a CA certificate and does not perform TLS interception. Proxy passwords and imported private keys are encrypted with AES-GCM using a key held by Android Keystore. Android cloud backup and device-to-device transfer are disabled for application data. Every upstream socket is protected from recursive routing through the VPN. SSH host keys are verified and unknown keys require explicit user confirmation. Two compatibility options deliberately reduce these protections: accepting an invalid HTTPS proxy certificate and accepting any SSH host key. MegaProxy displays a warning before enabling them. Use either option only when you understand and control the associated risk.

The proxy or SSH server can observe connection metadata and the destinations it is asked to reach, even though it cannot read end-to-end encrypted application content. The operator of that server must therefore be trusted. No application can override an explicit Android force-stop, and device vendors may impose additional background-execution restrictions.