ProofKit

A VPN client that can hide a tunnel inside a video call. Kotlin Multiplatform and Compose, one codebase for Android.

olcRTC is why this exists. Most tunnels are recognisable, and a network that inspects what crosses it drops them on shape rather than on content. olcRTC opens a WebRTC media session to a public meeting service and moves traffic inside it, so what stays on the wire is a call the network already carries. Its relays hold a fixed number of slots, and the app shows how full each room is before you join one. We maintain the engine at romanpodpriatov/olcrtc, forked from openlibrecommunity/olcrtc and carrying our own UDP wire, multi-key support and metering.

It speaks the ordinary protocols too, because a call-shaped tunnel costs bandwidth and is not needed until it is — and the moment you need the fallback is the worst possible moment to be installing a second app.

It ships as ProofKit and is built on the olcbox codebase, a fork of alananisimov/olcbox — the app's own footer says PROOFKIT • OLCBOX CORE for the same reason, and so does the repository name.

It is a client, not a service: you bring a server list from your provider — a subscription URL, a QR code, or a pasted link — and the app turns it into servers you can connect to. It is free, there is no account, nothing to sign up for, and nothing to buy here.

Protocols Protocol Engine olcRTC — a tunnel inside a WebRTC video call our own engine fork VLESS + Reality sing-box VLESS over TLS, incl. behind a CDN sing-box Hysteria2, with Salamander obfuscation sing-box XHTTP Xray, behind sing-box's tun One subscription usually carries several. The app groups them by provider, filters by protocol, and remembers the exit last used.

Features One tap to connect, with the session's elapsed time and traffic on screen. Server lists by link, QR code or file; grouped, foldable, and refreshed on a schedule you choose. What the provider says about your plan — quota, expiry, its own support and web links — read from the server list's own headers. Latency where it can honestly be measured: through the tunnel for the connection you are on, ICMP for a server you are not connected to. Sorting by ping or name, filtering by protocol, duplicate subscriptions refreshed rather than added twice. Diagnostics log with export, and a failed connection that says why. Server addresses are replaced by short tags before a line reaches the log, so the file is safe to send to anyone and still says which hop failed. Android TUN/proxy modes, SOCKS5 credentials, split tunneling. Network migration, reconnect handling, and watchdog recovery. No account, no analytics, nothing collected.