NetGuard

byPsychopath · Tools

Verified safeOpen sourceExclusive

Download APK

—

No reviews reviews

downloads

8.0

android

AI summary

Advanced VPN client supporting VLESS, VMess, Trojan, Shadowsocks and other protocols with per-site adaptive routing, leak prevention, and encrypted profile storage. v3.0 adds WB Stream conference transports, improved tunnel stability, glass UI with 16 languages, and Wi-Fi auto-connect with Evil Twin detection.

Generated by AI. May contain inaccuracies.

About this app

NetGuard combines an authenticated local proxy, encrypted profile storage, per-site routing, and conference transports. It is designed to avoid common leak patterns found in other VPN clients.

Features

Protocols

- VLESS (+ REALITY), VMess, Trojan, Shadowsocks, Telemost, and WB Stream - Transports: TCP, WebSocket, gRPC, HTTP/2, HTTP Upgrade, SplitHTTP, KCP, QUIC

Routing

- AUTO mode: per-site comparison of reachability and response latency in the background, with a weekly cache - Global proxy: all traffic goes through the VPN - Rule-based mode with direct routing for .ir sites - Direct mode - Per-app routing: whitelist, blacklist, or disabled - DNS: custom primary and secondary servers, optional DNS-over-HTTPS through the proxy - LAN bypass: access local network devices while connected

Server and subscription management

- Auto-select best server by comparing service responses and latency - Automatic subscription update via WorkManager (6, 12, 24, or 48 hours) - Subscription headers: traffic counters, provider website and support links, and announcement text - Friendly profile names for built-in subscriptions - Sort by ping with a second tap to restore subscription order - QR code scanning (ML Kit + CameraX) and generation (ZXing) - Deep link import for vless, vmess, trojan, ss, and hy2 URIs

Security

- Zero-leak network switching: keeps the TUN interface alive while restarting its internal transport during Wi-Fi or mobile reconnects - Ephemeral authenticated SOCKS5: fresh random port, UUID username, and 32-character password per connection - Config minimally exposed on disk: xray receives its JSON configuration in memory through the libXray JNI API in a dedicated service process - Built-in security self-test with 11 automated checks - Evil Twin Wi-Fi protection using trusted SSID and BSSID pairs - SQLCipher encryption of the Room database - EncryptedSharedPreferences for key material and small secrets - Log redaction for UUIDs, passwords, and Bearer tokens - SSRF protection with private, loopback, and link-local address blocking - Tapjacking protection on critical buttons - Deep link validation with confirmation dialog - Atomic file writes - No cleartext traffic except speed-test domains through the VPN tunnel - No backup - DNS leak prevention: all port 53 traffic forced through the proxy - DNS address validation - Input size limits on URIs, subscriptions, and imports

Service availability testing

Test which services actually work through each server, including YouTube, Telegram, Instagram, ChatGPT, Discord, Google, X, and Spotify, with a score before connecting.

- Connection map with animated world map and user-to-server arc - Speed test: download, upload, and ping through the VPN tunnel - Wi-Fi auto-connect on untrusted networks, with Evil Twin detection - Material You dynamic color theme on Android 12+ - Home screen widget with one-tap connect and disconnect - Quick Settings tile - Notification panel toggle - Boot auto-connect - Themes: Dark, Light, OLED Black, Ocean, fsociety, Dynamic (Material You) - 16 interface languages - Backup and restore of the full configuration as JSON - Real-time xray logs with automatic credential redaction - Traffic statistics: real-time speed, session, daily, weekly, and total counters - App-launch trigger mode: pick which apps go through the VPN, with no fallback path and pre-warming for instant connection - Onboarding wizard on first launch - Subscription URL masking to avoid token leaks

Requirements

- Android 8.0 (API 26) or higher. - ARM64 device (current release provides a signed ARM64 APK). - An xray-compatible profile or subscription is required.

License

Apache 2.0

vpn proxy privacy network tools open source offline

What's new

v3.0.0Oct 5, 2026

WB Stream
Create conference transport profiles from the managed-server wizard, import WB room links and resume setup in the background. - A room is only marked ready after live room and publisher state are checked. - Improved transport stability, reconnect handling and relay cleanup.
Connection
Connected status now requires a confirmed exchange through the tunnel. - Server selection considers service responses together with latency, and supports cancellation. - The home screen now follows the actual active server after a switch.
Adaptive routing
AUTO compares direct and VPN paths as sites are encountered, with a seven-day cache. - Apps can be forced through the VPN. - A direct route exposes your normal public IP, so choose Global proxy when all traffic should use the VPN.
Interface
Glass interface with refreshed icons, panels and connection map, and an accent color that follows connection state. - The home screen adapts to the viewport without scrolling. - All six themes remain, and the launcher icon can follow the theme. - Added sixteen languages for app screens, dialogs, notifications and diagnostics.
Wi-Fi auto-connect
Network checks now follow the current physical Wi-Fi association, and a hidden identity is treated as untrusted.
Security and reliability
Executables are checked by SHA-256 and a smoke test before replacement, with a backup. - SSH setup requires confirming a new server's fingerprint and rejects a changed key. - SSH and agent management now use the app's VPN proxy. - Fixed UDP transport cleanup issues, with reliable retries and no duplicate delivery.