Free VPN Subscriptions

English · 简体中文 · 日本語 · 한국어 · Español · Português · Русский

---

The easiest way to get a working free VPN — copy a subscription link, paste it into your client, connect.
No signup. No payment. Refreshed hourly from public sources — every published node has demonstrably forwarded real HTTP traffic through sing-box minutes ago.

Free VPN subscriptions · free proxy list · free v2ray / clash / sing-box · VLESS / Reality / VMess / Trojan / Shadowsocks / Hysteria2 · hourly refreshed · HTTP-over-proxy verified · by country

🚀 One-Click Subscribe

Copy the URL that matches your client and paste it into the subscription import field:

Client	Format	Subscribe URL
Clash / Clash Verge / ClashX	clash.yaml	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/clash.yaml
sing-box	singbox.json	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/singbox.json
v2rayN / v2rayNG / Shadowrocket / NekoBox	v2ray-base64	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/v2ray-base64.txt

Database-classified shards (stable / all verified / protocol / country / network): https://github.com/Au1rxx/free-vpn-subscriptions/tree/main/output

⚡ Nodes not working? Get Pekpik VPN — free, one tap

Free nodes come and go every hour. When you just need it to work:

✅ No signup — open the app and tap connect
✅ Servers in 100 countries and regions
✅ Auto-picks the fastest server for you
✅ iPhone · Android · Windows · Mac

⭐ Star this repo if it saved you time — it is the only signal we use to decide what to keep building.

💡 Why This Project?

Every "free VPN" list on GitHub is either stale, full of dead nodes, or asks you to install a sketchy binary. This repo goes further than anything else you'll find — we don't just check that a node answers the phone, we actually push HTTP traffic through it with sing-box and confirm a 204 comes back, minutes before publishing. You get 3 portable subscription files — drop them into Clash, sing-box, or v2rayN and go.

Most free-VPN lists stop at "the TCP port is open" and publish. We don't. Here is the full verification pipeline a node has to survive before it gets into the subscription.

✅ What we verify at aggregation time (before publishing)

1. TCP reachability — open a TCP connection to every server:port. Dead hosts, bad DNS, and blocked ports are dropped. ~40 % of raw entries fall out here.

2. TLS handshake — for every TLS / Reality / WS-TLS node we complete the full handshake. Expired certs, SNI mismatches, and broken Reality short-ids are dropped. ~10 % more fall out here.

3. sing-box config validation — every surviving node is translated into a real sing-box outbound and run through sing-box check. Corrupt ciphers, bad UUIDs, and unsupported flow options are dropped before they waste a probe slot.

4. HTTP-over-proxy probe (this is the big one) — we batch the fastest ~900 candidates into sing-box subprocesses, each node getting its own local SOCKS5 inbound, then push real HTTP + HTTPS GETs through it:

   • http://www.gstatic.com/generate_204 (expects 204)
   • https://www.cloudflare.com/cdn-cgi/trace (expects 200)

   The request traverses the actual proxy protocol (VLESS / VMess / Trojan / Shadowsocks / Hysteria2), so a node that passes has demonstrably functioning auth, routing, TLS inner handshake, and exit networking.

5. Two rounds, 45 seconds apart — nodes that pass once but die 45 seconds later get filtered. Only nodes with ≥ 50 % success rate across all (rounds × targets) are kept.

6. Median real-latency sort — survivors are ranked by their median HTTP-over-proxy round-trip (not raw TCP RTT), and the top N are published.

Typical numbers from a recent run: 17 sources → ~4,800 raw → ~2,900 TCP-alive → ~2,600 TLS-OK → ~840 config-valid → ~280 HTTP-verified → top 150 published. Every one of the 150 has actually forwarded traffic in the last ten minutes.

❌ What we still can't verify

• Bandwidth / throughput — we measure latency, not megabits. A 50 ms node may still be slow for video.
• Geolocation precision — GeoIP tells us the exit IP country but not the city or ISP reliably.
• Region-specific blocks — a node that works from our probe infra may be blocked from yours (ISP-level filtering, captive portals, etc.).
• Staying alive past the run — the node passed ten minutes ago; it may have died since.

🛡️ Runtime safety net — for the last bullet above

The clash.yaml we publish ships with a url-test proxy group that re-tests real HTTP through each node every 5 minutes on your device:

proxy-groups:
  - name: AUTO
    type: url-test
    url: http://www.gstatic.com/generate_204
    interval: 300

Your client keeps the node list sorted by live HTTP-over-proxy latency from your network and auto-picks the fastest working node. sing-box and v2ray have equivalent mechanisms. If a selected node dies between hourly aggregations, the client switches to the next without intervention.

This is the beginning of the README. Read the rest at the original. Read the full README ↗