Free VPN Subscriptions

English · 简体中文 · 日本語 · 한국어 · Español · Português · Русский

---

The easiest way to get a working free VPN — copy a subscription link, paste it into your client, connect.
No signup. No payment. Refreshed hourly from public sources — every published node has demonstrably forwarded real HTTP traffic through sing-box minutes ago.

Free VPN subscriptions · free proxy list · free v2ray / clash / sing-box · VLESS / Reality / VMess / Trojan / Shadowsocks / Hysteria2 · hourly refreshed · HTTP-over-proxy verified · by country

🚀 One-Click Subscribe

Copy the URL that matches your client and paste it into the subscription import field:

Client	Format	Subscribe URL
Clash / Clash Verge / ClashX	clash.yaml	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/clash.yaml
sing-box	singbox.json	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/singbox.json
v2rayN / v2rayNG / Shadowrocket / NekoBox	v2ray-base64	https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/v2ray-base64.txt

Database-classified shards (stable / all verified / protocol / country / network): https://github.com/Au1rxx/free-vpn-subscriptions/tree/main/output

⚡ Nodes not working? Get Pekpik VPN — free, one tap

Free nodes come and go every hour. When you just need it to work:

✅ No signup — open the app and tap connect
✅ Servers in 100 countries and regions
✅ Auto-picks the fastest server for you
✅ iPhone · Android · Windows · Mac

⭐ Star this repo if it saved you time — it is the only signal we use to decide what to keep building.

💡 Why This Project?

Every "free VPN" list on GitHub is either stale, full of dead nodes, or asks you to install a sketchy binary. This repo goes further than anything else you'll find — we don't just check that a node answers the phone, we actually push HTTP traffic through it with sing-box and confirm a 204 comes back, minutes before publishing. You get 3 portable subscription files — drop them into Clash, sing-box, or v2rayN and go.

Most free-VPN lists stop at "the TCP port is open" and publish. We don't. Here is the full verification pipeline a node has to survive before it gets into the subscription.

✅ What we verify at aggregation time (before publishing)

1. TCP reachability — open a TCP connection to every server:port. Dead hosts, bad DNS, and blocked ports are dropped. ~40 % of raw entries fall out here.

2. TLS handshake — for every TLS / Reality / WS-TLS node we complete the full handshake. Expired certs, SNI mismatches, and broken Reality short-ids are dropped. ~10 % more fall out here.

3. sing-box config validation — every surviving node is translated into a real sing-box outbound and run through sing-box check. Corrupt ciphers, bad UUIDs, and unsupported flow options are dropped before they waste a probe slot.

4. HTTP-over-proxy probe (this is the big one) — we batch the fastest ~900 candidates into sing-box subprocesses, each node getting its own local SOCKS5 inbound, then push real HTTP + HTTPS GETs through it:

   • http://www.gstatic.com/generate_204 (expects 204)
   • https://www.cloudflare.com/cdn-cgi/trace (expects 200)

   The request traverses the actual proxy protocol (VLESS / VMess / Trojan / Shadowsocks / Hysteria2), so a node that passes has demonstrably functioning auth, routing, TLS inner handshake, and exit networking.

5. Two rounds, 45 seconds apart — nodes that pass once but die 45 seconds later get filtered. Only nodes with ≥ 50 % success rate across all (rounds × targets) are kept.

6. Median real-latency sort — survivors are ranked by their median HTTP-over-proxy round-trip (not raw TCP RTT), and the top N are published.

Typical numbers from a recent run: 17 sources → ~4,800 raw → ~2,900 TCP-alive → ~2,600 TLS-OK → ~840 config-valid → ~280 HTTP-verified → top 150 published. Every one of the 150 has actually forwarded traffic in the last ten minutes.

❌ What we still can't verify

• Bandwidth / throughput — we measure latency, not megabits. A 50 ms node may still be slow for video.
• Geolocation precision — GeoIP tells us the exit IP country but not the city or ISP reliably.
• Region-specific blocks — a node that works from our probe infra may be blocked from yours (ISP-level filtering, captive portals, etc.).
• Staying alive past the run — the node passed ten minutes ago; it may have died since.

🛡️ Runtime safety net — for the last bullet above

The clash.yaml we publish ships with a url-test proxy group that re-tests real HTTP through each node every 5 minutes on your device:

proxy-groups:
  - name: AUTO
    type: url-test
    url: http://www.gstatic.com/generate_204
    interval: 300

Your client keeps the node list sorted by live HTTP-over-proxy latency from your network and auto-picks the fastest working node. sing-box and v2ray have equivalent mechanisms. If a selected node dies between hourly aggregations, the client switches to the next without intervention.

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗