enkinvsh/dropweb

---

dropweb is a private VPN and proxy client for Android, Windows, macOS and Linux, built on the mihomo (Clash.Meta) core. You connect your own configuration; dropweb establishes the connection and handles routing.

The dropweb team follows open-source principles, privacy by default, and predictable behavior across every platform. No activity logs are kept; dropweb does not provide servers and does not interfere with traffic — configurations and keys remain on the device.

---

Key differentiators

On-device leak protection

Most clients keep an open local proxy port that any app on the same device can reach — a potential channel for leaking your IP. On mobile, dropweb closes it by default: a random port on every launch, mandatory proxy authentication, and routing through the TUN interface only, with no separate listeners. The local proxy is not reachable by other apps on the device.

One-tap country

The Subscription page fits on one screen: the subscription card, the current server with its ping, and an All traffic through VPN switch. Pick a country and the route goes through it; pick Auto and the app keeps the fastest server on its own, without hopping between servers over small speed differences. No separate modes, tabs or YAML editing needed.

Modern TLS profiles

dropweb shapes the TLS handshake of outbound connections after a current browser profile, including custom Firefox 148 and Safari 26 profiles with the post-quantum X25519MLKEM768 key exchange. These profiles are not available in upstream uTLS.

Connection & subscription resilience

Optional TLS fragmentation improves handshake reliability on unstable and congested networks (enabled by the provider in the subscription config). The subscription itself updates even when the VPN is connected and its servers stop responding: after three seconds, the app races a direct request outside the tunnel. When the primary address is unreachable, the client rotates through mirror addresses and an Ed25519-signed beacon list.

Accurate connection state

The indicator becomes active only when the tunnel is established: the core confirms readiness to the UI. False "connected" states are not possible; on failure, the app rolls back to the disconnected state.

---

Comparison

Capability	dropweb	mihomo/Clash GUIs	Xray/sing-box GUIs
On-device privacy (local proxy isolation)	by default	rare / optional	rare
TLS connection resilience (ClientHello fragmentation)			in the core, usually manual JSON only
Modern TLS profiles (Firefox 148 / Safari 26, post-quantum)		uTLS presets only	often incompatible
One-tap country selection (the mode follows)
Subscription update outside a dead tunnel and mirror failover
Accurate connection state (UI waits for the real tunnel)
Android + Windows + macOS + Linux from one codebase		partial	rare

_{— out of the box · — partial / manual only · — none. Comparison reflects the ecosystem as of 2026; many features exist in the cores but aren't surfaced in the client UI.}

---

Features

Connectivity

• One-tap subscription import from the clipboard, via URL, QR code or email sign-in (in non-store builds); background auto-update without creating duplicates when re-adding
• Subscription updates outside the tunnel when the active VPN stops responding, with failover across mirror URLs and an Ed25519-signed beacon list
• Automatic recovery after freeing a device slot (x-hwid-limit)
• One-tap country selection: Auto keeps the fastest server, a chosen country carries the route without breaking direct rules
• An All traffic through VPN switch when the subscription supports it
• Cascade routes; under mobile internet restrictions, the whitelist from the subscription
• Core protocols: VLESS (Reality / Vision / XHTTP), VMess, Trojan, Hysteria2, TUIC, ShadowTLS, AnyTLS, WireGuard
• Import of sing-box configs and share-link lists (vless://, trojan://, ss://, hy2://, etc.)

Privacy & security

• Local proxy isolation: random port + authentication, routing through TUN only
• Modern TLS profiles with post-quantum key exchange
• Optional TLS fragmentation for connection resilience
• Rule-based routing, geosite/geoip, per-app split tunneling
• Diagnostics export with automatic redaction of passwords, keys, UUIDs and server IPs
• mihomo (Clash.Meta) core v1.19.31 with up-to-date security fixes

Interface

• Dark Lumina theme with liquid glass: a glass connect button, MENU pill and swipe-to-dismiss notifications; on mobile, the subscription, account and settings sheets grow directly out of the card or pill as one piece of glass, and on desktop pages open with a liquid zoom
• 6 color presets, custom accent and background-orb colors, pure black OLED mode and text scaling
• Rendering performance is maintained on mid-range hardware
• One-screen Subscription page: switching, updating, support and deleting subscriptions live in one menu
• Russian, English, Japanese and Chinese
• Native system tray on Windows/Linux and status bar on macOS
• Updates via Google Play, and for site/GitHub builds — parallel mirror checks (Yandex Cloud, GitHub, site) with APK signature verification

---

Efficiency & reliability

dropweb uses less battery and memory than comparable clients built on the same core, through targeted optimizations across the stack.

Battery & background

• Proxy-group polling stops when the app is backgrounded, eliminating the 20-second wakeup cycle
• UI rendering is paused in the background
• The network is refreshed only when the screen turns on — fewer radio and CPU wakeups
• Heavy smart groups from a subscription are switched to plain fastest-server selection — no constant probing and no private database
• The battery-optimization exemption is requested contextually — only after the first successful connection

Memory & stability

• Bounded Go heap (192 MB soft limit + earlier GC) — predictable RAM usage on mid-range hardware
• Core panic protection: a failure in one goroutine doesn't take down the VPN process
• Config caching — instant switching with no core re-initialization
• Atomic profile writes and lazy geodata loading
• A third smaller core: Tailscale, ZeroTier and EasyTier are removed — mesh protocols that VPN provider subscriptions never use

Built for modern Android

• 16 KB memory page alignment — compatible with new devices and Google Play requirements
• minSdk 24 and strict (fail-closed) release signing

---

Provider customization

An operator defines the client's appearance and behavior through the subscription response HTTP headers — no separate build, no fork. A single client binary can be branded independently for any number of operators.

Through dropweb-* headers an operator can set:

• Single-header theme — accent color, two background-orb colors, a color-scheme filter, blur and logo style — watermark or inline icon (dropweb-theme)
• Logo and service name on the subscription card (dropweb-logo, dropweb-servicename)
• Email sign-in and account area (in site and GitHub builds) — sign-in by email code with biometrics, auto-imported subscription, pre-authenticated web cabinet and contextual renewal and top-up actions (dropweb-account, dropweb-cabinet, dropweb-renew-url, dropweb-topup-url)
• Subscription mirror failover — mirror list, stable subscription ID against duplicates, and an Ed25519-signed beacon of new addresses (dropweb-sub-mirrors, dropweb-sub-id, dropweb-sub-beacon, dropweb-sub-beacon-key)
• Announcements, support and device-limit management (announce, support-url, dropweb-device-remove)

The user retains control of appearance: the "Theme from subscription" and "Logo from subscription" toggles (on by default) restore the default appearance at any time; operator-supplied values are not applied when these toggles are off.

---

Privacy

dropweb is a client: the app does not provide server infrastructure. You connect your own configuration (subscription), which the app uses to establish a connection. Traffic is not modified, no ads are shown, and no logs of network activity are retained. Configurations and keys are stored in on-device secure storage and are not transmitted.

---

Open source

dropweb is distributed under the GPL-3.0 license — the source code is fully open and available for audit. The project is based on FlClashX (a fork of FlClash) and uses the mihomo (Clash.Meta) core; we are grateful to their authors and communities.

• FlClashX (© pluralplay) — https://github.com/pluralplay/FlClashX
• FlClash (© chen08209) — https://github.com/chen08209/FlClash
• mihomo / Clash.Meta (© MetaCubeX) — https://github.com/MetaCubeX/mihomo

---

Community

• Telegram discussion forum

License

GPL-3.0 — see LICENSE.

---

_{dropweb is a tool for the privacy and security of your own traffic. Permitted use is defined by the laws of your country; the user is responsible for how the app is used.}