Bring your provider’s link. Avelir checks that traffic gets out.
Avelir is a client, not a VPN service. Access comes from your provider as a link. Without one there is nothing to connect to — and the app will tell you so on the first screen.
Statuses read August 30, 2026. Reasons below.
Run the check yourself
Nodes marked XHTTP go through where plain TCP does not. Sweden and the Netherlands were topped up on 27 August.
Favourites 2 nodes 38 ms
SERVERS · 25 COUNTRIES 92 in total
Nothing found. Try another country, city or protocol
Nodes marked XHTTP go through where plain TCP does not. Sweden and the Netherlands were topped up on 27 August.
Connection
Appearance
More
About
Press Connect. The five seconds are the real budget, not a loading bar.
- elapsed
- 0.00 s
- Shield
- EXPOSED
What the hosts do
Requirements
Before you download
- A
- A device. Android, or Windows. Nothing else yet.
- B
- A link from your provider. This is not our part: we make the app, and we do not run a VPN service. It looks like one of these:
- C
- The app. Not published yet — the final checks are under way. When it appears
https://panel.example.com/sub/9f3c… a subscription — many servers, refreshes itself vless://… vmess://… trojan://… one server, added by hand ss://… hysteria2://… and the same again with another scheme A QR code holding any of those works too, and so does tapping a vless:// link in a messenger.
A .json config file is not one of these. Avelir does not read config files.
There is no field here to paste your link into, and there will not be. A subscription link is a key to your access. A page that teaches you to paste it into a web form has taught you the habit a fake copy of this site would need.
Your link
Your link matches one of those
Then everything the app needs is in that one string: the servers, the routing rules the provider wrote, the expiry date and how much traffic is left. Paste it once. The app keeps the list current on whatever schedule the provider asks for.
Several subscriptions can live side by side, and servers added by hand can sit alongside them.
You do not have a link yet
Then Avelir has nothing to connect to, and installing it today will show you an empty screen. Better to know now.
The link comes from whoever runs the servers: whoever set this up at your office or at home, a service you already pay for, or you, if the server is yours.
Ask for it in these words:
Please send me the subscription link for my account — the https://… address, not a config file.
Avelir sells nothing: no servers of ours, no prices, no payment. There is no list of sellers here either — a list we kept current would be a list we stood behind.
If the server is your own, the link is whatever your panel hands out. Avelir reads the standard share links and subscription pages; it does not need a panel of any particular make.
Verification
The shield has four states. Two would be a lie.
Most clients turn the shield green the moment the tunnel interface comes up. That proves the interface exists. It proves nothing about whether anything reaches the other side.
Before Avelir says Connected, a probe inbound in the core asks two hosts for an empty page — connectivitycheck., and if that stays silent, connectivity-check.. Two, in different jurisdictions and on different infrastructure, so that one of them being unreachable where you are cannot condemn a working tunnel. The answer has to come from the target itself. The whole check gets five seconds, and those five seconds are added to your connection time. That is the price, and it is the only honest one.
The check can be switched off. Then Connected means only that the tunnel came up.
5 s
| State | Says | Means |
|---|---|---|
| PROTECTED | Protected traffic goes into the tunnel | Nothing can leave past the tunnel, whether or not anything is moving through it. |
| EXPOSED | Not protected sites see you directly | Traffic is going out in the clear, and that is known rather than assumed. |
| PARTIAL | Partly protected not every program is routed | Proxy mode on Windows. Whatever asks the system for a proxy is inside the tunnel — browsers, mostly. Games, torrents, QUIC and anything with its own network stack keep their own way out, and no route table was touched, so nothing here can catch them. |
| UNKNOWN | Protection state unknown the layer below went quiet | The layer holding the tunnel stopped answering. Neither of the other three may be shown. |
Four rather than two, and four rather than three. UNKNOWN exists because a shield with two states has to guess when the layer below goes quiet, and both guesses are wrong: one promises protection nobody confirmed, the other sends you to act exposed at the one moment it matters. Every surface draws these four in different shapes as well as different colours — one man in twelve will not sort them by colour alone.
And what the connection itself is doing
- Disconnected
- Connecting
- Connected
- Reconnecting
- Link not confirmed
- Tunnel carries nothing
- Traffic blocked
- State unknown
- Error
Three of those are worth reading twice.
Link not confirmed — the tunnel is up and sealed, but neither check target answered, so the word “Connected” is withheld.
Tunnel carries nothing — the probe stayed silent and the byte counters did not move; the app says so and offers to disconnect, and will not disconnect on its own, because taking an interface down is taking protection down and that is your call.
Traffic blocked — there is no tunnel and nothing is going anywhere either, because the leak guard is holding it. That is the opposite of disconnected, and drawing them the same would hide protection that is present.
Automatic
How the app picks a server when you did not pick one
The short answer — “it takes the fastest” — is rarely the true one. A reading lives half an hour, and once the tunnel is up the numbers stop being comparable at all. So almost every connection is decided not by speed but by knowledge: which node has actually carried traffic on this network.
-
First, the cut
Out go the nodes already known, on this network, to carry nothing. The cut is soft — if it leaves nobody, it is lifted whole. Being left without a VPN is worse than coming up on a doubtful node.
-
Then a comparison — if there is anything to compare
Only readings from one run and one kind of probe are compared: a handshake measurement and a real-traffic measurement differ by an order of magnitude, and mixing them is meaningless.
- 30 minutes
- how long a reading stays fit to compare
- 2 nodes
- fewer is not a comparison: the winner of a one-runner race is no winner
- 50 ms
- a smaller gap is not a gap — otherwise the choice jitters on noise and drags you between countries
-
Otherwise, a ladder of four rungs
And that is nearly always: readings go stale in half an hour, and anyone opening the app the next day lands here every time.
- This network’s stock — a node that has actually carried traffic here
- Confirmed passage — it carried traffic once, somewhere
- Favourites — a person’s choice, not the app’s observation
- The subscription’s first node — the last ground there is
The first rung sits above the second on purpose, and this is the best part of the rule: a mobile carrier and a home router let different sets of nodes through. A node that carried traffic yesterday in another city may be blocked solid on today’s network — so “here” outweighs “once”.
-
The screen does not invent a winner
When there is nothing to compare, the line says so in words instead of naming a presumed one. And it says out of how many it chose: “chosen out of three” and “chosen out of a hundred” are different claims.
-
No measurement starts by itself
Automatic decides only from what has already been measured. Fanning out across a whole subscription at once means hundreds of connections to a hundred foreign addresses in a row from your home address; that trail hands a watcher the provider’s entire server list, and the app has no business starting it behind your back.
-
If a node goes quiet
Failover takes over — the same rule plus a cool-down: a node that has just failed is not offered again in this episode. No more than three moves per episode; after that the app says it could not, rather than spinning.
What it does
On the panel
-
Android · Windows
Split tunnelling
Choose which apps go through the tunnel, or which ones go around it. What is not selected goes out in the clear — including apps you install later. Your carrier sees their traffic, and they see your real address. The app says this on the screen where you choose. On Windows the same list is kept by executable — chrome.exe — or by the path to it, and it is typed by hand: the system does not hand out a list of installed programs. A rule by name does not cover what that program starts under another name, and a DNS query can leave before the connection has been matched to a program.
-
Windows
Traffic blocked without the tunnel (kill switch)
On Windows, filters at the WFP layer: while this is on, nothing leaves past the tunnel — including while the tunnel is down. Local network and Hyper-V guests can be let through, each a hole exactly its own size. On Android the same job belongs to the system: Always-on VPN and Block connections without VPN, and the app takes you to that screen rather than pretending it owns the setting.
-
Android · Windows
Your own DNS
Plain addresses, DNS over HTTPS, DNS over TLS. Each entry can be checked from the list, and the check reports what actually came back: answers with a time, no answer, unreachable, answered a different query, or “that is a spoofing responder, not a name server”. Order matters — all are asked, the first to answer wins.
-
Android · Windows
Your own routing rules
Send one site or one subnet through the tunnel, around it, or nowhere. Your rules are checked before the provider’s. Rules live in named sets — “At home”, “Travelling” — and the sets belong to you, not to the subscription: they outlive changing providers. A set travels as a string or a QR code, and carries rules only: no subscription, no servers, no keys.
-
Android · Windows
Automatic choice, automatic move
Automatic does not simply take the fastest: readings go stale in half an hour, so most connections are decided by which node has carried traffic on this network. The rule is set out step by step above. A server you picked by hand stays the one you picked unless you ask otherwise.
-
Android · Windows
Latency, with the spread
Measured through the core’s own inbound, so the tunnel does not time itself. Best or median, one probe or five, and a warm-up probe that is thrown away because the first request to any server is always slower. A dash means “not measured”, not “slow”.
-
Android · Windows
Four ways a link gets in
Type it, paste it from the clipboard, point the camera at a QR code, or tap a vless:// link in a messenger and let it land in the app. Several subscriptions at once, and servers of your own alongside them.
-
Android · Windows
Reachable without the window
A tile in the Android shade. An icon in the Windows tray with an emergency disconnect, and a “hide the window, keep the VPN” that means what it says.
-
Android
When the firmware kills the tunnel
Xiaomi, Huawei, Samsung, Oppo and others close background apps harder than Android prescribes, VPN service included. No app can forbid its own killing or come back on its own. What Avelir can do is take you straight to the autostart and battery screens of ten manufacturers, and say plainly when a given firmware has no such screen.
-
Android · Windows
Traffic statistics
Seven days, thirty, or all of it, broken down by server. Counted here are the bytes that went through the tunnel — traffic from excluded apps is not included, traffic the subscription’s rules sent directly is. These figures need not match your provider’s.
Also on the panel: proxy mode instead of a tunnel on Windows · traffic history by day · dark and light.
The core
What the core speaks
You do not choose among these. The server your provider issued chose already, and the link carries the choice.
- Protocols
- VLESS · VMess · Trojan · Shadowsocks · Hysteria2 · SOCKS · HTTP
- Security
- TLS · REALITY, plus the XTLS flow and VLESS Encryption on VLESS
- Transports
- TCP · WebSocket · gRPC · XHTTP · HTTPUpgrade · mKCP
- Core
- Xray-core, through libXray v26.7.11, built from the stated revision rather than taken as a ready binary
Data
What the app sends, and who receives it
When Avelir asks your provider’s panel for the server list, five things ride along with the request:
Some panels answer only clients they recognise. There is a setting for that: it puts a well-known client’s name in user-agent and moves ours to x-app-agent. It stays off unless you turn it on.
They go to the address you typed in. Not to us — we have no address to send them to, and no server to receive them on.
The identifier is not your phone. It is a random UUID made on first run and kept. It is never derived from hardware: IMEI, MAC addresses and serial numbers cannot be reset, reading them breaks both Google Play and App Store policy, and a random value counts devices just as well. Counting devices against your subscription is the whole of its job. It sits in Settings, and your provider’s support will ask you for it.
The diagnostics log strips credentials out of its entries, so it can be sent to support as it is.
Builds
Coming: Android, Windows, iOS and Linux
The Android and Windows builds of 0.3.5 exist and run, the Linux packages are built, and iOS runs on a real iPhone. Nothing is published from this site yet: the Android build is signed with a release key and is headed for Google Play, iOS is headed for TestFlight and the App Store, and the Windows installer still carries no signature.
Every status on this site carries a date. When one changes, it changes here first.
- android
- COMING ~69.7 MB when it comes
- windows
- COMING ~24.9 MB when it comes
- ios
- COMING
- macos
- PLANNED
- linux
- COMING
Questions
Questions people actually ask
Do you keep logs of what I do?
There is nothing on our side that could keep them. Avelir has no servers, no accounts and no backend; nothing about your session reaches us, because there is no “us” for it to reach. The app writes a diagnostics log on your own device, with credentials stripped from the entries, and it stays there unless you send it to your provider’s support yourself. What your provider records on their servers is between you and them, and we cannot speak for it.
What is the device identifier, and can I turn it off?
Yes, since 0.3.5 — Settings, Advanced, “Send the device identifier”. Turned off, the header is not sent at all, rather than sent empty. The cost is on the panel’s side: your provider counts device slots by it, and a panel that does so answers with no servers without it. It is a random UUID made on first run and kept; it is never derived from your hardware. It goes to the panel address you entered, not to us. You will find it in Settings, and support will ask you for it.
Does it hide my address?
The app does not answer that, and it has stopped pretending to: the check that asked an outside service for your address was removed in 0.3.5, because it meant handing a third party we do not control a request from you. What the app does prove is narrower and more useful — that traffic really leaves through the tunnel. Which address the outside world then sees depends entirely on the server your provider issued and how they run it.
Will it work on my iPhone?
Not yet, but closer than it was. Avelir has run on a real iPhone since 28 August 2026: the tunnel extension carries traffic, and the subscription, the server list and the node measurement all work. It is headed for TestFlight and the App Store, and there is nothing to install from here yet. macOS is not started. Linux is packaged and awaiting release. The statuses above carry the date they were last true.
Why is there no Google Play version?
There is no published version at all yet, on any store or anywhere else. Store submission is being prepared: the Android build is signed with a release key, the store questionnaires and the policy are done, and what is left is on the account side rather than in the code.
Is the source code open?
The core and the libraries are, and the app lists every one of them with its licence and its source. Xray-core is used as an unmodified dependency, so there is nothing of it for us to publish. Avelir’s own code is not published.