How HopFox VPN works

This page describes only what is running today. When something changes, the change appears here and in the news.

The protocol: VLESS Reality

HopFox VPN connects with VLESS over TCP port 443, wrapped in Reality, using the open-source engine Xray-core (version 26.3.27 on the servers and in every app).

Port 443 is the port of HTTPS, and Reality makes the connection look exactly like a TLS 1.3 session with a well-known public website: the handshake is real, the certificate belongs to that site, and there is nothing in the first packets that says "VPN". Filtering equipment that recognises and slows down conventional VPN protocols sees regular web traffic. Only a client that knows the server's key gets a tunnel; anyone else who connects to the same address is transparently forwarded to the real website and sees a normal page.

Why we chose it:

• Indistinguishable from HTTPS. There is no custom handshake to fingerprint and no VPN-specific port. This is the property we care about most, because it decides whether the app works on the network you happen to be on.
• No certificates to trust. Reality borrows the TLS identity of a real site, so there is nothing to install or approve on the phone, and nothing that could be revoked.
• Fast. With XTLS Vision, application data that is already TLS-encrypted is not encrypted a second time, so the tunnel adds very little overhead. Latency is what you would get from a direct connection to the server.
• Open source and audited by many eyes. Xray-core is developed in the open; we run the latest release and do not modify the protocol.

Automatic is the default: the app picks between the two for each network. Reality is the one to use when the network is hostile. Since version 0.5.0 there is a second choice, described below.

The second protocol: AmneziaWG

AmneziaWG is WireGuard with obfuscation: the same fast UDP tunnel, but the handshake is padded and preceded by junk packets, so it does not look like WireGuard to filtering equipment. It runs on UDP port 443 on every location, next to Reality, using the open-source amneziawg-go engine on both the servers and in the apps.

When to pick it: on a good network it is usually faster and gives lower latency than a TCP tunnel, and it keeps a connection alive while the phone switches between Wi-Fi and mobile data. When to stay on Reality: when UDP is blocked or shaped, which is common on corporate and some mobile networks; Reality is TCP and passes as HTTPS. The choice is in Settings, Protocol, in every app. Automatic, the default, always connects with Reality first, so on a filtered network nothing is sent over UDP. If Reality cannot get through on a network, the app tries AmneziaWG once and remembers for a week which protocol worked there.

In the apps

On Android the app registers a system VPN interface, so every app on the phone goes through the tunnel, including DNS. On Windows and Linux a small helper service creates the tunnel adapter, so the whole computer goes through it; on the Mac, Reality works as a system proxy and AmneziaWG as a real tunnel. Inside each app a copy of Xray-core or amneziawg-go opens the connection. The app's own conversation with the panel, and the check of your visible IP, go directly.

Latency is measured on your device, not guessed on our side: the app opens a connection to each location and times it. The Automatic choice is simply the location with the lowest number at that moment. The list does not reorder itself while you look at it; it is refreshed once an hour and when you ask.

On the servers

• Our own servers, Debian 13, kept up to date. Two processes on each: Xray-core on TCP port 443 and amneziawg-go on UDP port 443.
• Logging is set to warnings only and goes to memory, not disk. Nothing about users is written to storage on a server.
• A small agent on each server talks to our panel: which accounts are allowed, how many are online, how much traffic passed. That is the entire data model.
• The panel knows your account number, plan, device count and the time of connections. It does not know what you do inside the tunnel.

Accounts without identity

On first launch the app generates a key on your device and asks the panel for an account number. That number is the account. No email, no phone number, no password: there is nothing to leak and nothing to reset. If you want the same account on a second device, you type the number there. If you delete the account, the panel closes the number and every device linked to it loses access at once.

What is not there yet

• App for iPhone: in development.

Updated 26 October 2026.