Outline

Outline Client is the Android half of the open-source Outline system. A server operator creates an Outline server and shares a unique access key; the client imports that key and routes the phone through the server using Android’s VPN interface. It also accepts Shadowsocks keys using the AEAD methods supported by this release, including ChaCha20-IETF-Poly1305 and AES-GCM. It does not implement SIP003 plugins or the Shadowsocks 2022 methods, so “Shadowsocks compatible” does not mean every profile will work.

This page covers the official stable 1.22.5 APK linked by Outline’s own developer documentation. We downloaded that exact address, checked its package, manifest, hash and signing certificate, and compared its behaviour claims with the tagged Android client source. We did not connect it to a live server or capture its network traffic.

What you need before installing

Outline does not include free locations, sell a subscription or discover public servers. You need one of these:

• an invitation from an Outline server administrator;
• your own server deployed with Outline Manager; or
• connection details for a Shadowsocks server using one of the client’s supported AEAD methods.

An Outline invitation embeds a credential. Treat it like a password: anyone with the key may be able to use the server until its administrator revokes it. Static keys contain the server address, port, password and encryption method. Dynamic keys point to a remote configuration that the administrator can update; the client fetches that configuration outside the VPN, so its host sees your direct IP. A dynamic configuration can also name a provider-controlled reporter endpoint for periodic connection reports.

After you add a server, Connect starts Android’s VPN service. Only one ordinary Android VPN can be active at a time. Android can replace a normal active VPN, but a different app configured as always-on prevents Outline from taking the slot until that setting is changed. Outline excludes local and private subnets from its tunnel, so traffic to LAN devices does not go through the server. What the remote server can reach and how fast it is still depend on its operator.

Privacy acknowledgement and Sentry

The APK contains the Sentry SDK, which our static scanner identifies as a tracker in the crash-reporting category. It is not merely an unused dependency and is not limited to feedback, errors and crashes. The release initialises native and browser Sentry at startup, before the first-run privacy acknowledgement, and neither that acknowledgement nor Settings provides an off switch. Both bundled SDKs keep their default automatic session tracking, so opening or foregrounding the app can contact Sentry even when no error occurs.

For native events, Outline’s beforeSend hook removes the Sentry user, device ID and name, screen dimensions, boot time and rooted status. Automatic session envelopes do not pass through that hook and can retain the installation identifier; web-layer events also do not use the same native field-removal step. The SDKs keep lifecycle, system-event and network-change breadcrumbs. Native INFO-level logs become breadcrumbs too: the selected server name is logged, and when a dynamic key has no friendly name that value is the configuration URL’s host. Feedback can attach your message, optional email and up to 50 lines from the VPN process log.

Those details come from the tagged release source and bundled SDK defaults, not a packet capture. They establish that version 1.22.5 has reporting paths beyond crashes, but do not prove the exact contents of every transmission on every device.

This distinction matters for the “no trackers” label: the client is open source, but version 1.22.5 is not tracker-free. The measured APK declares internet and network-state access, foreground-service permissions and boot completion. Those are also expected for maintaining a VPN tunnel.

Official sideload, updates and trust

Outline’s official alternative-download page links this stable APK from its S3 release bucket and explicitly warns that sideloaded copies do not update automatically. Check that page for a new version periodically. Do not take an “Outline APK” sent through a chat or an unrelated mirror; the project describes the links on that page as its only official download sources.

This is the first Outline file recorded by this site. Its SHA-256 signing-certificate fingerprint is pinned as f7868b842694a793d2afe471ce1079773c9c7c528a5185cb415c8dccbf1b784d; a later APK with a different signer will be stopped for review rather than silently published.

F-Droid’s main repository also carries a source-built Outline package with the same Android package name but a different signing certificate and an older release line whose displayed version name is malformed by its recipe. It cannot update this official sideloaded build in place, or vice versa. Switching between them requires uninstalling first and can remove the saved server list, so export or retain your access keys before changing source.

About this file

• This is the official stable Android APK, 1.22.5 (version code 498232), downloaded from the fixed link in Outline’s developer documentation. Compared with 1.22.0, its tagged Android source (client_android/v1.22.5-rc.1) updates the web layer’s @sentry/browser package, fixes Android/Capacitor error-message display and changes shared client layout and release packaging; the native Sentry SDK and the VPN protocol claims on this page are unchanged.
• The 42.0 MB file needs Android 10 or later and includes 32- and 64-bit ARM and x86 native libraries.
• Its measured SHA-256 is 7cff6c4ce6ad3911bd5e40f4d07b024113383b559834511ff979a05386bf7b6c.
• Our static scan found Sentry. The source and bundled SDK defaults confirm automatic sessions as well as error, crash and feedback paths; we did not run the app or inspect live traffic.
• Outline Client is licensed under Apache-2.0. The client needs a server or access key; the APK itself is not a VPN subscription.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).