sing-box

sing-box describes itself as “the universal proxy platform”: a program, written by the developer nekohasekai, that connects through many proxy and VPN protocols and decides by rules which traffic goes where. sing-box for Android, short SFA, is the project’s own app for it. Its documentation: “Maintained by Project S to provide a unified experience and platform-specific functionality.” The same developer’s earlier Android app, SagerNet, was archived in January 2024. Version 1.14.4 came out on 24 October 2026 with fixes and improvements; the 1.15 versions on GitHub are still alphas, which we don’t host.

NekoBox, also on this site, uses the same sing-box core but is a separate, third-party app.

What it runs

SFA has no servers and no built-in configuration. You give it a profile, which is a sing-box configuration in JSON:

• Local, imported from a file, scanned from a QR code, or written in the built-in editor.
• Remote, from a web address, which the app downloads again every 60 minutes by default; you can set any interval from 15 minutes up.

What the configuration can use, from sing-box’s documentation for this version: Shadowsocks, VMess, VLESS, Trojan, Hysteria and Hysteria2, TUIC, ShadowTLS, AnyTLS, NaiveProxy, Snell, SSH, SOCKS and HTTP proxies, and as full connections WireGuard, Tailscale, OpenVPN and OpenConnect, which 1.14.0 added and which reaches Cisco AnyConnect, GlobalProtect, Fortinet and other company VPNs.

When the profile asks for a TUN interface, SFA runs it through Android’s VPN service; otherwise it runs as a local proxy. You can include or exclude single apps, and the app also has a network quality test, a STUN test, a terminal for Tailscale SSH and Taildrop file sharing. A few options need root: automatic redirection of traffic, and the bridge outbound.

The LSPosed module

The APK also contains an optional module for LSPosed called Privileged Enhancement. Turned on for chosen apps, it changes what those apps see of the phone’s network, so the VPN and installed VPN apps are hidden from them, and it can rename the VPN interface. It is off by default with an empty app list, needs LSPosed, which in turn needs root, and has no effect otherwise. The app itself warns that hiding the VPN from a VPN app may cause problems.

What goes online

• Nothing until you add a profile. On first start, the app asks: “Would you like to enable automatic update checking from GitHub?” The check stays off unless you agree; you can switch the source to F-Droid, and installing updates by itself is a separate option, also off.
• Remote profiles are downloaded from the address you gave. The app’s web requests tell the server its version and your phone’s language.
• Everything else is up to your configuration: DNS servers, downloaded rule sets, connection tests. A configuration without DNS servers uses the phone’s own. The GeoIP and Geosite databases older versions downloaded were removed in sing-box 1.12.
• No analytics or crash reporting. Crash reports are kept on the phone and leave it only if you share them, optionally encrypted with the project’s public key. The privacy policy: “the data generated by the software is always on your device.”

About this file

• This is the developer’s own build of version 1.14.4, byte for byte SFA-1.14.4-universal.apk from the project’s GitHub release. F-Droid checks that the app builds reproducibly and then distributes the same signed file, so this copy, GitHub’s and F-Droid’s update one another. The project keeps its release keystore, the file that holds this signing key, in its public repository, protected by passwords kept in its build system.
• The 127.3 MB file runs on Android 7.0 and later, on ARM and x86, 32- and 64-bit. The documentation still says Android 5.0, which applies to separate legacy builds on GitHub. It declares 22 permissions: network access and changes, location for Wi-Fi rules, local network access on Android 17, the camera for QR codes, the list of installed apps for per-app routing, installing and silently updating itself, Shizuku, which it can use for those updates, the foreground service, restarting after a reboot if it was running, the battery-optimization request, notifications, and storage on Android 9 and older for saving images.
• sing-box is licensed under the GPL-3.0 or later, with an added term: “no derivative work may use the name or imply association with this application without prior consent.” This is the unmodified app, and we aren’t associated with the project. Its core bundles gVisor, Tailscale and, for NaiveProxy, Chromium’s network stack; the terminal brings 603 colour themes.
• The project’s own screenshots are only 133 pixels wide, so ours come from its Google Play listing; they show the interface of version 1.6 from 2023, which 1.13 replaced.

Shizuku API. Uses the Shizuku API, so it can do ADB-level work without root once Shizuku is running. (rikka.shizuku.ShizukuProvider)

Xposed API. Built against the Xposed API. It needs an Xposed framework such as LSPosed, which in turn needs root. (de.robv.android.xposed.XC_MethodHook$MethodHookParam)

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.