Open-Source VPN and Proxy Apps for Android, Compared (2026)

These are VPN and proxy clients, not VPN services. Each one connects to a server: one you run yourself, one your company or university gives you, or one from a provider. So the first question isn’t which app is best, but which protocol your server speaks. After that, the choice mostly makes itself.

Android lets only one app use its VPN slot at a time, so you run one of these per connection, not several side by side.

Quick picks

• You have a WireGuard configuration: WG Tunnel.
• You have an .ovpn file: OpenVPN for Android.
• Your employer or university uses AnyConnect, GlobalProtect, FortiClient or Pulse: try OpenConnect.
• You want to reach your own devices from anywhere: Tailscale.
• You have a Shadowsocks server: Shadowsocks; for several proxy protocols in one app, NekoBox.
• You don’t have a server and want a ready-made service with a free tier: Windscribe, the one app here tied to a commercial VPN provider.

At a glance

App	Protocol	What you need	Size	Trackers found
WG Tunnel	WireGuard and AmneziaWG	A WireGuard configuration	18.6 MB	None
OpenVPN for Android	OpenVPN	An .ovpn profile	39.8 MB	None
OpenConnect	Cisco AnyConnect, GlobalProtect, Fortinet and other SSL VPNs	An account on the VPN gateway	31.5 MB	None
Tailscale	A WireGuard mesh between your devices	A Tailscale account, or your own Headscale server	105.5 MB	None
Shadowsocks	Shadowsocks	A Shadowsocks server	14.8 MB	None
NekoBox	sing-box: Shadowsocks, VMess, VLESS, Trojan and more	A proxy server or subscription	15.3 MB	None
Windscribe	WireGuard, IKEv2, OpenVPN, plus two stealth modes	A Windscribe account (free plan available)	96.7 MB	None

Sizes and tracker results come from the files we host. Tailscale’s F-Droid build is flagged by F-Droid for sending debug logs without asking, which is a different thing from a tracking SDK; its page explains.

WG Tunnel: WireGuard, with automation

If your provider or server hands you a WireGuard configuration, WG Tunnel runs it and adds what the official WireGuard app lacks: it can switch tunnels on and off by itself depending on the network you’re on, with a kill switch, split tunneling by app and support for AmneziaWG, a WireGuard variant made to be harder to detect and block.

OpenVPN for Android: for .ovpn profiles

The open-source OpenVPN client by Arne Schwabe, based on OpenVPN 2.x. It is not the same app as OpenVPN Connect, the closed-source client from OpenVPN Inc., though both read standard .ovpn profiles. It supports per-app rules and automation, but not TAP mode, which Android’s non-root VPN interface doesn’t allow.

OpenConnect: for work and campus VPNs

For the SSL VPNs many organisations use: Cisco AnyConnect and the open-source ocserv, Palo Alto GlobalProtect, Fortinet, Pulse, Juniper, F5 and Array. It handles RSA SecurID and TOTP codes for two-factor logins. It isn’t affiliated with any of those vendors, and development is slow, with long gaps between releases.

Tailscale: your own devices in one network

Tailscale solves a different problem: reaching your own computers, servers and phone from anywhere, as if they were on one local network. You sign in through Google or another identity provider, or point the app at your own Headscale server if you don’t want to depend on Tailscale’s.

Shadowsocks and NekoBox: proxies for blocked networks

Both are proxy clients, widely used where ordinary VPN protocols are blocked or throttled. Shadowsocks is that project’s own app, with per-app routing, custom rules, subscriptions and plugins. NekoBox is built on sing-box and speaks several protocols, Shadowsocks among them. Proxy tools are legal in most countries but restricted in some, so check the rules where you are.

Windscribe: a VPN service’s own app

The others here are clients for servers you bring. Windscribe is the app of a commercial VPN service: you sign in to a Windscribe account and pick one of its server locations. A free account gets a monthly data allowance, larger once you confirm an email address. Its licensing is unclear (the repository’s LICENSE file says GPL, its README says proprietary), and F-Droid distributes it as free software flagged NonFreeNet because it depends on Windscribe’s servers.

Sharing the VPN with other devices

When your phone is a hotspot, connected devices don’t go through its VPN. With root, VPN Hotspot routes them through whichever VPN app you run.