dot.

Minimal VLESS and Hysteria2 client for Android and Windows with an AMOLED-first, Nothing-inspired interface.

Latest published release: v0.4.0 (18 October 2026 Hysteria2 compatibility hotfix). Android is a development-signed debug APK; Windows is an unsigned portable x64 build. Both release downloads have been tested by their maintainer on real devices, but support still depends on the provider and network. Website · Changelog · Release notes.

Features

• VLESS with REALITY / TLS
• Hysteria2 over TLS and UDP/QUIC (hy2:// and hysteria2://); optional Salamander finalmask and packet size range
• HTTPS subscription import
• plaintext and Base64 subscription decoding
• multiple subscription groups
• per-subscription device identity (X-HWID), with edit, copy and manual regeneration
• subscription refresh reports with added, edited and deleted node counts/details
• classified subscription update errors with redacted raw-error viewing while keeping existing nodes intact
• node selection and persistence
• one-tap AUTO NODE action that picks the fastest successful tested node and connects to it
• per-subscription node sorting by provider order, delay or natural name order
• delay sorting runs URL tests first when current latency data is unavailable
• LIST / MAP views for nodes, with LIST as the default
• interactive world map with real country geometry, borders, Mercator projection, pinch zoom and pan
• DNS + IP geolocation for subscription nodes with local caching
• fallback country detection from node flags, ISO codes and country names when IP geolocation fails
• country-level node grouping so multiple nodes do not overlap on the map
• node latency / connection tests through libXray URL testing
• direct node selection and switching while connected
• per-app split tunneling with all-apps, exclude-selected and only-selected modes
• network-aware reconnect after Wi-Fi/mobile-data changes
• capped reconnect backoff: 1s, 2s, 5s, 10s, then 30s
• connection failure classification for DNS, timeout, refused, TLS, REALITY, TUN, config and Xray startup errors
• Android VpnService + TUN integration
• libXray / Xray-core backend
• realtime upload/download traffic
• foreground VPN notification with active node and traffic
• Quick Settings connect/disconnect tile, including reconnect/waiting states
• long-press Quick Settings tile opens dot.
• AMOLED, Graphite and Matrix themes
• selectable launcher icon variants
• no accounts, ads, analytics or telemetry

Mobile interface

Android uses a small three-destination layout:

• Home is connection-first: the pixel orb, connection state, active node, traffic and connection test stay in one place
• Nodes contains the one-tap AUTO NODE action, subscription switching, refresh/test actions, sorting, LIST/MAP views and per-node controls
• Settings contains subscriptions, split tunneling, connection state, appearance and app information

The primary destinations use a floating pill navigation bar above the Android system navigation/gesture area. The selected destination is highlighted as an inner pill with the dot. red accent, while navigation automatically respects the system navigation inset.

The redesign changes information hierarchy without removing the existing node map, latency tests, sorting, subscription management, theme selection or launcher-icon controls.

AUTO NODE

AUTO NODE is a one-shot action at the top of the Nodes list rather than a persistent mode.

Tapping it chooses the successful node with the lowest available measured latency and connects to that node. If latency data is not available while the VPN core is idle, dot. runs the existing group URL test first, selects the fastest successful result and then continues into the normal Android VPN permission/connect flow.

When a tunnel is already active, AUTO NODE can switch immediately when usable latency results are already available. It does not continuously override later manual node selections.

Connection reliability

The Android VPN service observes default-network changes through ConnectivityManager.

If Wi-Fi or mobile data disappears while a tunnel is active, dot. moves to waiting for network instead of treating the interruption as a permanent failure. When connectivity returns, the same selected VLESS or Hysteria2 node and split-tunnel configuration are re-established automatically.

Failed reconnects use capped backoff intervals of 1, 2, 5, 10 and 30 seconds; further retries stay at 30 seconds. A manual disconnect cancels the reconnect loop immediately.

Startup failures are classified into readable categories such as DNS, timeout, connection refused, TLS, REALITY, TUN, invalid configuration and Xray startup failure. The latest category and reconnect attempt are exposed in Settings while the detailed runtime error stays local to the process.

Split tunneling

Split tunneling is applied at the Android VpnService.Builder layer before the TUN interface is established. The Xray profile itself remains unchanged.

Three routing modes are available:

• ALL APPS routes the device through the VPN as before
• EXCLUDE SELECTED keeps the VPN as the default but lets selected apps use the normal network
• ONLY SELECTED APPS places only the selected apps inside the VPN

Only launchable applications are shown in the selector, so dot. does not request Android's broad QUERY_ALL_PACKAGES permission. Rules are stored by package name and survive app upgrades. Missing/uninstalled packages are ignored in exclude mode; include-only mode refuses to establish a tunnel if none of the selected packages are currently installed, avoiding an unsafe fallback to all-app routing.

Changing split-tunnel rules while connected does not mutate the live TUN interface. The UI offers an explicit reconnect action to apply the new app routing.

Subscription updates

Each subscription has its own locally generated HWID for subscription-service compatibility. It uses 128 random bits (dot- followed by 32 lowercase hexadecimal characters), survives restarts, and is never derived from hardware identifiers. Existing subscriptions receive an HWID once during migration.

Change, paste, copy or regenerate it in Settings → Subscriptions → Add/Edit on Android and Settings → Subscriptions → EDIT on Windows. Saving a regenerated value changes the identity presented by that subscription. Values are preserved exactly; both clients accept 10–64 ASCII letters, digits, = or -. There is no automatic rotation.

Subscription downloads send x-hwid, x-device-os, x-ver-os and x-device-model alongside the existing User-Agent. Identity headers are scoped to the subscription origin and removed on redirects to a different origin. They are never added to VPN traffic, node tests, GeoIP or other requests. See device identity details and validation.

Refreshing a subscription compares the newly parsed VLESS and Hysteria2 nodes with the currently stored nodes before replacing them. dot. reports added, edited and deleted nodes, preserves the selected node when the same logical endpoint was edited, and carries matching latency results across the refresh.

If downloading or parsing fails, the previous working node list is retained. The error dialog presents a readable explanation and an optional raw error view; subscription credentials, VLESS user IDs, Hysteria2 authentication and obfuscation passwords are redacted before raw errors reach the UI.

Node sorting

Sorting is stored independently for each subscription:

• ORIGIN keeps the exact order received from the provider
• DELAY orders successful URL-test results from lowest to highest latency, then failed and untested nodes
• NAME uses natural numeric ordering, so France #2 comes before France #10

Choosing DELAY without current test data starts the existing group URL test first and keeps the list stable until that batch completes. The selected sort mode is also applied to node lists opened from country markers on the map.

Node map

The map is a lightweight custom Compose renderer rather than a full map SDK. It downloads low-resolution country GeoJSON, caches it locally, renders real borders with a dark ProtonVPN-inspired presentation and keeps node markers interactive while zooming and panning.

Node location resolution follows a fallback chain:

1. resolve the node hostname to a public IP
2. perform IP geolocation
3. if that fails, infer the country from the node name using an emoji flag, ISO code or common country name

Only the resolved node IP is sent to the geolocation provider; subscription URLs, UUIDs and VLESS credentials are not included.

Design

dot. intentionally keeps the interface small: pure-black AMOLED surfaces, monospace/Courier-like typography, sharp geometry and pixel-art accents inspired by Nothing OS.

Installation

Download from the current v0.4.0 release (or from the dot. website):

Platform	Download	Notes
Android 8.0+ (API 26)	dot-android-0.4.0-dev-debug.apk	0.4.0-debug, versionCode 401, package dev.dotclient.android.debug; signed using the public development key, not production-signed
Windows x64	dot-desktop-0.4.0-windows-x64.zip	Unsigned release-mode portable executable; extract the complete ZIP and keep runtime/ next to dot-desktop.exe

On Windows, Microsoft Edge WebView2 Runtime and administrator privileges are required for VPN routing. Android upgrades preserve existing application data only if the package ID and signing certificate match. The 401 build can replace an earlier development-signed 0.4.0-debug build with versionCode 400 without uninstalling. No iOS, macOS or Linux binary is currently distributed.

Verify the exact current release assets (SHA-256):

9c56aad2124e2b45acf54893e76fe44548fa3818dea55502a372925a106774c1  dot-android-0.4.0-dev-debug.apk
88e71c0eeb109a12b2fa9fb5bcb295fa6f6f0e56d7bcf01004f391a29f7596a3  dot-desktop-0.4.0-windows-x64.zip

The release also provides SHA256SUMS. On 18 October 2026, both initial v0.4.0 download assets were replaced with the verified Hysteria2-fix binaries from Actions run #39111580483, source commit 9d7064c3. The original v0.4.0 Git tag has not moved and points to an earlier revision; use the release download assets above to get the patched binaries.

See Desktop, Hysteria2 validation and Release process for limitations, tests and provenance.

Build from source

Requirements:

• JDK 17
• Android SDK 36 / Build Tools 36.0.0
• Gradle 9.5.0

CI downloads the pinned libXray Android AAR (v26.7.28) into app/libs/libXray.aar before compilation. For local Android builds, provide that AAR first using the same pinned upstream release.

gradle testDebugUnitTest
gradle assembleDebug

APK output:

app/build/outputs/apk/debug/app-debug.apk

Windows development

The Windows client uses Tauri 2, Rust, React and TypeScript. From desktop/, run npm ci, npm test, and npm run build. Building or running the Tauri VPN backend requires a Windows environment with Rust and the pinned xray.exe / wintun.dll placed in desktop/src-tauri/runtime/. See Desktop.

Privacy

Treat subscription URLs, VLESS UUIDs, Hysteria2 authentication/obfuscation passwords and subscription access tokens as credentials. Do not publish private links or unredacted runtime logs.

Split tunneling stores only Android package names selected by the user. dot. does not need broad installed-package visibility and does not send the app selection anywhere.

AUTO NODE selection and reconnect diagnostics remain local to the device. dot. does not upload latency history, network state or runtime VPN errors.

Stack

Kotlin · Jetpack Compose · Android VpnService · OkHttp · libXray / Xray-core · Rust · Tauri 2 · React · TypeScript · GitHub Actions

Documentation

• Architecture
• VPN engine
• Changelog
• Desktop
• Subscription identity / HWID
• Release and checksums
• Contributing

License

Copyright (C) 2026 atlasru and contributors. Original dot. source code is licensed under the GNU General Public License v3.0 or later (GPL-3.0-or-later).

You may use, study, modify and redistribute dot., including for commercial purposes. When redistributing a GPL-covered modified version, you must comply with the GPL's corresponding-source and license obligations: distributing a proprietary/closed-source derivative is not permitted under the GPL.

The Xray/libXray/Wintun runtimes and other third-party packages retain their own copyright and license terms. See third-party notices and original license texts in third_party_licenses/.

Important release distinction: This licensing change applies to the repository from the commit that introduced LICENSE. The already published v0.4.0 binaries were built from an earlier source revision; their bytes and checksums have not been modified or retrospectively rebuilt with the new notices. New GPL-distributed binaries should carry the GPL and third-party notices and point to their exact corresponding source.