NaiveProxy Clients and Servers: Free Tools That Run It, Ranked
None of the seven entries on this page sells NaiveProxy servers or a subscription. Everything listed is free, open-source software: five client apps or cores, one self-hosted panel and the NaiveProxy project itself. The client installs in minutes; the server, domain and certificate are yours to handle. Read more
Sorted by this page’s weighting: Censorship bypass weighs 40% on this page. Each row also shows the overall score.
Ready-made lists
- Works under heavy blocking
- Anonymous
- Honest free
- Trial without a card
- No price rise at renewal
- Netflix and streaming
- Gaming
- For business
All filters by topic: Price and payment · Anonymity and privacy · VPN security · VPN protocols · VPNs by platform · VPNs by use case · Travel and restrictions · VPN jurisdictions · VPN servers by country · VPN customer support · VPN segments
| # | Service | Page score | Protocols | Clients and configs | Obfuscation | |
|---|---|---|---|---|---|---|
| 1 | L×Box | 4.38overall 2.64 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links; Base64; Xray… | Yes DPI bypass: REALITY, XHTTP,… | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links; Base64; Xray…; Obfuscation: yes (DPI bypass: REALITY, XHTTP,… |
| 2 | Exclave | 3.69overall 2.05 | WireGuard, VLESS / Reality, VMess, Trojan… | subscriptions; groups; routing; … | — | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscriptions; groups; routing; … |
| 3 | sing-box | 3.50overall 2.37 | WireGuard, OpenVPN, VLESS / Reality, VMess… | JSON config / user-provided… | Yes | Protocols: WireGuard, OpenVPN, VLESS / Reality, VMess…; Clients and configs: JSON config / user-provided…; Obfuscation: yes… |
| 4 | NekoBox | 3.39overall 2.02 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links (Shadowsocks,… | Yes via obfuscated protocols | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links (Shadowsocks,…; Obfuscation: yes (via obfuscated protocols) |
| 5 | NekoBox for Android | 3.39overall 2.02 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links (Shadowsocks,… | Yes via obfuscated protocols | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links (Shadowsocks,…; Obfuscation: yes (via obfuscated protocols) |
| 6 | S-UI | 3.36overall 1.99 | VLESS / Reality, VMess, Trojan, Shadowsocks… | subscription link (link, JSON,… | Yes ShadowTLS/XTLS/naive | Protocols: VLESS / Reality, VMess, Trojan, Shadowsocks…; Clients and configs: subscription link (link, JSON,…; Obfuscation: yes (ShadowTLS/XTLS/naive) |
| 7 | NaiveProxy | 1.96overall 1.58 | NaiveProxy | JSON config (naive binary) | Yes mimics Chrome TLS/HTTP2,… | Protocols: NaiveProxy; Clients and configs: JSON config (naive binary); Obfuscation: yes (mimics Chrome TLS/HTTP2,… |
How NaiveProxy looks like Chrome to a censor
Go-based stealth proxies fake the browser handshake through the uTLS library, which covers the first packet while the session afterwards may still look odd. NaiveProxy instead reuses Chromium's own network code, so the TLS fingerprint and HTTP/2 behaviour match real Chrome.
Traffic flows over TCP in an HTTP/2 CONNECT tunnel; QUIC transport is optional. Connections are multiplexed, and the opening 8 reads and writes of every stream carry padding of random length. The server also resists active probing: a request without the right username and password receives an ordinary website (the probe_resistance option in the Caddyfile).
The 7 tools on this page and what each one gives you
| Entry | Type | Platforms | NaiveProxy | Page score | Bypass |
|---|---|---|---|---|---|
| L×Box | Android client | Android | built in | 4.38 | 8.6 |
| Exclave | Android client | Android | via plugin | 3.69 | 7.6 |
| sing-box | core + official apps | Windows, macOS, Linux, iOS, Android, Apple TV | outbound since 1.13.0 | 3.5 | 6.2 |
| NekoBox | Android client | Android | via plugin | 3.39 | 6.7 |
| NekoBox for Android | Android client | Android | via plugin | 3.39 | 6.7 |
| S-UI | server panel | your server | inbound | 3.36 | 6.7 |
| NaiveProxy (klzgrad) | reference client and server | Windows, macOS, Linux, OpenWrt | native | 1.96 | 2.9 |
None of the seven reaches the main ranking or holds an independent no-logs audit: these are tools without policies, servers or prices to grade, so the network sub-score is 0 for each.
Why the NaiveProxy project itself ranks last
The reference build carries just one protocol, so bypass points come only from obfuscation and manual configuration: 2.9 against 8.6 for L×Box. The other apps ship Hysteria2, Trojan, Shadowsocks, TUIC and VMess (6 of 7), WireGuard (5 of 7) and VLESS Reality (L×Box and Exclave), and censorship resistance weighs 40% of the page score. Security sits at 1.1 because the bare binary documents no kill switch or leak protection. The protocol is strong; the product is a command-line tool with a local SOCKS5 port.
Which client to install on Android, Windows, Mac or iPhone
| Device | Install | Note |
|---|---|---|
| Android | L×Box, Exclave or NekoBox | Exclave and NekoBox need the naive plugin added |
| Windows | sing-box or the naive binary | the binary gives a SOCKS5 port, not a system tunnel |
| macOS, Linux | sing-box or the naive binary | pick a sing-box build that includes the naive outbound |
| iPhone, Apple TV | sing-box | the only iOS option on this list |
| Router | naive binary on OpenWrt | see the project wiki for OpenWrt support |
For NekoBox, use the builds published on GitHub: the copy on Google Play comes from a third party and is not endorsed by the developers.
Running the server: Caddy, domain, certificate, credentials
Set up a VPS with a domain pointed at it, then build Caddy with the naive forwardproxy fork through xcaddy. The ":443" block goes first in the Caddyfile, holding basic_auth with your username and password, hide_ip, hide_via, probe_resistance and a file_server serving a normal site; Caddy fetches the TLS certificate automatically. Source code and stable releases are in the official NaiveProxy repository; track tags, not the master branch, which gets rebased for every Chrome release. S-UI is an alternative: a self-hosted panel that adds NaiveProxy alongside Hysteria2, Trojan and ShadowTLS. Change its default admin/admin login first, and keep in mind that its author positions the project as a learning tool. Updating the client with each release matters most: once it falls behind the current Chrome, the Chrome-identical signature breaks.
NaiveProxy next to VLESS Reality, Trojan and Hysteria2
NaiveProxy wins on fingerprint fidelity, since Chrome's own code does the talking. On reach it trails: 7 entries here versus 48 on the VLESS ranking page and 37 for Hysteria2, and Reality spares you a domain. Hysteria2 is quicker on lossy mobile links but demands UDP, while NaiveProxy rides TCP, an option where networks block UDP, with QUIC as an optional upgrade.
The short answer
Pick L×Box for Android and sing-box elsewhere, then serve it through Caddy with the naive plugin behind a proper domain. None of the seven entries on this page offers a ready-made service with servers; more on self-run setups is on the self-hosted VPN page.
NaiveProxy FAQ
Is NaiveProxy a VPN?
It is a proxy; tunnelling the whole device is the job of whatever client app wraps around it.
Does it work on iPhone?
Only through sing-box among the entries listed here.
Does NaiveProxy support QUIC?
Yes, HTTP/3 over QUIC is offered as an alternative to the default HTTP/2.
Is it free?
All seven entries are free, open-source software with no paid plans on the page.