Trojan VPN: Where to Get a Trojan Server and Which Apps Connect to It

How Trojan hides inside plain HTTPS

The client first establishes a real TLS handshake. Only then does it pack the 56-character hex SHA-224 digest of the password, a SOCKS5-style request (CONNECT or UDP ASSOCIATE) and the first data chunk into that same packet. A valid request gets relayed onward; anything with a wrong hash or malformed structure lands on a preset endpoint, by default a web server on port 80, so an active prober sees a boring site. Passive observers see HTTPS, which makes a valid certificate the operator's job. The protocol description documents the byte layout. Implementations include the stalled trojan-gfw original, Trojan-Go with multiplexing and AEAD, and Trojan inbounds in Xray-core and sing-box, which power most of the clients and panels on this list.

Providers that run Trojan servers for you

Their bypass sub-scores sit within a narrow band (8.1, 7.1, 7.1), so the real differences lie elsewhere. Xeovo provides setup guides for desktop, mobile and routers, and publishes nothing about a kill switch, DNS leak protection or a security audit, which pins its security score at 1.1. StelsVPN demands an email and advertises VLESS with Reality and uTLS, yet its no-logs claim has no audit behind it, hence privacy 1.3. CitadelVPN is the only one of the 41 listed here with an independent no-logs audit. It allows unlimited devices, accepts crypto payment, and reserves its WireGuard and OpenVPN config files for the MAX plan.

Further down: TorGuard at 4.61 (USA, €9.45 month to month, 7-day refund), VPNEU at 4.49 relying on third-party clients like Hiddify and v2rayNG (from €1.08 a month), and Nyx VPN at 4.34, €0.71 a month on a yearly plan but iPhone-only.

Apps, cores and panels: what the other entries do

These entries score zero on network and poorly on privacy for one plain reason: they publish no servers, no no-logs policy and no audits, so the bypass marks come purely from protocol support. Trojan itself adds just 1 of 10.5 bypass points (stealth mode gets 2, VLESS Reality 1.5), which is why the bare trojan-gfw build sits last at 1.87.

Self-hosted Trojan that survives active probing

Point a domain you own at the VPS, obtain a Let's Encrypt certificate, listen on port 443 and put a real website behind the fallback. A self-signed certificate can work, but only when you pin it on every client. A password typo passes the TLS handshake, fails authentication and lands on the fallback too. The log line "not trojan protocol" marks a different case: the first packet had no Trojan structure at all, being shorter than 58 bytes or lacking the carriage return at byte 57, which usually means a scanner or a client configured for another protocol. Either way, make sure the fallback serves real pages. On public networks the Xray docs call for Mux, because raw TLS-in-TLS becomes detectable.

Trojan or VLESS Reality

Trojan presents your own domain and certificate; VLESS Reality borrows the handshake of a real third-party site, so it needs neither, and it identifies clients by UUID instead of a password hash. If censors in your network have learned to spot Trojan, the VLESS ranking and the VLESS vs Trojan comparison cover the alternative.

Trojan VPN FAQ

Which route fits you

Need it working tonight: pick a provider; the top three cost €1.38 to €3.99 a month on long-term plans, and only CitadelVPN brings an independent audit plus unlimited devices. Already running a VPS: install 3X-UI or Hiddify Manager, add a domain and certificate, and keep a live site behind the fallback. For a Trojan profile from a provider or your own server, Hiddify on Android and desktop, or Shadowrocket on Apple devices, imports it from a link or subscription. And where Trojan gets blocked, switch to VLESS with Reality.