Censorship bypass

TLS fragmentation

All platforms · default off

Splits the TLS handshake so DPI systems can't match the SNI in a single packet. A provider can also drive it for its own users via a subscription header, and that value wins over your toggle — including when the provider turns it off. Your toggle applies only when the provider sends nothing. Defaults suit most blocking setups — change them only if a specific network needs it.

Parameter	Default · meaning
packets	tlshello — which packets to fragment
length	50-100 — fragment size range, bytes
interval	10-20 — delay between fragments, ms
maxSplit	empty — optional cap on the number of fragments

Full technical reference and the provider-side header are in the developer docs → TLS fragmentation.

Noise packets

All platforms · default off

Sends junk data before the handshake so DPI can't recognise the start of the connection. Works alongside fragmentation — the two share the same egress and don't conflict.

Parameter	Default · meaning
Type	rand — Junk content: rand, str or hex
Packet	50-100 — Junk packet size range, bytes
Delay	10-20 — Delay before the handshake, ms

⚠ As with fragmentation, the provider's setting takes precedence over yours — including when the provider turns it off. That's deliberate: noise has to match what the server expects.

Server address over DoH

All platforms · default off

Looks up the server's address over HTTPS before connecting. Use it where the local DNS returns a forged answer for the server's domain — without it the app would get a wrong address and never connect.

Parameter	Default · meaning
DoH resolver	dnsforge.de — Which resolver to ask
Resolver IP	empty — Address of the resolver itself, for networks where even its domain is poisoned

If the resolver doesn't answer within a second and a half the normal lookup is used — the setting can only help, never block a connection. The provider's setting takes precedence over yours.