Hiddify App: A Sing-box Front End That Reads Everyone Else's Subscription Links
Multi-platform auto-proxy client, supporting Sing-box, X-ray, TUIC, Hysteria, Reality, Trojan, SSH etc. It’s an open-source, secure and ad-free.
At a glance
- What is it?
- Hiddify is a Dart and Flutter proxy client for Android, iOS, Windows, macOS and Linux that wraps the Sing-box tool-chain and imports profiles written for Sing-box, V2ray, Clash and Clash Meta. The judgement: useful if you already have subscription links from a panel, hard to evaluate for anything beyond that because the repository does not document its internals.
- Who is it for?
- Adopt Hiddify if you already hold subscription links or config files from a proxy management panel and want one client on Android, iOS, Windows, macOS and Linux that reads all of them, with delay-based node selection and automatic subscription refresh. Do not adopt it if you need documented internals, a build guide or an audit trail, because the README supplies none of those.
- Can I use it commercially?
- Check first. The repository uses a licence we do not classify automatically, so read its LICENSE file before any commercial use.
- Is it still maintained?
- Yes. The repository last received commits 36 days ago.
- What is it written in?
- Mainly Dart, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The gap Hiddify fills: one client, many panel formats
Proxy panels emit subscription links in whatever format their authors preferred. A user with links from three providers can end up juggling three clients, or converting configs by hand. Hiddify's stated purpose is to remove that step. The README describes it as a multi-platform proxy client based on the Sing-box universal proxy tool-chain, and lists the configuration formats it accepts: Sing-box, V2ray, Clash and Clash Meta. It also claims compatibility with all proxy management panels. That claim is broad and unverified in the repository, but the format list is the concrete part, and it is the reason the project exists. The audience is people who already have a subscription link and want a single application across desktop and mobile rather than a different tool per operating system. The README adds that configurations are tuned for Iran, China and Russia, which tells you the maintainers treat network conditions in those countries as a first-class case rather than an afterthought.
Sing-box underneath, a Flutter shell on top
The primary language of the repository is Dart, and the README credits Sing-box as the underlying tool-chain. That combination implies a Flutter interface driving a Sing-box core, with the Dart layer handling profile import, subscription refresh and the node list, and the core handling the actual proxying. The README names the features that sit in that Dart layer: automatic node selection, a TUN mode, remote profiles, and a display of profile information including remaining days and traffic usage. Delay-based node selection is the one mechanism described in any detail. The client measures latency and picks a node from the result, rather than leaving selection to the user or to the order of entries in the subscription. Traffic and expiry display implies the client parses the metadata that panels attach to subscription responses, which is the same parsing path that handles the four config formats. Everything past that is inference. The repository README does not describe the process model, whether the core runs in-process or as a sidecar, how TUN mode is implemented per platform, or how profiles are stored. If you need those answers, the README will not give them to you.
Installing it on each of the five platforms
The README provides direct download links rather than a build guide. On Android the release assets are Hiddify-Android-universal.apk, Hiddify-Android-arm64.apk, Hiddify-Android-arm7.apk and Hiddify-Android-x86_64.apk. On Windows there are three artefacts: Hiddify-Windows-Setup-x64.Msix, Hiddify-Windows-Setup-x64.exe and Hiddify-Windows-Portable-x64.zip. On macOS the options are a DMG, a PKG and the App Store listing. Linux is served by Hiddify-Linux-x64.AppImage. iOS uses an IPA, and the README also points to the App Store and Google Play listings. The download URLs follow the pattern https://github.com/hiddify/hiddify-app/releases/latest/download/<asset-name>, so the universal Android build is at Hiddify-Android-universal.apk under that path. Note the inconsistency: several of the download links in the README point at the hiddify-next repository rather than hiddify-app, which suggests the project was renamed at some point and the README was only partly updated. That is worth knowing before you script a download. There is no documented CLI, no configuration file path, and no environment variable list in the README, so installation is the graphical client and nothing else.
The licence is unresolved in the repository metadata
The repository metadata reports the licence as NOASSERTION, which means the automated detector could not classify it, and the README does not state a licence either. For a client that handles your traffic, that matters more than it would for a formatting library. Redistribution terms, the right to bundle the Sing-box core, and the obligations attached to the App Store and Microsoft Store builds all depend on terms this material does not contain. This is not a reason to avoid the project, but it is a reason to read the LICENSE file in the repository and the licence of the bundled core before you ship anything built on it. Nothing here is legal advice, and I cannot tell you what the terms are because the README does not say. I can tell you that the metadata field is empty of a usable answer.
Where the documentation stops and the guesswork starts
The README is a landing page. It lists features with emoji bullets, links to builds, and links to translations in Farsi, Russian, Simplified Chinese, Japanese and Brazilian Portuguese. It does not explain how subscription parsing works, what happens when a panel returns a format the client misidentifies, how TUN mode interacts with an existing VPN on the same device, or what the update cadence for the bundled core looks like. The release history is visible and uneven: v2.5.7 in October 2024, then a gap to v4.0.4 in February 2026 and v4.1.1 in March 2026. A jump from 2.x to 4.x with no 3.x release in the list suggests either a rebase or a renumbering, and the README does not say which. The last push date is August 2026, so the project is active, but activity is not the same as documentation. If you are evaluating Hiddify for an organisation rather than personal use, the absence of a build guide and an architecture description is the practical blocker, not the feature list.
What it is not: a router firmware or a self-hosted panel
Hiddify sits at the client end. It consumes subscription links and config files. It does not generate them, and it does not run on a router. If your requirement is to route an entire home network through one tunnel, a client application on each device is the wrong shape, and you want something that runs on the gateway instead. The README mentions compatibility with all proxy management panels, which is a statement about the client's ability to read their output, not about Hiddify providing one. The same distinction applies to the protocol list. Vless, Vmess, Reality, TUIC, Hysteria, Wireguard and SSH are supported in the sense that the client can dial them, and that support comes from the Sing-box core rather than from code written for this project. If your interest is in the protocols themselves, the upstream core is the thing to read. Hiddify's contribution is the cross-platform interface, the import path and the node selection on top.
Maintenance cost and what to verify before you commit
Running Hiddify yourself costs nothing beyond keeping the client updated, since the README states it is ad-free and open source. The cost sits in the dependency chain. The client tracks Sing-box, and when the core changes, the client has to follow. The release dates show that happening on a schedule the maintainers control, not one you control. On managed devices, the Windows MSIX and the App Store builds add their own update paths, so you may end up with two update mechanisms to reason about. Before adopting, check four things in the repository rather than the README: the LICENSE file, the build instructions if any exist outside the README, the release notes for v4.0.4 and v4.1.1 to see what changed across the major version jump, and whether the download links for your platform resolve to hiddify-app or the older hiddify-next name. Those four checks take minutes and answer questions the README leaves open.
Editorial conclusion
Adopt Hiddify if you already hold subscription links or config files from a proxy management panel and want one client on Android, iOS, Windows, macOS and Linux that reads all of them, with delay-based node selection and automatic subscription refresh. Do not adopt it if you need documented internals, a build guide or an audit trail, because the README supplies none of those. Before installing, verify the licence terms and the provenance of the release artefact for your platform, since the repository metadata reports the licence as NOASSERTION and the README does not state one.
Community notes