Free-v2ray-Configs: what the tier system actually guarantees

The problem is not finding configs, it is finding live ones

Public V2Ray lists rot fast. A link that worked yesterday is a dead TCP handshake today, and the usual remedy is to paste a hundred of them into a client and click through until something connects. Free-v2ray-Configs attacks the sorting problem rather than the supply problem. Its README describes the pool as aggregated from public sources, then filtered by how much evidence exists that a given config actually works, and published as six tiers. The audience is narrow and specific: people behind filtering who need a working endpoint in a client they already run, and who are willing to accept someone else's server rather than pay for one. The README ships Persian, Chinese and Russian translations, and the repository carries an Iran topic, which tells you where the maintainer expects most of the demand to come from.

Six tiers, and what the verified label really asserts

The tiers are not different upstream sources. The README is explicit that they are the same pool filtered by accumulated evidence. verified means an entry passed a real proxied HTTP request in all three independent test rounds. fast is verified plus a median delay under 800 ms. secure is verified plus forward secrecy plus a link that does not disable certificate validation. Below those sit the wider all, light and heavy groupings, and the README offers all as the swap when you want the largest list rather than the most reliable one. That distinction matters more than the counts. A config that answered a request three times is a config that answered a request three times. It says nothing about who runs the server, whether the operator logs, or whether the endpoint will exist in an hour. The README does not claim otherwise, and the tier table is the most useful thing in the repository precisely because it refuses to blur that line.

The aggregation pipeline and the two JSON files it publishes

The repository is a Python project, not a library. pyproject.toml states this outright: there is deliberately no [build-system] and no [project] table, because adding either would make packaging tools treat the repository as an installable distribution. CI installs from requirements.txt and runs the scripts as plain files. The workflow in .github/workflows/aggregate.yml drives the run, and the badge in the README advertises auto-update every 15 minutes. Two machine-readable outputs sit at the repository root. index.json carries category counts, and health.json carries cascade buckets for verified, fast and secure plus a summary of how many sources are live. The README's own dynamic badges read those files directly, so the numbers on the page cannot drift from the data. requirements.txt pins requests at 2.34.2, PyYAML at 6.0.3 and maxminddb at 3.2.0, and the comments explain that maxminddb reads a DB-IP Country Lite database to determine the server's real country, with geoip2 deliberately excluded because it would pull in aiohttp for what the maintainer measured as an identical result.

Install and first use: you do not install this, you subscribe to it

There is nothing to pip install. The README's start-here section gives a single line to copy, and that line is the whole onboarding. The Top 100 list is the verified tier sorted by median delay and cut at the 100 fastest, which the README describes as small enough to import anywhere. Paste it into your client's subscription field, or point a phone client's scanner at the QR code the README provides, which encodes the subscription URL itself rather than a frozen snapshot.

https://raw.githubusercontent.com/0xRadikal/Free-v2ray-Configs/main/top100.txt

If 100 endpoints is not enough, the README offers the full verified list under the same standard of proof. This is the base64 form, which is what most clients expect for a subscription import.

https://raw.githubusercontent.com/0xRadikal/Free-v2ray-Configs/main/verified/configs_base64.txt

The README names v2rayNG, Hiddify, NekoRay, NekoBox, v2rayN, Clash Meta and Shadowrocket as compatible clients, and publishes each tier in plain text, base64, Clash YAML and sing-box JSON. After importing, the client fetches a fresh list on each refresh, so what you see is the current run rather than the list as it stood when you first pasted the URL. If you want to run the pipeline yourself instead of consuming its output, the repository expects Python and the pinned dependencies from requirements.txt, with scripts invoked as files rather than as an installed module.

What the tiers cannot tell you, and when this is the wrong tool

Reachability testing measures reachability. A config that passes three proxied requests may still be operated by someone who inspects traffic, and the tier names do not address that. The secure tier is the closest the project comes, and its definition is a property of the link rather than a statement about the operator: forward secrecy present, certificate validation not disabled. That is a meaningful filter and it is not a trust guarantee. The second limitation is volatility. A list refreshed every 15 minutes is a list whose contents change every 15 minutes, which is good for freshness and bad for anything that needs a stable endpoint identity. Do not build a long-lived SSH session, a CI runner or a monitoring probe on an endpoint drawn from this pool. The third is that this is the wrong tool entirely for anyone who needs a private tunnel. A public shared endpoint is the opposite of private infrastructure, and no amount of tier filtering converts one into the other.

How it compares with running your own Xray or sing-box instance

The real alternative is not another aggregator. It is renting a small VPS and running xray-core or sing-box on it yourself. The difference in approach is total: this project solves discovery and freshness, while a self-hosted instance solves ownership and stability and gives you nothing on discovery because there is nothing to discover. With your own server you know the operator, you control the transport and the TLS setup, and the endpoint does not disappear when a stranger's machine goes down. What you give up is the zero-cost part and the automatic churn of a pool that is re-tested continuously. A middle path exists and the repository supports it: use the public lists as a fallback while your own instance is your primary route. That is a reasonable arrangement, and it is the one that keeps the tier system in the role it is actually good at, which is filling a gap rather than carrying the load.

Maintenance cost, licensing and the packaging decision

The repository is MIT-licensed, which places few conditions on reuse of the code, though the configs themselves are endpoints operated by third parties and the licence says nothing about them. The maintenance story is unusual and worth reading before you fork. pyproject.toml exists only to pin the linter's rule set, and its comments record a real incident: with no linter configuration, Ruff ran on implicit defaults, and a routine upgrade from the older default selection to the newer one produced 549 findings across 13 files with no project code having changed. The file now pins the rule set so that a linter bump cannot silently rewrite the project's standards. The dependency pins are similarly documented rather than arbitrary, including a note that a requests advisory affecting versions below 2.33.0 was assessed against this codebase and closed. If you fork this, the upgrade cost is concentrated in the pipeline scripts under scripts/ and the workflow file, not in a published package, because there is no published package to upgrade.

Editorial conclusion

Adopt this if you want a subscription URL you can paste into v2rayNG, Hiddify, NekoBox or Clash Meta and you understand that the verified tier means a passed proxied request, not a security audit. Do not adopt it as a private tunnel: every endpoint is public, shared and operated by someone you cannot identify, so anything that must stay confidential belongs on infrastructure you control. Before you rely on it, fetch top100.txt and verified/configs_base64.txt once and confirm the entries parse in your client, then read the secure tier definition in the README and decide whether forward secrecy and certificate validation are conditions you need. The repository is MIT-licensed and last pushed on 2026-09-17.

Frequently asked questions

Official sources

1. 0xRadikal/Free-v2ray-Configs on GitHub
2. License: MIT
3. Project website
4. README
5. Releases