v2rayNG: the Android V2Ray client that ships its own Xray core

What v2rayNG actually is, and who it is for

v2rayNG is an Android client for the V2Ray protocol family. The README describes it as "A V2Ray client for Android, support Xray core and v2fly core", and the repository is written in Kotlin. It does not provide servers, subscriptions or bandwidth. It connects an Android device to a V2Ray-compatible endpoint that you supply.

That distinction decides the audience. If you administer an Xray or v2fly server, or you have been handed a share link or subscription URL by someone who does, v2rayNG is the piece that turns those credentials into a working VPN tunnel on the phone. If you have no server and no link, the app has nothing to connect to. The README never advertises a hosted service, and there is no sign-up flow described anywhere in it.

The project is one half of a pair. The README's tip says v2rayNG is the mobile version and directs desktop users to v2rayN, a separate repository by the same author. Treat them as two clients sharing a protocol and a maintainer, not as one product with two builds.

How the Xray and v2fly cores get into the APK

The interesting architectural detail is that the proxy engine is not written in Kotlin. The README's development guide states that the Android project under the V2rayNG folder can be compiled directly in Android Studio or with the Gradle wrapper, but warns that "the v2ray core inside the aar is (probably) outdated".

The core arrives as an .aar artifact, and the README names two Go projects that produce it: AndroidLibV2rayLite and AndroidLibXrayLite. Those are built with Go Mobile. So the data path is: Go core compiled to an Android library, wrapped in an aar, linked into the Kotlin application, which supplies the UI, the VPN service and the configuration handling.

That layout explains a maintenance pattern worth knowing about. A release of v2rayNG can ship without the bundled core being current, because updating the core means rebuilding the aar in a different repository first. The README says so plainly rather than hiding it. If you need a specific upstream Xray fix, the version number of v2rayNG is not sufficient evidence that you have it.

GeoIP and GeoSite data sit alongside the core. The README states that geoip.dat and geosite.dat live in Android/data/com.v2ray.ang/files/assets, with the caveat that the path may differ on some devices. The in-app download fetches an enhanced set from the Loyalsoldier/v2ray-rules-dat repository, and the README notes that this download "needs a working proxy".

Installing v2rayNG and importing a first config

There is no Play Store listing described in the README. Distribution is through GitHub releases, and the README's download section points only at https://github.com/2dust/v2rayNG/releases. The most recent releases listed are 2.3.5, 2.3.4 and 2.3.3.

Release files are GPG signed. The README gives the fingerprint so you can check a downloaded APK before installing it:

7694 5E9F 3E9A 168F 8070 F195 805D 661C
134D FAF6 8903 C199 463C 31E5 AE90 3AE0

After installing the APK, the app will ask for VPN permission, because it routes traffic through Android's VPN service. If you are running it on Windows Subsystem for Android rather than a phone, the README gives the exact command needed, since the normal permission prompt does not appear there:

appops set [package name] ACTIVATE_VPN allow

Replace the bracketed placeholder with the package name of the installed app. The README does not spell out that package name in this context, so read it from the installed application rather than guessing.

For the configuration itself, the README does not walk through importing a share link or subscription. It covers GeoIP assets and development, and defers the rest to the project wiki at https://github.com/2dust/v2rayNG/wiki. That is where a first-time user should look for the actual import steps.

The GeoIP download that needs a proxy to download

The GeoIP and GeoSite handling has a circular dependency that the README admits to without resolving. The in-app download feature pulls an enhanced rule set from Loyalsoldier/v2ray-rules-dat, and the README attaches a parenthetical: "note: it needs a working proxy".

So the routing data that helps you route traffic correctly is fetched over a connection you may not have yet. On a fresh install with no working config, that download can fail. The escape hatch is manual: the README says the latest official domain list and IP list can be imported by hand, and that third-party .dat files can be dropped into the same assets folder, citing the h2y external domain file format as an example.

If you are setting up a device for someone else, or preparing a phone before travel, fetch and place the .dat files while you still have connectivity you trust. The assets path the README gives is Android/data/com.v2ray.ang/files/assets, and it warns the path may differ on some devices, so confirm the folder exists before copying.

Where v2rayNG is the wrong choice

The clearest boundary is platform. The README's tip is explicit that v2rayNG is the mobile version and that desktop users should visit v2rayN. If you need a Windows machine covered, this repository is not the answer, and neither is it for iOS. There is no iOS client mentioned anywhere in the README.

The second boundary is that v2rayNG is not a VPN service. It has no servers of its own. Anyone arriving from a search for a free VPN will find an app that asks them for configuration they do not have.

Third, the bundled core may lag. The README's own warning that the aar's core is "(probably) outdated" means you cannot assume a freshly downloaded v2rayNG contains the newest Xray or v2fly code. For most users that is irrelevant. For someone chasing a specific protocol change or bug fix, it matters, and the only remedy the README offers is building the aar yourself from AndroidLibV2rayLite or AndroidLibXrayLite.

Finally, the README does not document rollback, downgrade paths or how to migrate configurations between versions. If a release breaks your setup, the README gives you nothing to fall back on.

v2rayNG compared with v2rayN and with bundled clients

The comparison the project itself makes is v2rayNG against v2rayN. They are not competitors so much as two builds of the same idea: v2rayNG is the Android client, v2rayN is the desktop one, and the README frames the choice purely as mobile versus computer. If your work spans a phone and a laptop, you are running two applications that share a protocol and a maintainer, not one account.

The other real alternative is a client that bundles its own servers and its own core, where the user installs one app and gets a working tunnel without supplying anything. That approach trades control for convenience. With v2rayNG you choose the server, which means you also carry the responsibility for it being reachable and configured correctly. Neither model is strictly better, but they attract different users, and the README's silence on provisioning makes clear which side v2rayNG is on.

Licensing is a third axis. v2rayNG is GPL-3.0. If you intend to redistribute a modified build, that licence carries obligations the README does not explain. Anyone planning to ship a fork should read the LICENSE file rather than rely on this article.

Maintenance, releases and what to verify before trusting a build

The repository is not archived, and the last push was on 2026-08-20, the same date as the 2.3.5 release. Releases 2.3.4 and 2.3.3 landed on 2026-08-14 and 2026-08-07, so the project has been cutting versions at a fairly steady rhythm through August 2026.

Upgrade cost is low in the ordinary case: download a new APK, install over the old one. The cost that is not zero is verification. The README explains why signing exists, saying release files are GPG signed to help prevent "mirror, ISP, or CDN hijacking". That is a direct statement that the distribution channel is considered untrusted. If you install v2rayNG from a mirror or a third-party APK site rather than the GitHub releases page, you have skipped the only integrity check the project offers.

The licence is GPL-3.0, stated in the repository's LICENSE file and in the repository metadata. This article does not give legal advice; if you plan to modify and redistribute, read the licence text and, where it matters, consult someone qualified.

One more maintenance reality: the AndroidLibXrayLite and hev-socks5-tunnel entries at the top level of the repository are git submodules. A clone without submodules will not have them.

Editorial conclusion

Adopt v2rayNG if you already run or subscribe to a V2Ray/Xray server and want an Android client you can verify by GPG signature. Do not adopt it if you need a ready-made VPN service, an iOS build, or a Windows desktop app; the README points desktop users at v2rayN instead. Before installing, check that the release APK's signature matches the fingerprint published in the README, and confirm your Android version is at least Lollipop. Also verify that your server speaks a protocol your core supports, because v2rayNG is only the client half of the connection.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes