# Free VPN Subscriptions: a verified feed of public proxy nodes

> This repository publishes a subscription feed of free proxy nodes in Clash, sing-box and v2ray formats, and the interesting part is the filter: a candidate only enters the feed after real HTTP requests have been pushed through it with sing-box, twice, 45 seconds apart. The feed is free because the nodes belong to strangers, which is the trade the reader has to weigh.

**Au1rxx/free-vpn-subscriptions** — Free Clash, sing-box, and V2Ray subscription feed with live node status and setup guides

- Repository: https://github.com/Au1rxx/free-vpn-subscriptions
- Website: https://au1rxx.github.io/free-vpn-subscriptions/
- Stars: 1,099 · Forks: 95
- Language: Unknown
- License: MIT
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/au1rxx-free-vpn-subscriptions

## What the repository publishes and who it is for

This is a subscription feed, not a client and not a VPN service. The repository collects public proxy endpoints from a set of sources, filters them, and republishes the survivors in three formats that popular clients can import directly. The protocols covered are VLESS with Reality, VMess, Trojan, Shadowsocks and Hysteria2, and the clients named are Clash and its forks, sing-box, and the v2rayN and v2rayNG family. The intended user is someone who needs a working proxy right now without a signup, and the second audience is developers who want a rotating set of real endpoints to test a client against, since the feed is regenerated rather than hand-maintained. The README is explicit that the feed is refreshed hourly and that every published node has forwarded real traffic through sing-box shortly before publication.

## Three files, three clients, one copy and paste

The import path is a subscription URL, and there is one per client format. The Clash format is a yaml file, the sing-box format is a json file, and the v2rayN, v2rayNG, Shadowrocket and NekoBox clients take a base64 encoded text file. Each of them is a raw link into the output directory of the repository:

```bash
https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/clash.yaml
https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/singbox.json
https://github.com/Au1rxx/free-vpn-subscriptions/raw/main/output/v2ray-base64.txt
```

Paste the matching link into the subscription import field of the client and the node list is fetched. The output directory also holds database-classified shards, with separate files for stable entries, all verified entries, and further splits by protocol, by country and by network, which is what a reader with a specific requirement would use instead of the general list. The client picks a node, the node forwards the traffic, and the connection dies at some point later. The refresh cycle is what makes that acceptable.

## The verification funnel, stage by stage

The filter is the part of the project worth reading, because it is more careful than the usual port-scan-and-publish approach. First, TCP reachability: a connection to every server and port, which drops dead hosts, bad DNS and blocked ports. Second, for TLS, Reality and WebSocket over TLS nodes, a full TLS handshake, which drops expired certificates, SNI mismatches and broken Reality short identifiers. Third, every survivor is translated into a real sing-box outbound and put through sing-box check, so corrupt ciphers, invalid UUIDs and unsupported flow options are removed before they consume a probe. Fourth, the actual test, where the fastest candidates are batched into sing-box subprocesses, each with its own local SOCKS5 inbound, and real HTTP and HTTPS requests are pushed through the proxy protocol itself, expecting a 204 from the Google connectivity endpoint and a 200 from the Cloudflare trace endpoint. Fifth, the whole run is repeated after 45 seconds, and a node has to keep at least half of its results to stay. Sixth, the survivors are ranked by median HTTP round-trip time rather than raw TCP ping.

## What the funnel still cannot tell you

The README has a section on what the pipeline cannot verify, and it starts with bandwidth: the project measures latency, not throughput, so a fast-responding node can still be useless for video. The second is geolocation precision, since a GeoIP database reports the country of the exit address and not more than that. Everything else follows from what the mechanism is. A node is a machine belonging to someone who has not been identified, so the reader is trusting an unknown operator with the traffic, and the verification says nothing about what that operator does with it, because the checks prove that requests get through, not that they are handled honestly. The feed is also a snapshot of public endpoints, so a node that passes today may be gone tomorrow, and the two-round filter with a 50 percent success threshold is a statement about recent behaviour rather than a guarantee.

## How the feed is produced and where it lives

The pipeline pulls from a set of public sources and writes its results into the output/ directory of the repository, which is why the subscription URLs are raw links to that directory rather than to an API. A typical run described in the README starts from 17 sources and about 4,800 raw entries, and the funnel reduces those to roughly 2,900 that complete a TCP connection, 2,600 that pass TLS, 840 that validate as sing-box configurations, around 280 that answer the HTTP probes, and finally the top 150 by median latency are published. Those numbers are the project describing a recent run, not a guarantee for the next one. The repository also carries docs/, an assets/ directory with the images used in the README, and a set of six translated READMEs covering Chinese, Japanese, Korean, Spanish, Portuguese and Russian, alongside AGENTS.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md and SECURITY.md.

## The commercial pitch inside the README

The README carries a repeated promotion for a named commercial VPN application, with a banner at the top, a section offering one-tap connections on iPhone, Android, Windows and Mac, and a line telling the reader that free nodes come and go every hour. It also asks for stars on the repository and states that this is the signal used to decide what to keep building. None of that is hidden, which is more than many projects manage, but an engineer assessing trust should notice the shape of it. The subscription feed is free and the code in the repository is MIT licensed, while the promotional product is a separate commercial service, and the README asserts that star counts are the signal for continuing the work. The verification pipeline may be as careful as it claims, and the promotion is still part of the page you are reading.

## A free node feed next to a paid or self-run proxy

The alternative approaches differ on one axis, who operates the exit. A paid provider operates it, which means a contract, a known data policy, support when something breaks and a monthly cost, and in exchange the exit address is stable and the throughput is predictable. A self-hosted proxy on your own machine or your own small server is the same idea with the operator being you, at the cost of the server and the traffic. This feed is the opposite end of that axis: nobody is paid, nobody is accountable, and the exit is a stranger's connection. What you get in exchange is zero cost, zero signup, several protocols to test against, and a list that changes every hour. For a developer checking whether a client handles Reality or Hysteria2, that is a better deal than for someone who needs their traffic to stay private.

## Licence, snapshot tags and the state of the feed

The repository is released under the MIT licence, with a LICENSE file at the root and a SECURITY.md for reporting problems, and the code that produces the feed is therefore readable and reusable even though the nodes themselves are not yours to redistribute as a service. The release history shows a different naming scheme from a normal software project: the tags are feed snapshots, for example feed-20260419-023716, which records the moment the feed was captured rather than a version of a tool. The most recent of those snapshot tags is dated 2026-04-19, while the last push was on 2026-10-19 and the README describes hourly refreshes, so the repository history rather than the release list is the timeline that reflects the current feed. Anyone building a dependency on those URLs should therefore treat the main branch as the moving target and pin a commit if they need stability.

## Conclusion

The free-vpn-subscriptions feed fits a reader who needs a working proxy in the next five minutes on a machine where signing up for a service is not an option, and it fits as a test corpus for proxy clients, since the feed spans several protocols and is regenerated rather than curated by hand. It does not fit anything where the identity of the exit operator matters, where throughput matters, or where an outage is expensive, because the operators are unknown and the verification only measures reachability and latency. Before using it, read the SECURITY.md file, treat every node as untrusted, and check the protocols and shards under output/ rather than assuming the top list suits your client.

## FAQ

### How do I import the free node feed into my client?

Paste the raw link for your client format into its subscription import field: the clash.yaml file for Clash and its forks, the singbox.json file for sing-box, or the v2ray-base64.txt file for v2rayN, v2rayNG, Shadowrocket and NekoBox.

### How does the project verify that a node actually works?

Each candidate has to pass a TCP connection, a full TLS handshake where the protocol uses TLS, a sing-box configuration check, and then real HTTP and HTTPS requests pushed through the proxy with its own local SOCKS5 inbound, expecting a 204 and a 200. The run is repeated 45 seconds later and a node is kept only if it keeps at least half of its results.

### Which protocols are included in the subscription?

The README lists VLESS with Reality, VMess, Trojan, Shadowsocks and Hysteria2, and the output directory also holds shards split by protocol, by country and by network.

### What can the verification pipeline not tell me about a node?

The project says it cannot measure bandwidth or throughput, only latency, and that geolocation is only as precise as a GeoIP database. It also does not establish who operates the node.

### How often is the feed refreshed?

The README describes an hourly refresh, and the subscription links point at the output directory of the main branch rather than at a fixed release, so the contents change as the pipeline reruns.

### Which licence covers this repository?

The MIT licence, with a LICENSE file at the root of the repository, alongside SECURITY.md and CONTRIBUTING.md.

## Sources

- [Au1rxx/free-vpn-subscriptions on GitHub](https://github.com/Au1rxx/free-vpn-subscriptions)
- [License: MIT](https://github.com/Au1rxx/free-vpn-subscriptions/blob/main/LICENSE)
- [Project website](https://au1rxx.github.io/free-vpn-subscriptions/)
- [README](https://github.com/Au1rxx/free-vpn-subscriptions/blob/main/README.md)
- [Releases](https://github.com/Au1rxx/free-vpn-subscriptions/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/au1rxx-free-vpn-subscriptions