NoDPI fragments the TLS ClientHello so a middlebox gives up

The mechanism is one packet, split badly on purpose

NoDPI launches a local proxy server on your machine and you point your http and https traffic through it. What it does to an outgoing connection is intercept the ClientHello and fragment it.

The default method is fragmentation by SNI. The ClientHello contains a field with the server name, and the proxy splits the message into three pieces: the part before the SNI, the SNI itself character by character, and the part after it. Each piece is given a header indicating the ClientHello type, and then the pieces are sent as a single packet.

The second method is random fragmentation, where the ClientHello is divided into parts of random length, each prefixed with the ClientHello type header, and the whole thing is sent in one package.

In both cases the TLS version is rewritten to 1.3, and the README is careful to say this does not mean your data is then transmitted according to that version's rules. It is a header value, chosen because it is the newest and therefore the one a middlebox is least likely to have a well-tested path for.

The stated theory is that DPI does not have the computing capacity to unpick the result and simply lets the traffic pass. The README attaches a caveat to that: it may stop working.

What the README says it cannot unblock

This is the section to read before anything else, and it is unusually honest. As of February 2026 the README lists services that cannot be unblocked with NoDPI: Instagram, Facebook, X (Twitter), Telegram, WhatsApp, and voice and video in Discord.

For those it points to GoodbyeDPI by ValdikSS or other tools.

The reason given earlier in the document is that each of those services needs a different bypass technique, and those approaches are not implemented because of their complexity and low-level nature. The README also notes that performance on a given site can depend on the provider, since how a site is blocked and by what technical means varies.

It names YouTube as the case that does work, which is how the project describes itself: developed primarily for Russian users as a simpler, if less powerful, replacement for similar tools.

One more boundary, stated separately: NoDPI only works with HTTPS traffic. It will pass HTTP, but only for compatibility, because sites using that outdated protocol are practically not subject to unlock and the program simply forwards the traffic.

Sites blocked by IP address are also listed as unavailable, since no packet rewriting can help there.

Standard library only, and no administrator rights

The implementation constraint is stated twice. The entire code is written exclusively in Python and uses only its standard library, and the program does not use any third-party programs or libraries.

That has practical consequences. The README documents separate paths for running from source, building an executable, and running in Docker. The Dockerfile confirms it: the base image is python:3.11-slim, the build copies src/ into /app, creates a group and a user called nodpi, makes a directory at /tmp/nodpi owned by that user, switches to it and sets the entrypoint to python src/main.py.

The claims about behaviour are equally concrete. The README says NoDPI does not collect and does not send any data about you, does not interfere in system processes, and does not require administrator rights to work. It can be launched by any user without special knowledge.

The rights point matters more than it sounds on Windows, where a proxy that needs elevated privileges cannot run transparently for a normal account. Being able to start it unprivileged is why the feature list calls out easy launching and configuration.

The repository layout supports the minimal-dependency story: a src/ directory, a Dockerfile, the two READMEs, assets, and the blacklist files.

Blacklists are data files you can edit

The program works with a list of blocked domains and can automatically detect blocked websites, and the repository shows how that list is organised. There is a blacklist.txt and a big-blacklist.txt at the root, plus a blacklists/ directory, which suggests several packaged lists rather than one.

The README has a section on additional blacklists, so extending the set is a documented operation rather than a code change. That is the right design for this problem: which domains a DPI blocks changes over time, and shipping the list as text means a user can react without waiting for a release.

The consequence is that a blocklist approach inherits the blocklist's staleness. If a newly blocked domain is not in the file, the proxy has nothing to act on for it.

The feature list also names error and access logging, and says you can see who visited specific websites and when. That is presented as an advantage, and on a corporate network it is the reason to deploy this rather than have each employee run their own.

Two deployment paths, and a corporate one

Beyond running it locally, the README describes building an executable, running in Docker, and adding the program to startup on Windows and Linux. There is a nodpi.spec file at the repository root, and the README documents a process for building the desktop executable.

There is a section on running on Windows 7 as well, which tells you the deployment targets are older than you might assume.

The deployment story the feature list emphasises is integration into a corporate network for use by staff rather than only by an individual. That reframes the tool: it is not only a personal workaround, it is something an administrator points the office network's egress at, which is why the access logging matters and why the no-administrator-rights claim matters less in that setting.

There is a separate Android project, NoDPI4Android, and this repository states that it is the desktop version, so the two are not interchangeable.

Support is organised around a dedicated NoDPI Lab forum for NoDPI, DPI, network filtering and circumvention topics, plus a documentation site.

Three repositories with the same name, and the README says so first

The most important line for anyone arriving at this repository is at the very top, in an IMPORTANT callout. This project is a fork of the repository theo0x0/nodpi, is developed independently, and should not be confused with raspabamos/nodpi.

Three projects, one name. That is a real operational hazard when you are following a link or a search result, and the project is unusually clear about it rather than leaving you to work it out.

It also tells you the lineage: this is a fork, so the behaviour and the blocklists descend from the upstream project, and the divergence is the independently maintained part.

Two READMEs are maintained, English and Russian, which matches the stated primary audience.

The homepage is a GitHub Pages documentation site rather than a separate domain, and the description in the repository topics is explicit that this is about anticensorship and censorship circumvention, deep packet inspection and DPI bypassing, with proxy and Python as the implementation tags. Nothing here is ambiguous about what the tool is for.

Release pace and licence

The repository is not archived and the last push was on 2026-08-26. Recent releases are v2.2 on 2026-05-29, v2.1 on 2025-12-28 and v2.0.1 on 2025-10-10.

The current release line is 2.x, with recent releases in 2025 and 2026.

The licence is GPL-3.0, stated in a badge and in the LICENSE file. For a utility most people run rather than redistribute, GPL is a reasonable choice: it keeps derivatives open, which suits a tool whose credibility comes from being auditable by people who are subject to the same blocking it circumvents.

If you intend to embed it in a commercial product rather than deploy it, that licence is a different conversation entirely, and worth checking with whoever owns that decision before you start.

The repository also carries a CODE_OF_CONDUCT.md and a CONTRIBUTING.md, and the badges at the top link to the visitor count, downloads, release version and last commit.

Editorial conclusion

Use NoDPI if you are on a network that blocks sites by inspecting TLS and you need something that runs without administrator rights or a third-party runtime, since the whole implementation is Python standard library and. Do not expect it to unblock everything: the README states plainly that Instagram, Facebook, X, Telegram, WhatsApp and Discord voice are not handled, and points to GoodbyeDPI instead. Verify first whether your ISP blocks by IP address rather than by inspection, because the README says all sites blocked by IP are unavailable to this approach, and check whether the blacklist files match the sites you actually need.

Frequently asked questions

Official sources

1. GVCoder09/NoDPI on GitHub
2. License: GPL-3.0
3. Project website
4. README
5. Releases