Stealtify docs

The short version

This part is for anyone opening Stealtify for the first time. There is not a single setting in it — only what is worth understanding before you install. Five minutes here saves most of the questions later.

What this app is

Stealtify is an Android app that decides which route the traffic of each program on your phone takes. Some programs you send through your server; others carry on directly. The decision is made per program, not for the whole phone at once.

Ordinary VPN apps work the other way: they move the entire phone through the server. That breaks the programs that expect your usual address — banking apps, government services, a delivery service. Stealtify does not do that: anything you have not ticked keeps working as before.

The app does not provide a server. It knows how to use one you already have access to — your own, or one you obtained from a provider. That is the key difference from services where the server comes with the subscription.

Six words you will meet

These words are used constantly further down the documentation. Understanding them once is enough.

Server

A computer elsewhere, belonging to someone else, through which your traffic travels. You either rent it yourself or get access from a provider.

Config

The set of details needed to connect to a server: address, port number, password or key. It usually arrives as one long line of text or as a QR code image. A config is not the server itself — it is the pass to it.

Tunnel

A protected passage between the phone and the server. While it is up, what you send is readable at the two ends only, not along the way.

Transport

The way the tunnel is built. There are several, and they differ in speed and in how noticeable they are on the network. You do not choose one by hand: it is written inside the config and the app reads it for you.

Subscription

One link that stands not for a single server but for a list. The provider updates the list on their side, the app re-reads it on its own roughly every 12 hours, and the "Refresh" button pulls in new servers right away.

Group

A shelf you put programs on. The shelf has one server for all of them. Change the server on the group and the route changes at once for every program on it.

What it takes to make it work

The app is only half of it. The other half is yours.

• A phone on Android 10 or newerRoot is not needed and the firmware stays as it is. The version is in the phone settings, under "About phone".
• Access to a serverEither your own server, set up by you, or access obtained from a provider. Without it the app installs but has nowhere to connect.
• A config or a subscription linkThat line of text or QR code. It is the only thing you will paste by hand, and you do it once.

What makes Stealtify different

Four things that others have individually and rarely together.

• Rules for programs and for sites on one screenThere is no choosing between "the whole phone through the server" and "nothing through the server". The list of programs and the list of sites sit side by side, and ticks are one tap.
• Several servers work at the same timeDifferent programs can be assigned different servers, and they run at the same moment. There are no profiles to switch by hand.
• Eight ways to connect in one appThe link you already have will most likely fit: the app understands eight common formats and reads them itself. There is no need to keep several clients for different configs.
• Nothing about you is collectedNo account, no analytics, no statistics sent anywhere. Settings and passwords stay on the phone, and keys are held in the protected Android store.

How to choose who to get access from

We do not sell access and we recommend no one — not in the text and not by link. The choice is yours, so here is what to look at. The list works the same for any provider.

• A trial or a refund. A provider confident in their servers lets you try before paying.
• How many devices one access covers. One phone, three, five — the number should be stated up front, not discovered after payment.
• Whether the subscription holds several servers. A single server is a single point of failure: when it goes down there is nowhere to connect.
• Whether the server list is updated. A live subscription pulls new addresses by itself; a dead one keeps whatever it had on the day you bought it.
• How quickly support answers. One question before paying settles it.
• Whether the link opens in a third-party client. If the config works only in the app of the provider, you are tied to them entirely — including their timelines and their decisions.
• Whether they ask for more than they need. Issuing access requires neither your documents, nor access to your phone, nor passwords to other services.
• A price far outside the usual range is a reason to ask questions, not a reason to celebrate.

Worth knowing in advance

Four things that most often come to light too late.

• A server link is a passwordYour credentials are inside it. Do not post it in open chats and do not forward it to people you do not trust: whoever receives it has exactly the access you have.
• Speed is set by the server, not by the appGoing through a server is always a longer path than going direct. How much longer depends on where the server stands and how many people are on it. The app does not affect this.
• The server sees where you connectThe tunnel closes your traffic to outsiders along the way, but not to whoever runs the server. That is why trusting your provider is not a formality.
• Settings move to another deviceEverything you set up exports to one file and moves to a new phone or to a TV. There is no pasting the configs again — details in the parts below.

Next comes Part 2: the step-by-step first run, config formats, routing rules and troubleshooting.

First run in 5 minutes

A guide for people who already have a subscription or their own server. Stealtify is a client: we do not provide servers, we connect to yours. Work through the steps in order and you will end up with a working "app → group" rule and a backup proxy for when things break.

Installing the APK

1. Download the file

   Open the releases page and download the latest APK. Only take the file from this site or from the update channel — builds in third-party catalogues are outside our control.

   Open the releases page

2. Allow installs from unknown sources

   Android asks for the permission the first time you open the file. It is granted to whichever app you open the APK from: the browser or a file manager. You can revoke it after installing.

3. Open the app

   On the first connection Android shows a system prompt asking to create a VPN connection — that is the standard VpnService dialog and you confirm it once. No root required.

Importing a subscription: three ways

The configuration comes from your subscription seller or your own server. All the client needs is that config, in one of three shapes.

Link from the clipboard

Copy a vless://…, vmess://…, trojan://…, ss://… or awg://… link and tap "Add server" → "Paste from clipboard". The client parses the parameters itself. This is the fastest route when the seller sent the config as text.

QR code

Choose "Scan QR" and point the camera at the code in the seller's dashboard. This is the convenient way to carry a config over from a computer screen without forwarding the link through a messenger.

Backup import

If you have many servers, or you are moving settings over from another device, import the whole configuration. Note that the file replaces your current configuration rather than adding to it — export your own first. The file format and what it holds are covered in Configuration formats.

A rule for an app

Example: all Telegram traffic should go through US VLESS. Open the rules screen, find Telegram in the app list and assign it to the group with the US VLESS proxy. That is the whole rule.

The rule you created is immediately visible on the home screen — you do not have to go looking for it. It switches on and off with a single tap, with no JSON editing and no reconnect.

A rule for a domain

Example: *.youtube.com → US VLESS. On the same rules screen switch to domains, add a domain mask and assign it to the group with the US VLESS proxy. Routing uses the domain from the TLS SNI, so the rule applies to any app that talks to that address.

App rules and domain rules sit next to each other on one screen: you see what is assigned to an app and what is assigned to a domain without switching between different settings sections.

Backup proxy and health checks

Add a second server the same way you added the first and mark it as the backup for the primary one. Turn on the health check: the client periodically probes the primary server and moves traffic to the backup if it stops responding.

The point is that one server going down does not turn into manual reconfiguration: the rules stay as they were, only the server underneath them changes.

Monitoring

The monitoring screen shows how much traffic each app used and which server it went through. The connection log lives there too: connection attempts, errors and health check events.

It is the first place to look when something does not behave as expected — the log usually shows straight away whether the problem is the server, the rule or the network itself.

Installation and updates

Requirements

Android 10 or newer, arm64-v8a only. The client will not install on 32-bit devices or on older versions of Android.

Installation

1. Download the APK.
2. Open the file — if Android asks to allow installs from unknown sources, allow it.
3. Tap Install.

Every build is published with a SHA-256 checksum. Check the downloaded file with Get-FileHash using the SHA256 algorithm and compare the result against the published value.

Updates

The client finds updates on its own: the offer appears on the home screen and in Settings → Updates. The dialog shows the version number and the changelog, with Update and Later buttons. Mandatory updates cannot be postponed.

First run

Add a proxy, tap connect, and confirm the system VPN permission prompt — the status changes to "VPN active".

Rolling back

Android will not install a build with a lower versionCode over a newer one, so rolling back to a previous build by a simple reinstall does not work: the app has to be uninstalled first, which wipes its settings and server list. Export your configuration in advance if a rollback might be needed.

Where to download it

The only official source is update.stealtify.app. The client is not on Google Play and will not be, so Android will ask you to allow installation from unknown sources. Updating from inside the app is the safest route: the built-in update runs over a pinned-certificate connection and its checksum is verified before installation.

Authenticity check

A checksum only confirms that the file downloaded without corruption — it says nothing about who built it. Anyone can rebuild the APK with their own servers and publish it under the Stealtify name, and for a VPN client that is the main threat: a counterfeit build sees all your traffic. So every genuine build is signed with the developer's key, and the app verifies that signature on startup. If the check fails the client does not start: instead of the interface you get a warning that the copy is not genuine and a link to the official source. There is no access to the VPN or the settings in that state, so a counterfeit cannot route your traffic through someone else's server. Nothing is required of you — the check runs by itself.

Builds older than 1.41.0

They cannot update over the network: the Let's Encrypt certificate pinning changed, and an older build cannot verify the update server's certificate. Download the latest APK by hand from the official site and install it over the top — your configuration and data survive, the signing key is the same.

Import and server management

A server can be added three ways: the "+" button for a quick add, the QR scanner, or a subscription URL. The server name is optional — leave it blank and the client fills in "TYPE host". The "Advanced input" button opens the full editor with every field.

Actions on a server card

• Test — checks reachability, shows the latency or the error text.
• Edit — opens the advanced editor.
• Delete — asks for confirmation: "This action cannot be undone."

Advanced editor fields

Every server has the basic fields: name, protocol type, host, port, login and password.

• VLESS, VMess and Trojan — UUID, security (tls / reality / none), transport (tcp / ws / grpc), SNI, ALPN, fingerprint, flow, WebSocket path and host, gRPC service name, REALITY parameters (public key, short ID).
• Shadowsocks — encryption method.
• SSH — host key fingerprint, cipher.
• AmneziaWG — private key, peer public key, preshared key, address (CIDR), DNS, MTU, keepalive, obfuscation parameters Jc/Jmin/Jmax and S1–S4, H1–H4.

Separate from the protocol: a "Use TLS" toggle, and a "Chain" setting — route traffic through another proxy first, then through this one.

Configuration formats

The client parses a link in one of eight schemes:

• SOCKS5 — socks5://[user:pass@]host:port (or just host:port)
• HTTP CONNECT — http://[user:pass@]host:port
• Shadowsocks — ss://BASE64(method:password)@host:port#name
• VLESS — vless://UUID@host:port?params#name
• VMess — vmess://BASE64(JSON)
• Trojan — trojan://password@host:port?params#name
• AmneziaWG — awg://PRIVATEKEY@host:port?publickey=...&address=...#name
• AmneziaWG in the AmneziaVPN app format — vpn://... (same transport, a different link syntax)

SSH has no link scheme of its own: it is set up manually, through the advanced input form.

If a link does not match any of the eight schemes, the client cannot parse it automatically — the parameters have to be entered through advanced input instead.

QR codes

The camera reads both kinds of code: a single server and a subscription. A code larger than 8 KB, or one with an unrecognised link scheme, is rejected before parsing; input over 64 KB is rejected as well.

Configuration backup

Settings → Data → Export saves the whole configuration to an encrypted stealtify_backup.stbackup file — servers, groups and rules. The older JSON format is still accepted on import. An import <strong>replaces the current configuration outright</strong>: the servers, groups and rules you had are deleted rather than added to. So export your own configuration before importing someone else's. The file holds secrets — server keys and passwords — so treat it as sensitive data; the client itself never uploads it anywhere.

Routing rules

Apps are assigned to groups, not to proxies directly. The proxy lives on the group, so the same proxy setting is reused by several apps at once.

Resolution order

For every connection the client works through five steps in order:

Domain masks

A domain rule takes one of three forms: an exact address like example.com, a subdomain like mail.example.com, or a mask like *.example.com. The format is validated on entry. Matching is done against the TLS SNI — the hostname visible while the TLS connection is being set up — not against the destination IP address.

An app with no rule

If an app has no rule and its domain matches no mask, the connection goes direct.

The empty case

While the client has no rules at all, the raised tunnel carries every app's traffic through the proxy. As soon as one rule exists, that changes: the rules decide, and anything they do not cover goes direct.

A limit on matching

DNS-over-HTTPS and IP addresses hard-coded into an app bypass domain matching, because the hostname is never visible to the client in that case. A domain rule will not catch this — route the whole app instead, with an app rule.

Backup server and health checks

Failover is simple: the client checks a proxy before connecting and switches to the backup if the primary one is unreachable or answers too slowly.

Latency threshold

The threshold is a slider from 500 ms to 15 s. If the response latency is above it, the client treats the proxy as unreachable and uses the fallback group. The fallback group is set on the group itself, the same way the primary proxy is.

Manual check

The Test button on a server card shows the response latency or the error text. The "Proxies (check)" screen lists every server with its status, ping and transport type — it is the first place to look when something is not working.

StealtifyTV — the Android TV app

TV sets and boxes get their own app — StealtifyTV. It is not the same APK as the phone one, but the routing is: per-app rules work exactly as they do on mobile.

StealtifyTV is in beta. Android TV support is under active development: expect rough edges and interface changes between versions.

Remote control (D-pad)

Every key action is reachable from an ordinary remote — no touch input is needed at any step.

• Move through the server list with the up and down arrows, select with the centre button.
• Add a server or subscription from the import screen: paste the link with the on-screen keyboard or scan a QR code off your phone.
• Switch the active server by moving focus to its row in the list and confirming with the centre button.
• Connect and disconnect with the Connect button on the home screen — it takes focus first on launch.
• Go back one screen with the remote's Back button.

Opening settings without touch input

From the home screen press up until you reach the top bar, move right to the settings icon and confirm with the centre button. Inside settings the same arrows apply: move vertically through the items, centre button toggles.

Running your own server

Another option is skipping a ready-made subscription and running a server yourself. The general shape is the same for most protocols on the supported list:

Stealtify tech

Stealtify is an Android routing client. It connects to your servers and subscriptions and splits traffic according to your rules. Below: what the client is made of and what exactly it can connect to.

Running your own server

Another option is skipping a ready-made subscription and running a server yourself. The general shape is the same for most protocols on the supported list:

1. Rent a VPS from any VPS provider — the specific choice makes no difference to the client.
2. Install a control panel on the server — 3x-ui, Marzban or Xray, for example — and configure the transport you need.
3. Generate the configuration on your side: the panel hands out a ready link or QR code with the server's parameters.
4. Import that link or QR code into Stealtify the same way you would import any other configuration.

The client does not change anything in this setup: it connects to this server the same way it connects to any other, over one of the eight supported transports.

Troubleshooting

Installation

• The APK will not install. Allow installs from unknown sources, check that the device is arm64-v8a on Android 10 or newer, and remove any existing build signed with a different key.

Connecting

• Nothing happens when tapping Connect. Grant the system VPN prompt, turn off any other active VPN — Android allows only one VPN connection at a time — and make sure at least one server is added.
• "All proxies unreachable". Test the servers with the Test button, check the host, port and credentials, and loosen the failover threshold.
• Connected, but there is no internet. Open the "Proxies (check)" screen, reassign the app to a different group, or temporarily set it to "no group".

Routing

• An app still goes direct instead of through the proxy. Traffic with no rule goes direct by default: assign the app to a group with a working proxy and check that the group is enabled and has a proxy set.
• A domain rule does not trigger. Matching runs against the TLS SNI — check the mask format. DoH and hard-coded IP addresses bypass domain matching: route the whole app instead, with an app rule.

Kill Switch

• DNS bypasses the proxy. Turn on DNS leak protection in settings. Traffic with no rule goes direct by design — that is not a leak in the strict sense.
• The internet disappears entirely after the VPN drops. That is the Kill Switch working as intended: reconnect or turn it off. At the system level, Always-on VPN with "block connections without VPN" produces a similar effect.

Background operation and autostart

• The VPN drops in the background. Exclude the app from battery optimisation and turn on auto-reconnect.
• The client does not start automatically on boot. Turn on autostart on boot in the app settings; on Xiaomi, Huawei, Oppo and Samsung also allow autostart in the system settings and turn off aggressive battery management for the app.

Import, subscriptions and QR

• A subscription returned 0 servers. Check that the URL is a valid http(s):// subscription endpoint with a path, that the link has not expired, and that it is reachable.
• The QR code will not scan. Check camera permission and lighting. Codes over 8 KB and codes with an unrecognised link scheme are rejected.

Individual protocols

• VLESS, VMess or Trojan with TLS or REALITY will not connect. Check the UUID, SNI, fingerprint, flow and transport, toggle "Use TLS", and check the device clock — a clock out of sync breaks the TLS handshake.
• Shadowsocks connects, but no data flows. Check the encryption method — it has to match what the server is set to.

Updates and notifications

• The update loops. Check whether the update channel is reachable, and download the APK by hand if needed. Mandatory updates cannot be postponed — that is intentional.
• The notification shows no traffic stats. Grant the app notification permission.

Backup

• Servers and rules disappeared after I imported a backup. That is by design: an import replaces the current configuration entirely with the contents of the file, and the previous one is deleted. It can only be restored from your own export taken before the import.