◇ Privacy · Censorship-resistant · Native
Works whereother VPNs don't.
Doppler VPN is a censorship-resistant VPN built on VLESS-Reality. Your traffic looks like ordinary HTTPS — undetectable by deep packet inspection. No registration, no logs, no tracking. Native apps on iOS, Android, macOS, and Windows.
▸ Specification
§ 01 · About
A VPN thatstays invisible.
Most consumer VPNs were built for a friendlier internet. They tunnel with well-known protocols, sign transport layers with recognisable fingerprints, and rely on server IPs that blocklists catch within days. The moment a network operator wants them gone, they're gone.
Doppler starts from the opposite constraint: assume the network is hostile. Every connection is wrapped in VLESS-Reality — XTLS-Reality over VLESS — so outbound traffic is indistinguishable from a genuine HTTPS session to a legitimate website. There is no TLS fingerprint to classify, no handshake signature to match, nothing for deep packet inspection to lock onto.
Around the protocol sits a deliberately thin control plane. No account database, no email, no phone number — the device itself is the identity, and a subscription key unlocks connectivity. There is no browsing log, no IP log, no DNS query storage. The privacy claim isn't a policy line; it's a direct consequence of what the infrastructure is built to never store.
The product ships as native apps on iOS, Android, macOS, and Windows, backed by a self-hosted Marzban control plane and geo-distributed edge nodes. Subscriptions are payable through the App Store, Google Play, web checkout, or with BTC, ETH, USDT, and USDC — one plan, up to ten devices, one tap to connect.
§ 02 · DPI bypass · VLESS-Reality
A tunnel thatlooks like nothing.
VLESS-Reality performs a real TLS handshake with a real website certificate. The edge node borrows its TLS identity from a legitimate third-party site, then muxes authenticated client traffic through the same connection. An observer — censor, ISP, or transit provider — sees a completely normal HTTPS session.
Because the signature is genuine, there is no anomaly to detect. Active probes against our servers get a real website back. Only an authenticated client activates the VPN tunnel — which is why Doppler stays online behind TSPU, the GFW, and the same inspection hardware that catches commercial VPNs within hours of launch.
▸ Operational against
- TSPU hardware deployed across Russian ISPs.
- TLS fingerprinting and JA3/JA4 classifiers.
- Active probing of server IPs by censors.
- Domain-level blocks — reachable via Telegram bot.
§ 03 · What's inside
Four moving parts.
VLESS-Reality performs a genuine TLS handshake against a real site certificate. Deep packet inspection sees ordinary HTTPS, not a VPN tunnel — nothing to classify, nothing to block.
The device is the account. No email, no phone number, no personal information. A subscription key unlocks connectivity — accounts we never create can't be breached, subpoenaed, or leaked.
Traffic is routed by destination, not by server list. The client picks the fastest healthy path automatically — no manual server hopping, no stale hops when a region is under load.
Every query is encrypted end-to-end and discarded after resolution. Tracker and malware domains are filtered at the DNS layer across every app on the device, not just the browser.
§ 04 · Infrastructure
How itactually works.
The stack is deliberately small. A self-hosted Marzban control plane issues subscriptions and rotates keys. Edge nodes run VLESS-Reality behind real third-party certificates. Nothing logs. Every layer is picked because it either contributes to unobservability or it doesn't ship.
▸ Stack
XTLS-Reality over VLESS. Zero TLS fingerprint, genuine certificate from a third-party front site, resistant to active probing.
Self-hosted Marzban orchestrates inbound nodes, subscription issuance, and key rotation across every region — no third-party SaaS in the auth path.
Five geo-distributed inbound nodes running the same dual-protocol stack. Failover is automatic; smart routing selects the lowest-latency healthy hop for each destination.
No browsing logs. No IP logs. No DNS query storage. No account database. Privacy isn't policy text — it's what the system is physically able to store.
Defeats TSPU, TLS fingerprinting, and active probing — the stack used by Russia, China, and Iran to block commercial VPNs. Domain on Roskomnadzor blocklist; service still operational via Telegram bot.
Pay through the App Store, Google Play, web checkout, or with BTC, ETH, USDT and USDC. One subscription, up to ten devices, no auto-renewal.
§ 05 · Design system
Cinematic dark,measured accents.
Doppler flattens dark mode to a single page ground and lifts cards with a graduated surface scale. Teal owns primary interaction. Gold is the brand warmth. Violet is reserved for the Pro tier. Amber flags freshness and warnings. Every accent clears WCAG AA on the page bg.
▸ Palette
▸ Typography pairing
Reserved for the landing hero headline on dopplervpn.org. Italic, low contrast, oversized — carries all of the brand warmth without a logotype.
Default for sections, navigation, UI copy and pricing. Weights 400, 500, 600, 700.
Active on ru and uk locales. Matches Space Grotesk's metrics while shipping a full Cyrillic glyph set.
§ 06 · Platforms
Native everywhere.
Native apps on every supported platform — SwiftUI on iOS and macOS, Kotlin on Android, a signed Windows client for x64 and ARM64. One subscription covers up to ten devices. Status syncs across them via a device-bound token, never via an email address.
- 01iOSLIVE
- 02AndroidLIVE
- 03macOSLIVE
- 04WindowsLIVE
◇ Continue
Try the network.
Three-day free trial on iOS. Subscription unlocks every region and every platform. Pay by card, by IAP, or with crypto.