Hitchecker - Network analyzer

See the address the internet sees you at and which DNS resolvers your iPhone is really asking — then open the config links people hand you and see how they grade.

Most tools for proxy configs begin with the config. Hitchecker begins with the network you are already on: the address the internet sees you at, how it is classified, and which DNS resolvers your iPhone is really asking. The links other people hand you come after that.

WHAT YOUR CONNECTION LOOKS LIKE FROM OUTSIDE The Network tab opens with what iOS already knows, before anything leaves: Wi-Fi, cellular or wired, metered, Low Data. Ask for the full check and our server describes the address your request arrived from — the public IP, where it maps to, the operator and network type behind it, and a risk figure with a word beside it. Reputation flags — VPN, proxy, Tor, hosting — appear when they apply.

WHO IS ANSWERING YOUR DNS Which resolvers this device uses is read locally, then identified: operator, country, and whether it is a public resolver or your network's own. Their answers get checked too. Three anchor names — dns.google, one.one.one.one and dns.quad9.net — are looked up twice, once through your own resolvers and once through Cloudflare's public DNS, which nothing on your local network can rewrite. Agreement reads as nothing unusual; disagreement is shown as an observation, with the addresses that came back. A measurement, not a verdict.

AND A SERVER THAT ISN'T YOURS For VLESS, VMess, Trojan and Shadowsocks you can ask whether the server is still alive — five a day free, unlimited on Pro. Your iPhone stays out of it: the link goes to a server we run, which makes the connection itself and reports whether it answered, the round-trip time, throughput each way, and the same portrait of the address traffic would surface from.

WHAT ACTUALLY LEAVES THIS IPHONE No account. No analytics. No advertising. No third-party SDKs. Hitchecker carries none of your traffic and never connects your device to a config you inspect. Only these go out, each at your request: the connection check's own request; the addresses of your DNS resolvers, so the tester can name who runs them; the canary lookups to Cloudflare; the config link you choose to test; a subscription URL fetched from your provider. Both checks sit behind a one-time consent screen, and the tester runs under a no-logging policy for links and IP addresses.

THE LINK ITSELF, OPENED ON THE DEVICE Paste text, scan a QR code, pick a screenshot out of Photos, or send a link from another app. Twelve formats are decoded on the device: VLESS, VMess, Trojan, Shadowsocks, ShadowsocksR, Hysteria, Hysteria 2, TUIC, SOCKS, HTTP proxy, WireGuard and OpenVPN. Each becomes plain labeled rows — transport, encryption, Reality keys, server names, fingerprints, timeouts — and fields Hitchecker cannot place get their own heading. Secrets stay covered until you tap them.

THIRTEEN CHECKS, GRADED NOTE, RISK OR SEVERE Certificate validation switched off, a password in the clear, no transport encryption, ciphers long past trustworthy, an empty server name, sample credentials nobody replaced, half-configured Reality, a WebSocket on a plaintext port. Whatever fires is listed with its grade — Note, Risk or Severe — for everyone, and a clean config is told so in full, paid or not. Pro adds the reasoning behind each finding and what to change.

A LIBRARY THAT CAN BE SWITCHED OFF Free keeps 40 configs and 15 favorites, searchable; Pro removes the ceiling. Want no history at all? Switch saving off and, from then on, no analyzed config is stored on the device — anything saved earlier stays until you delete it, and your own settings are kept locally either way. Any config can be passed on as a QR image, or as a text file when it is too big to scan — large OpenVPN profiles usually are — with a reminder that either carries the password.

PRO, PAID ONCE, NEVER A SUBSCRIPTION Past unlimited testing and history: batch work on many links, a subscription URL or an imported file; two configs compared field by field, where both sides must be the same format; your library exported as Text, Markdown or JSON.