Hysteria 2 VPN

A free, public bring-your-own-profile VPN client for Hysteria 2 and IKEv2. No account, subscription, purchase, invitation, or XOmobile VPN service is required.

Hysteria 2 VPN is a free, public bring-your-own-profile client for Hysteria 2 and certificate-free IKEv2/PSK servers. It is offered to the general public in the App Store territories where it is available and is not restricted to XOmobile or any company or organization. No account, invitation, pre-approval, purchase, subscription, or business relationship is required.

Import a profile for a compatible server that you own, administer, or are authorized to use; review how traffic will be handled; and connect through Apple’s native VPN interface. Hysteria 2 uses the app’s Packet Tunnel over QUIC and TLS 1.3. IKEv2 uses Apple’s system IPsec client with PSK server authentication and EAP username/password authentication.

Features:

• device-wide VPN routing using NetworkExtension;
• certificate-free IKEv2/PSK through Apple Personal VPN;
• IPv4 and IPv6 support;
• TCP, UDP, and DNS through the tunnel;
• local profile storage in Apple Keychain;
• passwords and IKEv2 PSKs supplied to the system VPN only through persistent Keychain references;
• normal certificate validation or optional SHA-256 pinning;
• clear protected, connecting, disconnecting, and blocked states;
• no ads, analytics, or client telemetry;
• replace or delete the local profile at any time;
• supports iOS 15.0 and later.

All features in the app are available without payment. A compatible profile for a server you own, administer, or are authorized to use is required only to establish a VPN connection; it does not unlock app functionality or paid content. XOmobile does not sell or provide VPN access, and the app does not bundle, identify, recommend, link to, or automatically select a VPN service. Whoever operates the configured server can process tunneled traffic and may have separate terms and a separate privacy policy.

Hysteria profiles that disable certificate verification reduce protection against server impersonation. IKEv2/PSK profiles use no certificate and therefore require a strong, private PSK of at least 32 bytes.