v1.5.0

What's new

XHTTP support. VLESS over XHTTP now works through embedded Xray-core, with TLS or Reality, all four transport modes and extra settings from panel-generated links. No separate Xray installation needed.

Your own server through zapret2. Zarp now tests combinations of strategies and servers, checks each twice and connects with the best pair. The country filter and your own strategies apply here too, and zapret2 stays active while connected.

Subscriptions. Paste an HTTPS subscription URL instead of a single server link. Plain-text and base64 lists are supported. Zarp remembers the servers, refreshes the list after 12 hours when connecting and keeps the previous list if the update fails.

ECH and clearer errors. Added TLS Encrypted Client Hello support. Unsupported link parameters are reported by name, and XHTTP connection errors include the reason from Xray.

Connection handling. Added safeguards against Xray traffic looping through the tunnel, coordinated shutdown of Xray and sing-box, and cleanup when the Xray bridge stops unexpectedly.

Bigger file. Zarp.exe is now about 31 MB because Xray-core is embedded. It is unpacked and started only for XHTTP connections.

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 94da596953858bb3f236026218068be5220addc32af7b7f46df4bf758af3c086

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Code signing policy

Third-party software inside Zarp.exe. Zarp's own code is MIT. The file also carries unmodified upstream programs: zapret2 with WinDivert and the Cygwin DLL (MIT, LGPL-3.0), sing-box with Wintun (GPL-3.0-or-later) and Xray-core (MPL-2.0, with GPL-3.0-or-later modules inside). Versions, license texts and the places to get their source code are in THIRD_PARTY_NOTICES.md. The same texts are in the program: Settings, Licenses.

Full Changelog: v1.4.0...v1.5.0

v1.4.0

What's new

Your own server instead of WARP. Paste one VLESS, Trojan or Hysteria2 link in Settings → Server and endpoints and Zarp connects through it with TCP and UDP, no WARP client needed. Supported: TCP, WebSocket, gRPC, HTTPUpgrade, TLS, Reality, Vision and uTLS for VLESS, Salamander for Hysteria2. One link only: no subscriptions, XHTTP or port hopping. The mode is new, so reports are welcome: attach zarp.log (it shows your server address, remove it first).

Routing and programs. With your own server you can also choose where traffic goes. Presets for local networks, Russia, Iran and China; edit them or add your own, with Direct, Proxy and Block groups (IP ranges, domains, full:, keyword:, regexp:, geoip:, geosite:). Block wins over Proxy, Proxy over Direct, and local networks stay direct unless a rule says otherwise. A wrong rule is reported with its line number, and a missing database or an unknown category stops the connection instead of being skipped. You can also send only the programs you pick through the server; an empty selection never falls back to all programs.

GeoIP and GeoSite. Download or update V2Ray/Xray .dat databases from an address you can change (the default is Loyalsoldier/v2ray-rules-dat). A failed update keeps the previous database. Ranges of Russia, Iran and China are built in until you download your own GeoIP.

Strategies by country. A new filter for Russia, Iran and China (one or several) covers the list, both scans, auto-connect, rechecks and saved results. Your own strategies in strategies.txt can add a fourth column such as ru,ir,cn; old three-column lines keep working.

New strategies (19). Added TLS split at the host, sld and endhost points and a QUIC fake google x12.

Your own WARP endpoints. List IP:port or [IPv6]:port addresses, one per line, in Settings → Server and endpoints. Searches and rechecks rotate through them, and the connection uses the address that passed the check. An empty list brings the defaults back. The addresses must be real WARP endpoints.

Hardening. sing-box starts only if the file is byte for byte the one embedded in Zarp.exe. The configuration with your password is deleted right after start. Your server is checked before any network adapter exists, and sing-box is stopped at once if the adapter passes no traffic.

Bigger file. Zarp.exe is now about 18 MB because sing-box 1.13.14 is embedded. It is unpacked only when you use your own server, and it brings the Wintun network driver, which Windows installs the first time an adapter is created. Licenses are in the third-party notices.

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 32d527b8dec6d556fa727701764279c89a0c7b2327434530b819fdee894a4cc0

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Code signing policy

Full Changelog: v1.3.0...v1.4.0

v1.3.0

What's new

Another VPN no longer ruins your results. A search while another VPN (Happ, v2rayN, Clash, ...) is on now asks first, and failures from such a run are never saved, so working strategies are not overwritten. Connecting with a saved strategy still works.

New strategy set (15). Added TLS disorder on SNI points, disorder with seqovl and a gosuslugi fake, QUIC IP fragmentation and a x11 fake, plus WARP endpoint port 8095. Removed the built-in WireGuard strategies and close variants.

More honest results. Quick scan counts only confirmed strategies, and a connection counts only if traffic really goes through WARP. Zarp notices a dropped tunnel within 15 seconds.

Hardening. The WARP installer and warp-cli are checked by the certificate's organization, system tools run from absolute paths, settings are saved atomically with a backup, a failed zapret2 update rolls back, and Windows shutdown is no longer blocked.

Behavior change. --autostart now only starts Zarp in the tray. Connecting on start is controlled by the "Connect when Zarp starts" setting or --connect.

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 8fa5e2f47f98a9f74a7104e0f370b4e412555950c73b63cd66e0ae9170178514

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Code signing policy

Full Changelog: v1.2.0...v1.3.0

v1.2.0

What's new

• Cloudflare WARP is installed for you. If it is missing, Zarp asks once, downloads the official installer from Cloudflare, checks its signature and installs it, then carries on. No separate setup.
• Better WARP detection. Zarp now finds WARP via the Windows service, the installed programs list and every drive, and writes what it looked at to the log.
• If the Cloudflare site is blocked, put Cloudflare_WARP.msi into %LOCALAPPDATA%\Zarp and Zarp installs it after verifying the signature.

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 524e74281362c7d685ebf03167a0fa7a170dc3dda312bdb80b3cdc241627b528

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Code signing policy

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's new

• 8 languages: English, Русский, Español, Português, 中文, हिन्दी, Français, Deutsch. Zarp follows the Windows language (English otherwise); the globe button next to Settings switches it on the fly.
• Quick scan and Full scan. Quick scan stops after N working strategies (3 by default). Full scan tests every strategy, so nothing is skipped.
• While a search runs, Cancel takes the place of the scan buttons.
• Test results are stored language-independently and follow the chosen language.

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 4b706ffdea213ef0ab40279b7293e9063c8a271ad5a64bf8fe2518160835522a

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

v1.0.3

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: 1a66b614dbfd95342d14e8cb7e84245f686c3e7396cc5c8b1c564cad8b51caa1

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Full Changelog: v1.0.2...v1.0.3

v1.0.1

This release is unsigned. Windows SmartScreen may show an unknown-publisher warning.

Zarp.exe SHA-256: d002953089eede39db1f4b0c14018b99ebb4a9350e42525d16d7e42ff2f2dfe7

Check that the file was built by GitHub Actions from this repository:
gh attestation verify Zarp.exe --repo feg55/Zarp

Full Changelog: v1.0.0...v1.0.1

v1.0.0

First public release of Zarp: one-click Cloudflare WARP for networks that block it.

Zarp finds a zapret2 strategy that gets the WARP handshake through DPI, remembers it and connects. No config files, no command line.

Download

Zarp.exe (1.7 MB). A single file, no installer. zapret2 v1.0.5.2 is embedded.

Highlights

• One button. The first click finds the fastest working strategy, later clicks connect instantly.
• Strategies built for WARP. 17 profiles aimed at the WARP handshake: MASQUE over QUIC, WireGuard and the MASQUE HTTP/2 fallback. The fakes are real QUIC/TLS/STUN packets of services that are not blocked.
• Honest testing. Each test hits a fresh WARP endpoint and every candidate is checked twice, so a strategy can't pass on the back of a previous connection.
• Self-healing. If the saved strategy stops working, Zarp tries the other verified ones before searching again.
• Auto-updates zapret2 in the background. If WARP is connected, the update applies without dropping the tunnel. If the new version fails to start, Zarp rolls back.
• Low overhead. Only WARP addresses and handshake packets are intercepted. Your other traffic and the tunnel itself never go through zapret.
• Tray mode, autostart with Windows, custom strategies via strategies.txt.

Requirements

• Windows 10 or 11, x64
• Cloudflare WARP installed (winget install Cloudflare.Warp)
• Administrator rights (required by the WinDivert driver)

Getting started

1. Run Zarp.exe and accept the UAC prompt.
2. Press the power button. The first search takes a minute or two.
3. That's it. The next time you open Zarp, one click connects.

Good to know

• Turn off other VPNs (Happ, v2rayN, Clash, AmneziaVPN, ...) before searching. WARP traffic would go through their tunnel and no strategy would be found. Zarp warns you if it detects one.
• Windows Defender may flag WinDivert as a hacktool. This is a known false positive for every zapret build. If it happens, Zarp offers to add its folder to Defender exclusions.
• Zarp keeps its settings, log and zapret2 files in %LOCALAPPDATA%\Zarp.
• Zarp changes the WARP tunnel protocol and, during the search, the endpoint. The endpoint goes back to automatic once the search is done.

Credits

zapret2 by bol-van, WinDivert, Cloudflare WARP.